The Object Name
If the NameOffset member of the OBJECT_HEADER is non-zero, it specifies the inverse offset of an OBJECT_NAME structure with respect to the base address of the OBJECT_HEADER. Typical values are 0[ts]10 or 0[ts]20, depending on the presence of an OBJECT_CREATOR_INFO header part. Listing 3 shows the definition of the OBJECT_NAME structure. The Name member is a UNICODE_STRING whose Buffer member points to the name string, which is usually not part of the memory block containing the object. Not all named objects use an OBJECT_NAME structure in the header to store the name. For example, some objects rely on a QueryNameProcedure() provided by their associated OBJECT_TYPE.
Listing 3 The OBJECT_NAME Structure
typedef struct _OBJECT_NAME
{
/*000*/ POBJECT_DIRECTORY Directory;
/*004*/ UNICODE_STRING Name;
/*00C*/ DWORD Reserved;
/*010*/ }
OBJECT_NAME,
* POBJECT_NAME,
**PPOBJECT_NAME;
If the Directory member is not NULL, it points to the directory object representing the layer in the system's object hierarchy where this object is located. Like files in a file system, Windows 2000 objects are kept in a hierarchically structured tree consisting of directory and leaf objects. More details about the OBJECT_DIRECTORY structure follow in a moment.