学步园

ObInit会被调用两次，ObpInitializationPhase分别为TRUE和FALSE的时候。

在ObpInitializationPhase==TURE时，创建根目录\和\ObjectTypes
在ObpInitializationPhase==FALSE时，调用ObCreateObjectType，创建\ObjectTypes中下的的Type、Directory、SymbolicLink等。
根目录\和\ObjectTypes

ObInit()
{
…
// 创建根目录\

/* Create the directory */
Status = NtCreateDirectoryObject(&Handle,
                                 DIRECTORY_ALL_ACCESS,
                                 &ObjectAttributes);

…
//将句柄转换成对象
Status = ObReferenceObjectByHandle(Handle,
                                   0,
                                   ObDirectoryType,
                                   KernelMode,
                                   (PVOID*)&ObpRootDirectoryObject,
                                   NULL);

…

// 创建根目录\ObjectTypes
Status = NtCreateDirectoryObject(&Handle,
                                 DIRECTORY_ALL_ACCESS,
                                 &ObjectAttributes);

…

/* Get a handle to it */
Status = ObReferenceObjectByHandle(Handle,
                                   0,
                                   ObDirectoryType,
                                   KernelMode,
                                   (PVOID*)&ObpTypeDirectoryObject,
                                   NULL);

…
}