windows-xp/Source/XPSP1/NT/base/ntos/ob/obdir.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    obdir.c

Abstract:

    Directory Object routines

Author:

    Steve Wood (stevewo) 31-Mar-1989

Revision History:

--*/

#include "obp.h"
#include <stdio.h>

POBJECT_DIRECTORY
ObpGetShadowDirectory(
    POBJECT_DIRECTORY Dir
    );

//
// Defined in ntos\se\rmlogon.c
// private kernel function to obtain the LUID device map's directory
// object
// returns a kernel handle
//
NTSTATUS
SeGetLogonIdDeviceMap(
    IN PLUID pLogonId,
    OUT PDEVICE_MAP* ppDevMap
    );

NTSTATUS
ObpSetCurrentProcessDeviceMap(
    );

#if defined(ALLOC_PRAGMA)
#pragma alloc_text(PAGE,NtCreateDirectoryObject)
#pragma alloc_text(PAGE,NtOpenDirectoryObject)
#pragma alloc_text(PAGE,NtQueryDirectoryObject)
#pragma alloc_text(PAGE,ObpLookupDirectoryEntry)
#pragma alloc_text(PAGE,ObpInsertDirectoryEntry)
#pragma alloc_text(PAGE,ObpDeleteDirectoryEntry)
#pragma alloc_text(PAGE,ObpLookupObjectName)
#pragma alloc_text(PAGE,NtMakePermanentObject)

#ifdef OBP_PAGEDPOOL_NAMESPACE
#pragma alloc_text(PAGE,ObpGetShadowDirectory)
#pragma alloc_text(PAGE,ObpSetCurrentProcessDeviceMap)
#pragma alloc_text(PAGE,ObpReferenceDeviceMap)
#pragma alloc_text(PAGE,ObfDereferenceDeviceMap)
#endif  // OBP_PAGEDPOOL_NAMESPACE

#endif

//
//  Global Object manager flags to control the case sensitivity lookup
//  and the LUID devicemap lookup
//

ULONG ObpCaseInsensitive = 1;
extern ULONG ObpLUIDDeviceMapsEnabled;


NTSTATUS
NtCreateDirectoryObject (
    OUT PHANDLE DirectoryHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
    )

/*++

Routine Description:

    This routine creates a new directory object according to user
    specified object attributes

Arguments:

    DirectoryHandle - Receives the handle for the newly created
        directory object

    DesiredAccess - Supplies the access being requested for this
        new directory object

    ObjectAttributes - Supplies caller specified attributes for new
        directory object

Return Value:

    An appropriate status value.

--*/

{
    POBJECT_DIRECTORY Directory;
    HANDLE Handle;
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;

    PAGED_CODE();

    ObpValidateIrql( "NtCreateDirectoryObject" );

    //
    //  Get previous processor mode and probe output arguments if necessary.
    //

    PreviousMode = KeGetPreviousMode();

    if (PreviousMode != KernelMode) {

        try {

            ProbeForWriteHandle( DirectoryHandle );

        } except( EXCEPTION_EXECUTE_HANDLER ) {

            return( GetExceptionCode() );
        }
    }

    //
    //  Allocate and initialize a new Directory Object.  We don't need
    //  to specify a parse context or charge any quota.  The size of
    //  the object body is simply a directory object.  This call gets
    //  us a new referenced object.
    //

    Status = ObCreateObject( PreviousMode,
                             ObpDirectoryObjectType,
                             ObjectAttributes,
                             PreviousMode,
                             NULL,
                             sizeof( *Directory ),
                             0,
                             0,
                             (PVOID *)&Directory );

    if (!NT_SUCCESS( Status )) {

        return( Status );
    }

    RtlZeroMemory( Directory, sizeof( *Directory ) );

    ExInitializePushLock( &Directory->Lock );

    //
    //  Insert directory object in the current processes handle table,
    //  set directory handle value and return status.
    //
    //  ObInsertObject will delete the object in the case of failure
    //

    Status = ObInsertObject( Directory,
                             NULL,
                             DesiredAccess,
                             0,
                             (PVOID *)NULL,
                             &Handle );

    try {

        *DirectoryHandle = Handle;

    } except( EXCEPTION_EXECUTE_HANDLER ) {

        //
        //  Fall through, since we do not want to undo what we have done.
        //
    }

    return( Status );
}


NTSTATUS
NtOpenDirectoryObject (
    OUT PHANDLE DirectoryHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
    )

/*++

Routine Description:

    This routine opens an existing directory object.

Arguments:

    DirectoryHandle - Receives the handle for the newly opened directory
        object

    DesiredAccess - Supplies the access being requested for this
        directory object

    ObjectAttributes - Supplies caller specified attributes for the
        directory object

Return Value:

    An appropriate status value.

--*/

{
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;
    HANDLE Handle;

    PAGED_CODE();

    ObpValidateIrql( "NtOpenDirectoryObject" );

    //
    //  Get previous processor mode and probe output arguments if necessary.
    //

    PreviousMode = KeGetPreviousMode();

    if (PreviousMode != KernelMode) {

        try {

            ProbeForWriteHandle( DirectoryHandle );

        } except( EXCEPTION_EXECUTE_HANDLER ) {

            return( GetExceptionCode() );
        }
    }

    //
    //  Open handle to the directory object with the specified desired access,
    //  set directory handle value, and return service completion status.
    //

    Status = ObOpenObjectByName( ObjectAttributes,
                                 ObpDirectoryObjectType,
                                 PreviousMode,
                                 NULL,
                                 DesiredAccess,
                                 NULL,
                                 &Handle );

    try {

        *DirectoryHandle = Handle;

    } except( EXCEPTION_EXECUTE_HANDLER ) {

        //
        //  Fall through, since we do not want to undo what we have done.
        //
    }

    return Status;
}


NTSTATUS
NtQueryDirectoryObject (
    IN HANDLE DirectoryHandle,
    OUT PVOID Buffer,
    IN ULONG Length,
    IN BOOLEAN ReturnSingleEntry,
    IN BOOLEAN RestartScan,
    IN OUT PULONG Context,
    OUT PULONG ReturnLength OPTIONAL
    )

/*++

Routine Description:

    This function returns information regarding a specified object
    directory.

Arguments:

    DirectoryHandle - Supplies a handle to the directory being queried

    Buffer - Supplies the output buffer to receive the directory
        information.  On return this contains one or more OBJECT DIRECTORY
        INFORMATION structures, the last one being null.  And then this is
        followed by the string names for the directory entries.

    Length - Supplies the length, in bytes, of the user supplied output
        buffer

    ReturnSingleEntry - Indicates if this routine should just return
        one entry in the directory

    RestartScan - Indicates if we are to restart the scan or continue
        relative to the enumeration context passed in as the next
        parameter

    Context - Supplies an enumeration context that must be resupplied
        to this routine on subsequent calls to keep the enumeration
        in sync

    ReturnLength - Optionally receives the length, in bytes, that this
        routine has stuffed into the output buffer

Return Value:

    An appropriate status value.

--*/

{
    POBJECT_DIRECTORY Directory;
    POBJECT_DIRECTORY_ENTRY DirectoryEntry;
    POBJECT_HEADER ObjectHeader;
    POBJECT_HEADER_NAME_INFO NameInfo;
    UNICODE_STRING ObjectName;
    POBJECT_DIRECTORY_INFORMATION DirInfo;
    PWCH NameBuffer;
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;
    ULONG Bucket, EntryNumber, CapturedContext;
    ULONG TotalLengthNeeded, LengthNeeded, EntriesFound;
    PCHAR TempBuffer;
    OBP_LOOKUP_CONTEXT LookupContext;

    PAGED_CODE();

    ObpValidateIrql( "NtQueryDirectoryObject" );

    ObpInitializeLookupContext( &LookupContext );
    
    //
    //  Get previous processor mode and probe output arguments if necessary.
    //

    PreviousMode = KeGetPreviousMode();

    if (PreviousMode != KernelMode) {

        try {

            ProbeForWrite( Buffer, Length, sizeof( WCHAR ) );
            ProbeForWriteUlong( Context );

            if (ARGUMENT_PRESENT( ReturnLength )) {

                ProbeForWriteUlong( ReturnLength );
            }

            if (RestartScan) {

                CapturedContext = 0;

            } else {

                CapturedContext = *Context;
            }

        } except( EXCEPTION_EXECUTE_HANDLER ) {

            return( GetExceptionCode() );
        }

    } else {

        if (RestartScan) {

            CapturedContext = 0;

        } else {

            CapturedContext = *Context;
        }
    }

    //
    //  Test for 64 bit if Length + sizeof( OBJECT_DIRECTORY_INFORMATION ) is less than Length
    //  Return STATUS_INVALID_PARAMETER if there is an overflow
    //

    if (ObpIsOverflow( Length, sizeof( OBJECT_DIRECTORY_INFORMATION ))) {

        return( STATUS_INVALID_PARAMETER );
    }

    //
    //  Allocate space for a temporary work buffer, make sure we got it,
    //  and then zero it out.  Make sure the buffer is large enough to
    //  hold at least one dir info record.  This will make the logic work
    //  better when the a bad length is passed in.
    //
    
    TempBuffer = ExAllocatePoolWithTag( PagedPool,
                                        Length + sizeof( OBJECT_DIRECTORY_INFORMATION ),
                                        'mNbO' );

    if (TempBuffer == NULL) {

        return( STATUS_INSUFFICIENT_RESOURCES );
    }

    RtlZeroMemory( TempBuffer, Length );

    //
    //  Reference the directory object
    //

    Status = ObReferenceObjectByHandle( DirectoryHandle,
                                        DIRECTORY_QUERY,
                                        ObpDirectoryObjectType,
                                        PreviousMode,
                                        (PVOID *)&Directory,
                                        NULL );

    if (!NT_SUCCESS( Status )) {

        ExFreePool( TempBuffer );

        return( Status );
    }

    //
    //  Lock down the directory structures for the life of this
    //  procedure
    //

    ObpLockDirectoryShared(Directory, &LookupContext);

    //
    //  DirInfo is used to march through the output buffer filling
    //  in directory information.  We'll start off by making sure
    //  there is room for a NULL entry at end.
    //

    DirInfo = (POBJECT_DIRECTORY_INFORMATION)TempBuffer;

    TotalLengthNeeded = sizeof( *DirInfo );

    //
    //  Keep track of the number of entries found and actual
    //  entry that we are processing
    //

    EntryNumber = 0;
    EntriesFound = 0;

    //
    //  By default we'll say there are no more entries until the
    //  following loop put in some data
    //

    Status = STATUS_NO_MORE_ENTRIES;

    //
    //  Our outer loop processes each hash bucket in the directory object
    //

    for (Bucket=0; Bucket<NUMBER_HASH_BUCKETS; Bucket++) {

        DirectoryEntry = Directory->HashBuckets[ Bucket ];

        //
        //  For this hash bucket we'll zip through its list of entries.
        //  This is a singly linked list so when the next pointer is null
        //  (i.e., false) we at the end of the hash list
        //

        while (DirectoryEntry) {

            //
            //  The captured context is simply the entry count unless the
            //  user specified otherwise we start at zero, which means
            //  the first entry is always returned in the enumeration.
            //  If we have an match based on the entry index then we
            //  process this entry.  We bump the captured context further
            //  done in the code.
            //

            if (CapturedContext == EntryNumber++) {

                //
                //  For this directory entry we'll get a pointer to the
                //  object body and see if it has an object name.  If it
                //  doesn't have a name then we'll give it an empty name.
                //

                ObjectHeader = OBJECT_TO_OBJECT_HEADER( DirectoryEntry->Object );
                NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );

                if (NameInfo != NULL) {

                    ObjectName = NameInfo->Name;

                } else {

                    RtlInitUnicodeString( &ObjectName, NULL );
                }

                //
                //  Now compute the length needed for this entry.  This would
                //  be the size of the object directory information record,
                //  plus the size of the object name and object type name both
                //  null terminated.
                //

                LengthNeeded = sizeof( *DirInfo ) +
                               ObjectName.Length + sizeof( UNICODE_NULL ) +
                               ObjectHeader->Type->Name.Length + sizeof( UNICODE_NULL );

                //
                //  If there isn't enough room then take the following error
                //  path.   If the user wanted a single entry then tell the
                //  caller what length is really needed and say the buffer was
                //  too small.  Otherwise the user wanted multiple entries,
                //  so we'll just say there are more entries in the directory.
                //  In both cases we drop down the entry number because we
                //  weren't able to fit it in on this call
                //

                if ((TotalLengthNeeded + LengthNeeded) > Length) {

                    if (ReturnSingleEntry) {

                        TotalLengthNeeded += LengthNeeded;

                        Status = STATUS_BUFFER_TOO_SMALL;

                    } else {

                        Status = STATUS_MORE_ENTRIES;
                    }

                    EntryNumber -= 1;
                    goto querydone;
                }

                //
                //  The information will fit in the buffer.  So now fill
                //  in the output buffer.  We temporarily put in pointers
                //  to the name buffer as stored in the object and object
                //  type.  We copy the data buffer to the user buffer
                //  right before we return to the caller
                //

                try {

                    DirInfo->Name.Length            = ObjectName.Length;
                    DirInfo->Name.MaximumLength     = (USHORT)(ObjectName.Length+sizeof( UNICODE_NULL ));
                    DirInfo->Name.Buffer            = ObjectName.Buffer;

                    DirInfo->TypeName.Length        = ObjectHeader->Type->Name.Length;
                    DirInfo->TypeName.MaximumLength = (USHORT)(ObjectHeader->Type->Name.Length+sizeof( UNICODE_NULL ));
                    DirInfo->TypeName.Buffer        = ObjectHeader->Type->Name.Buffer;

                    Status = STATUS_SUCCESS;

                } except( EXCEPTION_EXECUTE_HANDLER ) {

                    Status = GetExceptionCode();
                }

                if (!NT_SUCCESS( Status )) {

                    goto querydone;
                }

                //
                //  Update the total number of bytes needed in this query.
                //  Push the dir info pointer to the next output location,
                //  and indicate how many entries we've processed
                //
                //

                TotalLengthNeeded += LengthNeeded;

                DirInfo++;
                EntriesFound++;

                //
                //  If we are to return only one entry then move on to the
                //  post processing phase, otherwise indicate that we're
                //  processing the next entry and go back to the top of
                //  the inner loop
                //

                if (ReturnSingleEntry) {

                    goto querydone;

                } else {

                    //
                    //  Bump the captured context by one entry.
                    //

                    CapturedContext++;
                }
            }

            //
            //  Get the next directory entry from the singly linked hash
            //  bucket chain
            //

            DirectoryEntry = DirectoryEntry->ChainLink;
        }
    }

    //
    //  At this point we've processed the directory entries and the first
    //  part of the output buffer now contains a bunch of object directory
    //  information records,  but the pointers in them refer to the wrong
    //  copies.  So now we have some fixup to do.
    //

querydone:

    try {

        //
        //  We'll only do this post processing if we've been successful
        //  so far.  Note that this means we could be returning in the
        //  user's output buffer system address that are meaningless, but
        //  then getting back an error status should tell the caller to
        //  forget about everything in the output buffer.  Given back
        //  a system address also isn't harmful because there is nothing
        //  that the user can really do with it.
        //

        if (NT_SUCCESS( Status )) {

            //
            //  Null terminate the string of object directory information
            //  records and point to where the actual names will go
            //

            RtlZeroMemory( DirInfo, sizeof( *DirInfo ));

            DirInfo++;

            NameBuffer = (PWCH)DirInfo;

            //
            //  Now for every entry that we've put in the output buffer
            //  DirInfo will point to the entry and EntriesFound kept the
            //  count.  Note that we are guaranteed space because of
            //  the math we did earlier in computing TotalLengthNeeded.
            //

            DirInfo = (POBJECT_DIRECTORY_INFORMATION)TempBuffer;

            while (EntriesFound--) {

                //
                //  Copy over the object name, set the dir info pointer into
                //  the user's buffer, then null terminate the string.  Note
                //  that we are really copying the data into our temp buffer
                //  but the pointer fix up is for the user's buffer which
                //  we'll copy into right after this loop.
                //

                RtlCopyMemory( NameBuffer,
                               DirInfo->Name.Buffer,
                               DirInfo->Name.Length );

                DirInfo->Name.Buffer = (PVOID)((ULONG_PTR)Buffer + ((ULONG_PTR)NameBuffer - (ULONG_PTR)TempBuffer));
                NameBuffer           = (PWCH)((ULONG_PTR)NameBuffer + DirInfo->Name.Length);
                *NameBuffer++        = UNICODE_NULL;

                //
                //  Do the same copy with the object type name
                //

                RtlCopyMemory( NameBuffer,
                               DirInfo->TypeName.Buffer,
                               DirInfo->TypeName.Length );

                DirInfo->TypeName.Buffer = (PVOID)((ULONG_PTR)Buffer + ((ULONG_PTR)NameBuffer - (ULONG_PTR)TempBuffer));
                NameBuffer               = (PWCH)((ULONG_PTR)NameBuffer + DirInfo->TypeName.Length);
                *NameBuffer++            = UNICODE_NULL;

                //
                //  Move on to the next dir info record
                //

                DirInfo++;
            }

            //
            //  Set the enumeration context to the entry number of the next
            //  entry to return.
            //

            *Context = EntryNumber;
        }

        //
        //  Copy over the results from our temp buffer to the users buffer.
        //  But adjust the amount copied just in case the total length needed
        //  exceeds the length we allocated.
        //

        RtlCopyMemory( Buffer,
                       TempBuffer,
                       (TotalLengthNeeded <= Length ? TotalLengthNeeded : Length) );

        //
        //  In all cases we'll tell the caller how much space if really needed
        //  provided the user asked for this information
        //

        if (ARGUMENT_PRESENT( ReturnLength )) {

            *ReturnLength = TotalLengthNeeded;
        }

    } except( EXCEPTION_EXECUTE_HANDLER ) {

        //
        //  Fall through, since we do not want to undo what we have done.
        //
    }

    //
    //  Unlock the directroy structures, dereference the directory object,
    //  free up our temp buffer, and return to our caller
    //

    ObpUnlockDirectory( Directory, &LookupContext);

    ObDereferenceObject( Directory );

    ExFreePool( TempBuffer );

    return( Status );
}


PVOID
ObpLookupDirectoryEntry (
    IN POBJECT_DIRECTORY Directory,
    IN PUNICODE_STRING Name,
    IN ULONG Attributes,
    IN BOOLEAN SearchShadow,
    OUT POBP_LOOKUP_CONTEXT LookupContext
    )

/*++

Routine Description:

    This routine will lookup a single directory entry in a given directory.
    If it founds an object into that directory with the give name,
    that object will be referenced and the name will be referenced too, in order
    to prevent them going away when the directory is unlocked. 
    The referenced object is saved in the LookupContext, and the references will be released 
    at the next lookup, or when ObpReleaseLookupContext is called.

Arguments:

    Directory - Supplies the directory being searched

    Name - Supplies the name of entry we're looking for

    Attributes - Indicates if the lookup should be case insensitive
        or not
        
    SearchShadow - If TRUE, and the object name is not found in the current directory,
    it will search the object into the shadow directory.
        
    LookupContext - The lookup context for this call. This structure must be initialized
    before calling first time ObpLookupDirectoryEntry. 

Return Value:

    Returns a pointer to the corresponding object body if found and NULL
    otherwise. 
--*/

{
    POBJECT_DIRECTORY_ENTRY *HeadDirectoryEntry;
    POBJECT_DIRECTORY_ENTRY DirectoryEntry;
    POBJECT_HEADER ObjectHeader;
    POBJECT_HEADER_NAME_INFO NameInfo;
    PWCH Buffer;
    WCHAR Wchar;
    ULONG HashIndex;
    ULONG WcharLength;
    BOOLEAN CaseInSensitive;
    POBJECT_DIRECTORY_ENTRY *LookupBucket;
    PVOID Object = NULL;

    PAGED_CODE();

    if (ObpLUIDDeviceMapsEnabled == 0) {

        SearchShadow = FALSE; // Disable global devmap search
    }

    //
    //  The caller needs to specify both a directory and a name otherwise
    //  we can't process the request
    //

    if (!Directory || !Name) {

        goto UPDATECONTEXT;
    }

    //
    //  Set a local variable to tell us if the search is case sensitive
    //

    if (Attributes & OBJ_CASE_INSENSITIVE) {

        CaseInSensitive = TRUE;

    } else {

        CaseInSensitive = FALSE;
    }

    //
    //  Establish our local pointer to the input name buffer and get the
    //  number of unicode characters in the input name.  Also make sure
    //  the caller gave us a non null name
    //

    Buffer = Name->Buffer;
    WcharLength = Name->Length / sizeof( *Buffer );

    if (!WcharLength || !Buffer) {

        goto UPDATECONTEXT;
    }

    //
    //  Compute the address of the head of the bucket chain for this name.
    //

    HashIndex = 0;
    while (WcharLength--) {

        Wchar = *Buffer++;
        HashIndex += (HashIndex << 1) + (HashIndex >> 1);

        if (Wchar < 'a') {

            HashIndex += Wchar;

        } else if (Wchar > 'z') {

            HashIndex += RtlUpcaseUnicodeChar( Wchar );

        } else {

            HashIndex += (Wchar - ('a'-'A'));
        }
    }

    HashIndex %= NUMBER_HASH_BUCKETS;

    LookupContext->HashIndex = (USHORT)HashIndex;

    while (1) {

        HeadDirectoryEntry = (POBJECT_DIRECTORY_ENTRY *)&Directory->HashBuckets[ HashIndex ];

        LookupBucket = HeadDirectoryEntry;

        //
        //  Lock the directory for read access, if the context was not previously locked
        //  exclusively
        //

        if (!LookupContext->DirectoryLocked) {

            ObpLockDirectoryShared( Directory, LookupContext);
        }
        
        //
        //  Walk the chain of directory entries for this hash bucket, looking
        //  for either a match, or the insertion point if no match in the chain.
        //

        while ((DirectoryEntry = *HeadDirectoryEntry) != NULL) {

            //
            //  Get the object header and name from the object body
            //
            //  This function assumes the name must exist, otherwise it
            //  wouldn't be in a directory
            //

            ObjectHeader = OBJECT_TO_OBJECT_HEADER( DirectoryEntry->Object );
            NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );

            //
            //  Compare strings using appropriate function.
            //

            if ((Name->Length == NameInfo->Name.Length) &&
                RtlEqualUnicodeString( Name,
                                       &NameInfo->Name,
                                       CaseInSensitive )) {

                //
                //  If name matches, then exit loop with DirectoryEntry
                //  pointing to matching entry.
                //

                break;
            }

            HeadDirectoryEntry = &DirectoryEntry->ChainLink;
        }

        //
        //  At this point, there are two possiblilities:
        //
        //   - we found an entry that matched and DirectoryEntry points to that
        //     entry.  Update the bucket chain so that the entry found is at the
        //     head of the bucket chain.  This is so the ObpDeleteDirectoryEntry
        //     and ObpInsertDirectoryEntry functions will work.  Also repeated
        //     lookups of the same name will succeed quickly.
        //
        //   - we did not find an entry that matched and DirectoryEntry is NULL.
        //

        if (DirectoryEntry) {

            //
            //  The following convoluted piece of code moves a directory entry
            //  we've found to the front of the hash list.
            //

            if (HeadDirectoryEntry != LookupBucket) {

                if ( LookupContext->DirectoryLocked
                        ||
                     ExTryConvertPushLockSharedToExclusive(&Directory->Lock)) {

                    *HeadDirectoryEntry = DirectoryEntry->ChainLink;
                    DirectoryEntry->ChainLink = *LookupBucket;
                    *LookupBucket = DirectoryEntry;
                }
            }

            //
            //  Now return the object to our caller
            //

            Object = DirectoryEntry->Object;

            goto UPDATECONTEXT;

        } else {

            if (!LookupContext->DirectoryLocked) {

                ObpUnlockDirectory( Directory, LookupContext );
            }

            //
            // If this is a directory with a device map then search the second directory for an entry.
            //

            if (SearchShadow && Directory->DeviceMap != NULL) {
                POBJECT_DIRECTORY NewDirectory;

                NewDirectory = ObpGetShadowDirectory (Directory);
                if (NewDirectory != NULL) {
                    Directory = NewDirectory;
                    continue;
                }
            }

            goto UPDATECONTEXT;
        }
    }

UPDATECONTEXT:

    if (Object) {

        //
        //  Reference the name to keep it's directory alive and the object
        //  before returning from the lookup
        //

        ObpReferenceNameInfo( OBJECT_TO_OBJECT_HEADER(Object) );
        ObReferenceObject( Object );

        //
        //  We can safetly drop the lock now
        //

        if (!LookupContext->DirectoryLocked) {

            ObpUnlockDirectory( Directory, LookupContext );
        }
    }
    
    //
    //  If we have a previously referenced object we can dereference it
    //

    if (LookupContext->Object) {

        POBJECT_HEADER_NAME_INFO PreviousNameInfo;

        PreviousNameInfo = OBJECT_HEADER_TO_NAME_INFO(OBJECT_TO_OBJECT_HEADER(LookupContext->Object));

        ObpDereferenceNameInfo(PreviousNameInfo);
        ObDereferenceObject(LookupContext->Object);
    }

    LookupContext->Object = Object;

    return Object;
}


BOOLEAN
ObpInsertDirectoryEntry (
    IN POBJECT_DIRECTORY Directory,
    IN POBP_LOOKUP_CONTEXT LookupContext,
    IN POBJECT_HEADER ObjectHeader
    )

/*++

Routine Description:

    This routine will insert a new directory entry into a directory
    object.  The directory must have already have been searched using
    ObpLookupDirectoryEntry because that routine sets the LookupContext.
    
    N.B. The ObpLookupDirectoryEntry before should be done with the LookupContext
    locked.

Arguments:

    Directory - Supplies the directory object being modified.  This
        function assumes that we earlier did a lookup on the name
        that was successful or we just did an insertion

    Object - Supplies the object to insert into the directory
    
    LookupContext - The lookupContext passed in previously to  ObpLookupDirectoryEntry

Return Value:

    TRUE if the object is inserted successfully and FALSE otherwise

--*/

{
    POBJECT_DIRECTORY_ENTRY *HeadDirectoryEntry;
    POBJECT_DIRECTORY_ENTRY NewDirectoryEntry;
    POBJECT_HEADER_NAME_INFO NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );

#if DBG

    //
    //  This function should be always called with a valid Directory
    //  and LookupContext. Test this on checked builds
    //

    if ((LookupContext->Object != NULL) ||
        !LookupContext->DirectoryLocked ||
        (Directory != LookupContext->Directory)) {

        DbgPrint("OB: ObpInsertDirectoryEntry - invalid context %p %ld\n",
                 LookupContext->Object,
                 (ULONG)LookupContext->DirectoryLocked );
        DbgBreakPoint();

        return FALSE;
    }

#endif // DBG

    //
    //  Allocate memory for a new entry, and fail if not enough memory.
    //

    NewDirectoryEntry = (POBJECT_DIRECTORY_ENTRY)ExAllocatePoolWithTag( PagedPool,
                                                                        sizeof( OBJECT_DIRECTORY_ENTRY ),
                                                                        'iDbO' );

    if (NewDirectoryEntry == NULL) {

        return( FALSE );
    }

    //
    //  Get the right lookup bucket based on the HashIndex
    //

    HeadDirectoryEntry = (POBJECT_DIRECTORY_ENTRY *)&Directory->HashBuckets[ LookupContext->HashIndex ];

    //
    //  Link the new entry into the chain at the insertion point.
    //  This puts the new object right at the head of the current
    //  hash bucket chain
    //

    NewDirectoryEntry->ChainLink = *HeadDirectoryEntry;
    *HeadDirectoryEntry = NewDirectoryEntry;
    NewDirectoryEntry->Object = &ObjectHeader->Body;

    //
    //  Point the object header back to the directory we just inserted
    //  it into.
    //

    NameInfo->Directory = Directory;

    //
    //  Return success.
    //

    return( TRUE );
}


BOOLEAN
ObpDeleteDirectoryEntry (
    IN POBP_LOOKUP_CONTEXT LookupContext
    )

/*++

Routine Description:

    This routine deletes the most recently found directory entry from
    the specified directory object.  It will only succeed after a
    successful ObpLookupDirectoryEntry call.

Arguments:

    Directory - Supplies the directory being modified

Return Value:

    TRUE if the deletion succeeded and FALSE otherwise

--*/

{
    POBJECT_DIRECTORY_ENTRY *HeadDirectoryEntry;
    POBJECT_DIRECTORY_ENTRY DirectoryEntry;
    IN POBJECT_DIRECTORY Directory = LookupContext->Directory;

    //
    //  Make sure we have a directory and that it has a found entry
    //

    if (!Directory ) {

        return( FALSE );
    }

    //
    //  The lookup path places the object in the front of the list, so basically 
    //  we find the object immediately
    //
    
    HeadDirectoryEntry = (POBJECT_DIRECTORY_ENTRY *)&Directory->HashBuckets[ LookupContext->HashIndex ];
    
    DirectoryEntry = *HeadDirectoryEntry;

    //
    //  Unlink the entry from the head of the bucket chain and free the
    //  memory for the entry.
    //

    *HeadDirectoryEntry = DirectoryEntry->ChainLink;
    DirectoryEntry->ChainLink = NULL;

    ExFreePool( DirectoryEntry );

    return TRUE;
}

POBJECT_DIRECTORY
ObpGetShadowDirectory(
    POBJECT_DIRECTORY Dir
    )
{
    KIRQL OldIrql;
    PDEVICE_MAP DeviceMap;
    POBJECT_DIRECTORY NewDir;

    NewDir = NULL;

    ObpLockDeviceMap();

    if (Dir->DeviceMap != NULL) {
        NewDir = Dir->DeviceMap->GlobalDosDevicesDirectory;
    }

    ObpUnlockDeviceMap();

    return NewDir;
}


NTSTATUS
ObpSetCurrentProcessDeviceMap(
    )
/*++

Routine Description:

    This function sets the process' device map to the device map associated
    with the process token's LUID.

Arguments:

    none

Return Values:

    STATUS_NO_TOKEN - process does not have a primary token

    STATUS_OBJECT_PATH_INVALID - could not obtain the device map associated
                                 with the process token's LUID

    An appropriate status - unexcepted error occurred

--*/
{
    PEPROCESS pProcess;
    PACCESS_TOKEN pToken = NULL;
    LUID userLuid;
    LUID SystemAuthenticationId = SYSTEM_LUID;  // Local_System's LUID
    PDEVICE_MAP DeviceMap = NULL;
    PDEVICE_MAP DerefDeviceMap = NULL;
    KIRQL OldIrql;
    NTSTATUS Status = STATUS_SUCCESS;

    pProcess = PsGetCurrentProcess();

    pToken = PsReferencePrimaryToken( pProcess );

    if (pToken == NULL) {
        return (STATUS_NO_TOKEN);
    }

    Status = SeQueryAuthenticationIdToken( pToken, &userLuid );

    if (!NT_SUCCESS(Status)) {
        PsDereferencePrimaryToken( pToken );
        return (Status);
    }

    if (!RtlEqualLuid( &userLuid, &SystemAuthenticationId )) {
        PDEVICE_MAP pDevMap;

        //
        // Get a handle to the Device Map for the user's LUID
        //
        Status = SeGetLogonIdDeviceMap( &userLuid,
                                        &pDevMap );

        if (NT_SUCCESS(Status)) {
            DeviceMap = pDevMap;
        }
    }
    else {
        //
        // Process is Local_System, so use the System's device map
        //
        DeviceMap = ObSystemDeviceMap;
    }

    if (DeviceMap != NULL) {
        //
        // set the process' device map
        //
        
        ObpLockDeviceMap();

        DerefDeviceMap = pProcess->DeviceMap;

        pProcess->DeviceMap = DeviceMap;

        DeviceMap->ReferenceCount++;

        ObpUnlockDeviceMap();
    }
    else {
        Status = STATUS_OBJECT_PATH_INVALID;
    }

    PsDereferencePrimaryToken( pToken );

    //
    // If the process already had a device map, then deref it now
    //
    if (DerefDeviceMap != NULL) {
        ObfDereferenceDeviceMap (DerefDeviceMap);
    }

    return (Status);
}


PDEVICE_MAP
ObpReferenceDeviceMap(
    )
/*++

Routine Description:

    This function obtains the correct device map associated with the
    caller.
    If LUID device maps are enabled,
    then we obtain the LUID's device map.

    We use the existing process device map field as a cache for the
    process token's LUID device map.

    If LUID device maps are disabled,
    then use the device map associated with the process

Arguments:

    none

Return Values:

    A pointer to the caller's device map
    NULL - could not obtain the user's device map

--*/
{
    KIRQL OldIrql;
    PDEVICE_MAP DeviceMap = NULL;
    BOOLEAN LocalSystemRequest = FALSE;
    BOOLEAN LUIDDeviceMapsEnabled;
    PACCESS_TOKEN pToken = NULL;
    NTSTATUS Status;

    LUIDDeviceMapsEnabled = (ObpLUIDDeviceMapsEnabled != 0);

    if (LUIDDeviceMapsEnabled == TRUE) {
        
        PETHREAD Thread = NULL;

        //
        //     Separate device maps for each user LUID
        // if (thread is impersonating)
        //    then get user's LUID to retrieve their device map
        //    else use the process' device map
        // if (LUID is the Local_System)
        //    then use the system's device map
        // if (unable to retrieve LUID's device map),
        //    then use the process' device map
        //

        //
        // Get the current thread & check if the thread is impersonating
        //
        // if impersonating,
        //     then take the long path
        //          - get thread's access token
        //          - read the caller's LUID from the token
        //          - get the device map associate with this LUID
        // if not impersonating,
        //     then use the device map associated with the process
        //
        Thread = PsGetCurrentThread();

        if ( PS_IS_THREAD_IMPERSONATING (Thread) ) {
            BOOLEAN fCopyOnOpen;
            BOOLEAN fEffectiveOnly;
            SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
            LUID userLuid;


            //
            // Get the caller's access token from the thread
            //
            pToken = PsReferenceImpersonationToken( Thread, 
                                                    &fCopyOnOpen,
                                                    &fEffectiveOnly,
                                                    &ImpersonationLevel);

            if (pToken != NULL) {

                //
                // query the token for the LUID
                //
                Status = SeQueryAuthenticationIdToken( pToken, &userLuid );
            }
            else {
                Status = STATUS_NO_TOKEN;
            }

            if (NT_SUCCESS(Status)) {
                LUID SystemAuthenticationId = SYSTEM_LUID;  // Local_System's LUID

                //
                // Verify the caller is not Local_System by
                // comparing the LUID with Local_System's LUID
                //
                if (!RtlEqualLuid( &userLuid, &SystemAuthenticationId )) {
                    PDEVICE_MAP pDevMap;

                    //
                    // Get a handle to the Device Map for the LUID
                    //
                    Status = SeGetLogonIdDeviceMap( &userLuid,
                                                    &pDevMap );

                    if (NT_SUCCESS(Status)) {

                        //
                        // Use the device map associated with the LUID
                        //

                        DeviceMap = pDevMap;

                        ObpLockDeviceMap();
                        
                        if (DeviceMap != NULL) {
                            DeviceMap->ReferenceCount++;
                        }

                        ObpUnlockDeviceMap();

                    }

                }
                else {
                    //
                    // Local_System will use the system's device map
                    //
                    LocalSystemRequest = TRUE;
                }

            }

        }

    }

    if (DeviceMap == NULL) {
        //
        // if (going to reference the process' device map and the process'
        // device map is not set),
        // then set the process' device map
        //
        if ((LUIDDeviceMapsEnabled == TRUE) &&
            (LocalSystemRequest == FALSE) &&
            ((PsGetCurrentProcess()->DeviceMap) == NULL)) {

            Status = ObpSetCurrentProcessDeviceMap();

            if (!NT_SUCCESS(Status)) {
                goto Error_Exit;
            }
        }

        ObpLockDeviceMap();
        
        if (LocalSystemRequest == TRUE) {
            //
            // Use the system's device map
            //
            DeviceMap = ObSystemDeviceMap;
        }
        else {
            //
            // Use the device map from the process
            //
            DeviceMap = PsGetCurrentProcess()->DeviceMap;
        }

        if (DeviceMap != NULL) {
            DeviceMap->ReferenceCount++;
        }
        ObpUnlockDeviceMap();
    }

Error_Exit:

    if( pToken != NULL ) {
        PsDereferenceImpersonationToken(pToken);
    }

    return DeviceMap;
}


VOID
FASTCALL
ObfDereferenceDeviceMap(
    IN PDEVICE_MAP DeviceMap
    )
{
    KIRQL OldIrql;

    ObpLockDeviceMap();

    DeviceMap->ReferenceCount--;

    if (DeviceMap->ReferenceCount == 0) {

        DeviceMap->DosDevicesDirectory->DeviceMap = NULL;

        ObpUnlockDeviceMap();

        //
        // This devmap is dead so mark the directory temporary so its name will go away and dereference it.
        //
        ObMakeTemporaryObject (DeviceMap->DosDevicesDirectory);
        ObDereferenceObject( DeviceMap->DosDevicesDirectory );

        ExFreePool( DeviceMap );

    } else {

        ObpUnlockDeviceMap();
    }
}


NTSTATUS
ObpLookupObjectName (
    IN HANDLE RootDirectoryHandle OPTIONAL,
    IN PUNICODE_STRING ObjectName,
    IN ULONG Attributes,
    IN POBJECT_TYPE ObjectType,
    IN KPROCESSOR_MODE AccessMode,
    IN PVOID ParseContext OPTIONAL,
    IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
    IN PVOID InsertObject OPTIONAL,
    IN OUT PACCESS_STATE AccessState,
    OUT POBP_LOOKUP_CONTEXT LookupContext,
    OUT PVOID *FoundObject
    )

/*++

Routine Description:

    This function will search a given directoroy for a specified
    object name.  It will also create a new object specified by
    InsertObject.

Arguments:

    RootDirectoryHandle - Optionally supplies the directory being
        searched.  If not supplied then this routine searches
        the root directory

    ObjectName - Supplies the name of object to lookup

    Attributes - Specifies the attributes for the lookup (e.g., case
        insensitive)

    ObjectType - Specifies the type of the object to lookup

    AccessMode - Specifies the callers processor mode

    ParseContext - Optionally supplies a parse context that is blindly
        passed to the parse callback routines

    SecurityQos - Optionally supplies a pointer to the passed Security
        Quality of Service parameter that is blindly passed to the parse
        callback routines

    InsertObject - Optionally supplies the object we think will be found.
        This is used if the caller did not give a root directory handle
        and the object name is "\" and the root object directory hasn't
        been created yet.  In other cases where we wind up creating
        a new directory entry this is the object inserted.

    AccessState - Current access state, describing already granted access
        types, the privileges used to get them, and any access types yet to
        be granted.  The access masks may not contain any generic access
        types.

    DirectoryLocked - Receives an indication if this routine has returned
        with the input directory locked

    FoundObject - Receives a pointer to the object body if found

Return Value:

    An appropriate status value. 
    
    N.B. If the status returned is SUCCESS the caller has the
    responsability to release the lookup context

--*/

{
    POBJECT_DIRECTORY RootDirectory;
    POBJECT_DIRECTORY Directory = NULL;
    POBJECT_DIRECTORY ParentDirectory = NULL;
    POBJECT_HEADER ObjectHeader;
    POBJECT_HEADER_NAME_INFO NameInfo;
    PDEVICE_MAP DeviceMap = NULL;
    PVOID Object;
    UNICODE_STRING RemainingName;
    UNICODE_STRING ComponentName;
    PWCH NewName;
    NTSTATUS Status;
    BOOLEAN Reparse, ReparsedSymbolicLink = FALSE;
    ULONG MaxReparse = OBJ_MAX_REPARSE_ATTEMPTS;
    OB_PARSE_METHOD ParseProcedure;
    extern POBJECT_TYPE IoFileObjectType;
    KPROCESSOR_MODE AccessCheckMode;
    
    ObpValidateIrql( "ObpLookupObjectName" );

    //
    //  Initialize our output variables to say we haven't lock or found
    //  anything but we were successful at it
    //

    ObpInitializeLookupContext(LookupContext);

    *FoundObject = NULL;
    Status = STATUS_SUCCESS;

    Object = NULL;

    //
    //  If the global flag says that we need to perform a case-insensitive check
    //  we'll force the OBJ_CASE_INSENSITIVE flag in attributes at lookup
    //

    if ( ObpCaseInsensitive ) {

        if ( (ObjectType == NULL) ||
             (ObjectType->TypeInfo.CaseInsensitive)
           ) {

            Attributes |= OBJ_CASE_INSENSITIVE;
        }
    }

    if (Attributes & OBJ_FORCE_ACCESS_CHECK) {
        AccessCheckMode = UserMode;
    } else {
        AccessCheckMode = AccessMode;
    }
    
    //
    //  Check if the caller has given us a directory to search.  Otherwise
    //  we'll search the root object directory
    //

    if (ARGUMENT_PRESENT( RootDirectoryHandle )) {

        //
        //  Otherwise reference the directory object and make sure
        //  that we successfully got the object
        //

        Status = ObReferenceObjectByHandle( RootDirectoryHandle,
                                            0,
                                            NULL,
                                            AccessMode,
                                            (PVOID *)&RootDirectory,
                                            NULL );

        if (!NT_SUCCESS( Status )) {

            return( Status );
        }

        //
        //  Translate the directory object to its object header
        //

        ObjectHeader = OBJECT_TO_OBJECT_HEADER( RootDirectory );

        //
        //  Now if the name we're looking up starts with a "\" and it
        //  does not have a parse procedure then the syntax is bad
        //

        if ((ObjectName->Buffer != NULL) &&
            (*(ObjectName->Buffer) == OBJ_NAME_PATH_SEPARATOR) &&
            (ObjectHeader->Type != IoFileObjectType)) {

            ObDereferenceObject( RootDirectory );

            return( STATUS_OBJECT_PATH_SYNTAX_BAD );
        }

        //
        //  Now make sure that we do not have the directory of the
        //  object types
        //

        if (ObjectHeader->Type != ObpDirectoryObjectType) {

            //
            //  We have an object directory that is not the object type
            //  directory.  So now if it doesn't have a parse routine
            //  then there is nothing we can
            //

            if (ObjectHeader->Type->TypeInfo.ParseProcedure == NULL) {

                ObDereferenceObject( RootDirectory );

                return( STATUS_INVALID_HANDLE );

            } else {

                MaxReparse = OBJ_MAX_REPARSE_ATTEMPTS;

                //
                //  The following loop cycles cycles through the various
                //  parse routine to we could encounter trying to resolve
                //  this name through symbolic links.
                //

                while (TRUE) {

                    KIRQL SaveIrql;

                    RemainingName = *ObjectName;

                    //
                    //  Invoke the callback routine to parse the remaining
                    //  object name
                    //

                    ObpBeginTypeSpecificCallOut( SaveIrql );

                    Status = (*ObjectHeader->Type->TypeInfo.ParseProcedure)( RootDirectory,
                                                                             ObjectType,
                                                                             AccessState,
                                                                             AccessCheckMode,
                                                                             Attributes,
                                                                             ObjectName,
                                                                             &RemainingName,
                                                                             ParseContext,
                                                                             SecurityQos,
                                                                             &Object );

                    ObpEndTypeSpecificCallOut( SaveIrql, "Parse", ObjectHeader->Type, Object );

                    //
                    //  If the status was not to do a reparse and the lookup
                    //  was not successful then we found nothing so we
                    //  dereference the directory and return the status to
                    //  our caller.  If the object we got back was null then
                    //  we'll tell our caller that we couldn't find the name.
                    //  Lastly if we did not get a reparse and we were
                    //  successful and the object is not null then everything
                    //  gets nicely returned to our caller
                    //

                    if ( ( Status != STATUS_REPARSE ) && 
                         ( Status != STATUS_REPARSE_OBJECT )) {

                        if (!NT_SUCCESS( Status )) {

                            Object = NULL;

                        } else if (Object == NULL) {

                            Status = STATUS_OBJECT_NAME_NOT_FOUND;
                        }
    
                        ObDereferenceObject( RootDirectory );

                        *FoundObject = Object;
                        
                        return( Status );

                    //
                    //  We got a status reparse, which means the object
                    //  name has been modified to have use start all over
                    //  again.  If the reparse target is now empty or it
                    //  is a path separator then we start the parse at the
                    //  root directory
                    //

                    } else if ((ObjectName->Length == 0) ||
                               (ObjectName->Buffer == NULL) ||
                               (*(ObjectName->Buffer) == OBJ_NAME_PATH_SEPARATOR)) {

                        //
                        //  Restart the parse relative to the root directory.
                        //

                        ObDereferenceObject( RootDirectory );

                        RootDirectory = ObpRootDirectoryObject;
                        RootDirectoryHandle = NULL;

                        goto ParseFromRoot;

                    //
                    //  We got a reparse and we actually have a new name to
                    //  go to we if we haven't exhausted our reparse attempts
                    //  yet then just continue to the top of this loop.
                    //

                    } else if (--MaxReparse) {

                        continue;

                    //
                    //  We got a reparse and we've exhausted our times through
                    //  the loop so we'll return what we found.
                    //

                    } else {

                        ObDereferenceObject( RootDirectory );

                        *FoundObject = Object;

                        //
                        //  At this point we were failing in stress by
                        //  returning to the caller with a success status but
                        //  a null object pointer.
                        //

                        if (Object == NULL) {

                            Status = STATUS_OBJECT_NAME_NOT_FOUND;
                        }

                        return( Status );
                    }
                }
            }

        //
        //  At this point the caller has given us the directory of object
        //  types.  If the caller didn't specify a name then we'll return
        //  a pointer to the root object directory.
        //

        } else if ((ObjectName->Length == 0) ||
                   (ObjectName->Buffer == NULL)) {

            Status = ObReferenceObjectByPointer( RootDirectory,
                                                 0,
                                                 ObjectType,
                                                 AccessMode );

            if (NT_SUCCESS( Status )) {

                Object = RootDirectory;
            }

            ObDereferenceObject( RootDirectory );

            *FoundObject = Object;

            return( Status );
        }

    //
    //  Otherwise the caller did not specify a directory to search so
    //  we'll default to the object root directory
    //

    } else {

        RootDirectory = ObpRootDirectoryObject;

        //
        //  If the name we're looking for is empty then it is illformed.
        //  Also it has to start with a "\" or it is illformed.
        //

        if ((ObjectName->Length == 0) ||
            (ObjectName->Buffer == NULL) ||
            (*(ObjectName->Buffer) != OBJ_NAME_PATH_SEPARATOR)) {

            return( STATUS_OBJECT_PATH_SYNTAX_BAD );
        }

        //
        //  Check if the name is has only one character (that is the "\")
        //  Which means that the caller really just wants to lookup the
        //  root directory.
        //

        if (ObjectName->Length == sizeof( OBJ_NAME_PATH_SEPARATOR )) {

            //
            //  If there is not a root directory yet.  Then we really
            //  can't return it, however if the caller specified
            //  an insert object that is the one we'll reference and
            //  return to our caller
            //

            if (!RootDirectory) {

                if (InsertObject) {

                    Status = ObReferenceObjectByPointer( InsertObject,
                                                         0,
                                                         ObjectType,
                                                         AccessMode );

                    if (NT_SUCCESS( Status )) {

                        *FoundObject = InsertObject;
                    }

                    return( Status );

                } else {

                    return( STATUS_INVALID_PARAMETER );
                }

            //
            //  At this point the caller did not specify a root directory,
            //  the name is "\" and the root object directory exists so
            //  we'll simply return the real root directory object
            //

            } else {

                Status = ObReferenceObjectByPointer( RootDirectory,
                                                     0,
                                                     ObjectType,
                                                     AccessMode );

                if (NT_SUCCESS( Status )) {

                    *FoundObject = RootDirectory;
                }

                return( Status );
            }

        //
        //  At this pointer the caller did not specify a root directory,
        //  and the name is more than just a "\"
        //
        //  Now if the lookup is case insensitive, and the name buffer is a
        //  legitimate pointer (meaning that is it quadword aligned), and
        //  there is a dos device map for the process.  Then we'll handle
        //  the situation here. First get the device map and make sure it
        //  doesn't go away while we're using it.
        //

        } else {

ParseFromRoot:

            if (DeviceMap != NULL) {

                ObfDereferenceDeviceMap(DeviceMap);
                DeviceMap = NULL;
            }

            if (!((ULONG_PTR)(ObjectName->Buffer) & (sizeof(ULONGLONG)-1))) {

                //
                //  Check if the object name is actually equal to the
                //  global dos devices short name prefix "\??\"
                //

                if ((ObjectName->Length >= ObpDosDevicesShortName.Length)

                        &&

                    (*(PULONGLONG)(ObjectName->Buffer) == ObpDosDevicesShortNamePrefix.Alignment.QuadPart)) {

                    if ((DeviceMap = ObpReferenceDeviceMap()) != NULL) {
                        if (DeviceMap->DosDevicesDirectory != NULL ) {

                            //
                            //  The user gave us the dos short name prefix so we'll
                            //  look down the directory, and start the search at the
                            //  dos device directory
                            //

                            ParentDirectory = RootDirectory;

                            Directory = DeviceMap->DosDevicesDirectory;

                            RemainingName = *ObjectName;
                            RemainingName.Buffer += (ObpDosDevicesShortName.Length / sizeof( WCHAR ));
                            RemainingName.Length -= ObpDosDevicesShortName.Length;

                            goto quickStart;

                        }
                    }
                    //
                    //  The name is not equal to "\??\" but check if it is
                    //  equal to "\??"
                    //

                } else if ((ObjectName->Length == ObpDosDevicesShortName.Length - sizeof( WCHAR ))

                                &&

                    (*(PULONG)(ObjectName->Buffer) == ObpDosDevicesShortNameRoot.Alignment.LowPart)

                                &&

                    (*((PWCHAR)(ObjectName->Buffer)+2) == (WCHAR)(ObpDosDevicesShortNameRoot.Alignment.HighPart))) {

                    //
                    //  The user specified "\??" so we return to dos devices
                    //  directory to our caller
                    //

                    if ((DeviceMap = ObpReferenceDeviceMap()) != NULL) {
                        if (DeviceMap->DosDevicesDirectory != NULL ) {

                            Status = ObReferenceObjectByPointer( DeviceMap->DosDevicesDirectory,
                                                                 0,
                                                                 ObjectType,
                                                                 AccessMode );

                            if (NT_SUCCESS( Status )) {

                                *FoundObject = DeviceMap->DosDevicesDirectory;
                            }

                            //
                            //  Dereference the Device Map
                            //

                            ObfDereferenceDeviceMap(DeviceMap);

                            return( Status );
                        }
                    }
                }
            }
        }
    }

    //
    //  At this point either
    //
    //  the user specified a directory that is not the object
    //  type directory and got repase back to the root directory
    //
    //  the user specified the object type directory and gave us
    //  a name to actually look up
    //
    //  the user did not specify a search directory (default
    //  to root object directory) and if the name did start off
    //  with the dos device prefix we've munged outselves back to
    //  it to the dos device directory for the process
    //

    if( ReparsedSymbolicLink == FALSE ) {
        Reparse = TRUE;
        MaxReparse = OBJ_MAX_REPARSE_ATTEMPTS;
    }

    while (Reparse) {

        RemainingName = *ObjectName;

quickStart:

        Reparse = FALSE;

        while (TRUE) {

            Object = NULL;

            //if (RemainingName.Length == 0) {
            //    Status = STATUS_OBJECT_NAME_INVALID;
            //    break;
            //    }

            //
            //  If the remaining name for the object starts with a
            //  "\" then just gobble up the "\"
            //

            if ( (RemainingName.Length != 0) &&
                 (*(RemainingName.Buffer) == OBJ_NAME_PATH_SEPARATOR) ) {

                RemainingName.Buffer++;
                RemainingName.Length -= sizeof( OBJ_NAME_PATH_SEPARATOR );
            }

            //
            //  The following piece of code will calculate the first
            //  component of the remaining name.  If there is not
            //  a remaining component then the object name is illformed
            //

            ComponentName = RemainingName;

            while (RemainingName.Length != 0) {

                if (*(RemainingName.Buffer) == OBJ_NAME_PATH_SEPARATOR) {

                    break;
                }

                RemainingName.Buffer++;
                RemainingName.Length -= sizeof( OBJ_NAME_PATH_SEPARATOR );
            }

            ComponentName.Length -= RemainingName.Length;

            if (ComponentName.Length == 0) {

                Status = STATUS_OBJECT_NAME_INVALID;
                break;
            }

            //
            //  Now we have the first component name to lookup so we'll
            //  look the directory is necessary
            //

            if ( Directory == NULL ) {

                Directory = RootDirectory;
            }

            //
            //  Now if the caller does not have traverse privilege and
            //  there is a parent directory then we must check if the
            //  user has traverse access to the directory.  Our local
            //  Reparse variable should be false at this point so we'll
            //  drop out of both loops
            //

            if ( !(AccessState->Flags & TOKEN_HAS_TRAVERSE_PRIVILEGE) && (ParentDirectory != NULL) ) {

                if (!ObpCheckTraverseAccess( ParentDirectory,
                                             DIRECTORY_TRAVERSE,
                                             AccessState,
                                             FALSE,
                                             AccessCheckMode,
                                             &Status )) {

                    break;
                }
            }

            //
            //  If the object already exists in this directory, find it,
            //  else return NULL.
            //

            if ((RemainingName.Length == 0) && (InsertObject != NULL)) {

                //
                //  If we are searching the last name, and we have an object
                //  to insert into that directory, we lock the context
                //  exclusively before the lookup. An insertion is likely 
                //  to occur after this lookup if it fails, so we need to protect 
                //  this directory to be changed until the ObpInsertDirectoryEntry call
                //

                ObpLockLookupContext( LookupContext, Directory );
            }

            Object = ObpLookupDirectoryEntry( Directory, 
                                              &ComponentName, 
                                              Attributes, 
                                              InsertObject == NULL,
                                              LookupContext );

            if (!Object) {

                //
                //  We didn't find the object.  If there is some remaining
                //  name left (meaning the component name is a directory in
                //  path we trying to break) or the caller didn't specify an
                //  insert object then we then we'll break out here with an
                //  error status
                //

                if (RemainingName.Length != 0) {

                    Status = STATUS_OBJECT_PATH_NOT_FOUND;
                    break;
                }

                if (!InsertObject) {

                    Status = STATUS_OBJECT_NAME_NOT_FOUND;
                    break;
                }

                //
                //  Check that the caller has the access to the directory
                //  to either create a subdirectory (in the object type
                //  directory) or to create an object of the given component
                //  name.  If the call fails then we'll break out of here
                //  with the status value set
                //

                if (!ObCheckCreateObjectAccess( Directory,
                                                ObjectType == ObpDirectoryObjectType ?
                                                        DIRECTORY_CREATE_SUBDIRECTORY :
                                                        DIRECTORY_CREATE_OBJECT,
                                                AccessState,
                                                &ComponentName,
                                                FALSE,
                                                AccessCheckMode,
                                                &Status )) {

                    break;
                }

                //
                //  The object does not exist in the directory and
                //  we are allowed to create one.  So allocate space
                //  for the name and insert the name into the directory
                //

                NewName = ExAllocatePoolWithTag( PagedPool, ComponentName.Length, 'mNbO' );
                
                ObjectHeader = OBJECT_TO_OBJECT_HEADER( InsertObject );

                if ((NewName == NULL) ||
                    !ObpInsertDirectoryEntry( Directory, LookupContext, ObjectHeader )) {

                    if (NewName != NULL) {

                        ExFreePool( NewName );
                    }


                    Status = STATUS_INSUFFICIENT_RESOURCES;
                    break;
                }

                //
                //  We have an insert object so now get its name info,
                //  because we are going to change its name and insert it
                //  into the directory
                //

                ObReferenceObject( InsertObject );

                NameInfo = OBJECT_HEADER_TO_NAME_INFO( ObjectHeader );

                ObReferenceObject( Directory );

                RtlCopyMemory( NewName,
                               ComponentName.Buffer,
                               ComponentName.Length );

                if (NameInfo->Name.Buffer) {

                    ExFreePool( NameInfo->Name.Buffer );
                }

                NameInfo->Name.Buffer = NewName;
                NameInfo->Name.Length = ComponentName.Length;
                NameInfo->Name.MaximumLength = ComponentName.Length;

                Object = InsertObject;

                Status = STATUS_SUCCESS;

                break;
            }

            //
            //  At this point we've found the component name within
            //  the directory.  So we'll now grab the components object
            //  header, and get its parse routine
            //

ReparseObject:

            ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );
            ParseProcedure = ObjectHeader->Type->TypeInfo.ParseProcedure;

            //
            //  Now if there is a parse routine for the type and we are not
            //  inserting a new object or the parse routine is for symbolic
            //  links then we'll actually call the parse routine
            //

            if (ParseProcedure && (!InsertObject || (ParseProcedure == ObpParseSymbolicLink))) {

                KIRQL SaveIrql;

                //
                //  Reference the object and then free the directory lock
                //  This will keep the object from going away with the
                //  directory unlocked
                //

                ObpIncrPointerCount( ObjectHeader );

                Directory = NULL;
                ObpReleaseLookupContext(LookupContext);

                ObpBeginTypeSpecificCallOut( SaveIrql );

                //
                //  Call the objects parse routine
                //

                Status = (*ParseProcedure)( Object,
                                            (PVOID)ObjectType,
                                            AccessState,
                                            AccessCheckMode,
                                            Attributes,
                                            ObjectName,
                                            &RemainingName,
                                            ParseContext,
                                            SecurityQos,
                                            &Object );

                ObpEndTypeSpecificCallOut( SaveIrql, "Parse", ObjectHeader->Type, Object );

                //
                //  We can now decrement the object reference count
                //

                ObDereferenceObject( &ObjectHeader->Body );

                //
                //  Check if we have some reparsing to do
                //

                if ((Status == STATUS_REPARSE) || (Status == STATUS_REPARSE_OBJECT)) {

                    //
                    //  See if we've reparsed too many times already and if
                    //  so we'll fail the request
                    //

                    if (--MaxReparse) {

                        //
                        //  Tell the outer loop to continue looping
                        //

                        Reparse = TRUE;

                        //
                        //  Check if we have a reparse object or the name
                        //  starts with a "\"
                        //

                        if ((Status == STATUS_REPARSE_OBJECT) ||
                            (*(ObjectName->Buffer) == OBJ_NAME_PATH_SEPARATOR)) {

                            //
                            //  If the user specified a start directory then
                            //  remove this information because we're taking
                            //  a reparse point to someplace else
                             //

                            if (ARGUMENT_PRESENT( RootDirectoryHandle )) {

                                ObDereferenceObject( RootDirectory );
                                RootDirectoryHandle = NULL;
                            }

                            //
                            //  And where we start is the root directory
                            //  object
                            //

                            ParentDirectory = NULL;
                            RootDirectory = ObpRootDirectoryObject;

                            //
                            //  Now if this is a reparse object (means we have
                            //  encountered a symbolic link that has already been
                            //  snapped so we have an object and remaining
                            //  name that need to be examined) and we didn't
                            //  find an object from the parse routine object
                            //  break out of both loops.
                            //

                            if (Status == STATUS_REPARSE_OBJECT) {

                                Reparse = FALSE;

                                if (Object == NULL) {

                                    Status = STATUS_OBJECT_NAME_NOT_FOUND;

                                } else {

                                    //
                                    //  At this point we have a reparse object
                                    //  so we'll look the directory down and
                                    //  parse the new object
                                    //

                                    goto ReparseObject;
                                }
                            } else {
                                //
                                // At this point Status must be equal to
                                // STATUS_REPARSE because [(Status equals
                                // (STATUS_REPARSE_OBJECT or STATUS_REPARSE))
                                // && (Status != STATUS_REPARSE_OBJECT)]
                                //
                                ReparsedSymbolicLink = TRUE;
                                goto ParseFromRoot;
                            }

                        //
                        //  We did not have a reparse object and the name
                        //  does not start with a "\".  Meaning we got back
                        //  STATUS_REPASE, so now check if the directory
                        //  is the root object directory and if so then
                        //  we didn't the name otherwise we'll drop out of
                        //  the inner loop and reparse true to get back to
                        //  outer loop
                        //

                        } else if (RootDirectory == ObpRootDirectoryObject) {

                            Object = NULL;
                            Status = STATUS_OBJECT_NAME_NOT_FOUND;

                            Reparse = FALSE;
                        }

                    } else {

                        //
                        //  We return object not found if we've exhausted
                        //  the MaxReparse time
                        //

                        Object = NULL;
                        Status = STATUS_OBJECT_NAME_NOT_FOUND;
                    }

                //
                //  We are not reparsing and if we did not get success then
                //  the object is null and we'll break out of our loops
                //

                } else if (!NT_SUCCESS( Status )) {

                    Object = NULL;

                //
                //  We are not reparsing and we got back success but check
                //  if the object is null because that means we really didn't
                //  find the object, and then break out of our loops
                //
                //  If the object is not null then we've been successful and
                //  prosperous so break out with the object set.
                //

                } else if (Object == NULL) {

                    Status = STATUS_OBJECT_NAME_NOT_FOUND;
                }

                break;

            } else {

                //
                //  At this point we do not have a parse routine or if there
                //  is a parse routine it is not for symbolic links or there
                //  may not be a specified insert object
                //
                //  Check to see if we have exhausted the remaining name
                //

                if (RemainingName.Length == 0) {

                    //
                    //  Check if the caller specified an object to insert.
                    //  If specified then we'll break out of our loops with
                    //  the object that we've found
                    //

                    if (!InsertObject) {

                        //
                        //  The user did not specify an insert object
                        //  so we're opening an existing object.  Make sure
                        //  we have traverse access to the container
                        //  directory.
                        //

                        if ( !(AccessState->Flags & TOKEN_HAS_TRAVERSE_PRIVILEGE) ) {

                            if (!ObpCheckTraverseAccess( Directory,
                                                         DIRECTORY_TRAVERSE,
                                                         AccessState,
                                                         FALSE,
                                                         AccessCheckMode,
                                                         &Status )) {

                                Object = NULL;
                                break;
                            }
                        }

                        Status = ObReferenceObjectByPointer( Object,
                                                             0,
                                                             ObjectType,
                                                             AccessMode );

                        if (!NT_SUCCESS( Status )) {

                            Object = NULL;
                        }
                    }

                    break;

                } else {

                    //
                    //  There is some name remaining names to process
                    //  if the directory we're looking at is the
                    //  directory of object types and set ourselves
                    //  up to parse it all over again.
                    //

                    if (ObjectHeader->Type == ObpDirectoryObjectType) {

                        ParentDirectory = Directory;
                        Directory = (POBJECT_DIRECTORY)Object;

                    } else {

                        //
                        //  Otherwise there has been a mismatch so we'll
                        //  set our error status and break out of the
                        //  loops
                        //

                        Status = STATUS_OBJECT_TYPE_MISMATCH;
                        Object = NULL;

                        break;
                    }
                }
            }
        }
    }

    //
    //  We can release the context if our search was unsuccesful.
    //  We still need the directory to be locked if a new object is 
    //  inserted into that directory, until we finish the initialization
    //  (i.e SD, handle, ...). Note the object is visible now and could be accessed
    //  via name. We need to hold the directory lock until we are done.
    //

    if ( !NT_SUCCESS(Status) ) {
        
        ObpReleaseLookupContext(LookupContext);
    }

    //
    //  If the device map has been referenced then dereference it
    //

    if (DeviceMap != NULL) {

        ObfDereferenceDeviceMap(DeviceMap);
    }

    //
    //  At this point we've parsed the object name as much as possible
    //  going through symbolic links as necessary.  So now set the
    //  output object pointer, and if we really did not find an object
    //  then we might need to modify the error status.  If the
    //  status was repase or some success status then translate it
    //  to name not found.
    //

    if (!(*FoundObject = Object)) {

        if (Status == STATUS_REPARSE) {

            Status = STATUS_OBJECT_NAME_NOT_FOUND;

        } else if (NT_SUCCESS( Status )) {

            Status = STATUS_OBJECT_NAME_NOT_FOUND;
        }
    }

    //
    //  If the caller gave us a root directory to search (and we didn't
    //  zero out this value) then free up our reference
    //

    if (ARGUMENT_PRESENT( RootDirectoryHandle )) {

        ObDereferenceObject( RootDirectory );
        RootDirectoryHandle = NULL;
    }

    //
    //  And return to our caller
    //

    return( Status );
}


NTSTATUS
NtMakePermanentObject (
    IN HANDLE Handle
    )

/*++

Routine Description:

    This routine makes the specified object permanent.
    By default, only Local_System may make this call

Arguments:

    Handle - Supplies a handle to the object being modified

Return Value:

    An appropriate status value.

--*/

{
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;
    PVOID Object;
    OBJECT_HANDLE_INFORMATION HandleInformation;
    POBJECT_HEADER ObjectHeader;


    PAGED_CODE();

    //
    //  Get previous processor mode and probe output argument if necessary.
    //

    PreviousMode = KeGetPreviousMode();

    //
    //  The object is being changed to permanent, check if
    //  the caller has the appropriate privilege.
    //
    if (!SeSinglePrivilegeCheck( SeCreatePermanentPrivilege,
                                 PreviousMode)) {

        Status = STATUS_PRIVILEGE_NOT_HELD;
        return( Status );
    }

    Status = ObReferenceObjectByHandle( Handle,
                                        0,
                                        (POBJECT_TYPE)NULL,
                                        PreviousMode,
                                        &Object,
                                        &HandleInformation );
    if (!NT_SUCCESS( Status )) {
        return( Status );
    }

    //
    //  Make the object permanant.  Note that the object should still
    //  have a name and directory entry because its handle count is not
    //  zero
    //

    ObjectHeader = OBJECT_TO_OBJECT_HEADER( Object );

    //
    // Other bits are set in this flags field by the handle database code. Synchronize with that.
    //
    
    ObpLockObject( ObjectHeader );

    ObjectHeader->Flags |= OB_FLAG_PERMANENT_OBJECT;

    //
    // This routine releases the type mutex
    //
    
    ObpUnlockObject( ObjectHeader );

    ObDereferenceObject( Object );

    return( Status );
}