1.1.4 Objects and Resources

IoCreateDevice: Initializes a device object, representing a physical, virtual, or logical device for which the driver is being loaded into the system, and allocates space for the driver-defined device extension associated with the device object. This routine also initializes a device object representing a logical or virtual device if the driver can reconfigure its devices dynamically, as, for example, when a disk is repartitioned dynamically.
IoDeleteDevice: Removes a device object from the system when a driver is being unloaded or when its logical or virtual devices are being reconfigured dynamically.
IoGetDeviceObjectPointer: Returns a pointer to a device object with a given name if the caller’s desired access to the object can be granted; also returns a pointer to the file object referenced by the named device object. In effect, this routine establishes a connection between the caller and the next-lower-level driver. A successful caller can use the returned device object pointer to initialize its own device object(s) and as an argument to IoBuildAsynchronousFsdRequest, IoBuildSynchronousFsdRequest, IoBuildDeviceIoControlRequest, IoAttachDeviceToDeviceStack, and IoCallDriver.
IoAttachDevice: “Attaches” a given source device object (belonging to the caller) to a named target device object (usually belonging to the next-lower-level-driver), so that I/O requests bound for the target device are routed first to the caller.
IoAttachDeviceToDeviceStack: “Attaches” the caller’s device object to the highest device object in a chain of drivers and returns a pointer to the previously highest device object. I/O requests bound for the target device are routed first to the caller.
IoDetachDevice: Releases an attachment between the caller’s device object and a target driver’s device object.
IoCreateSymbolicLink: Sets up a symbolic link object, aliasing a named device object to a user-visible name for the same device.
IoCreateUnprotectedSymbolicLink: Sets up a symbolic link object, aliasing a named device object to a user-visible name for the same device and allowing user-mode callers to affect the mode of the device (for example, parallel and serial drivers call this routine so users can redirect output).
IoDeleteSymbolicLink: Releases a symbolic link between a device object name and a user-visible name.
IoAssignArcName: Sets up a symbolic link between a named device object (such as a tape, floppy, or CD-ROM) and the corresponding ARC name for the device.
IoDeassignArcName: Releases the symbolic link created by calling IoAssignArcName.
IoSetShareAccess: Sets the access allowed to a given file object representing a device. (Only highest-level drivers can call this routine.)
IoConnectInterrupt: Registers a driver’s ISR), according to the parameters obtained by calling HalGetInterruptVector. Returns a pointer to a set of allocated, initialized, and connected interrupt objects that is used as an argument to KeSynchronizeExecution.
IoDisconnectInterrupt: Releases a driver’s interrupt object(s) when the driver unloads.
IoReadPartitionTable: Returns a list of partitions on a disk with a given sector size.
IoSetPartitionInformation: Sets the partition type and number for a (disk) partition.
IoWritePartitionTable: Writes partition tables for a disk, given the device object representing the disk, the sector size, and a pointer to a buffer containing the drive geometry.
IoCreateController: Initializes a controller object, representing a physical device controller shared by two or more like devices with the same driver, and specifies the size of the controller extension.
IoDeleteController: Removes a controller object from the system.
KeInitializeSpinLock: Initializes a variable of type KSPIN_LOCK.
KeInitializeDpc: Initializes a DPC object, setting up a driver-supplied CustomDpc routine that can be called with a given context.
KeInitializeTimer: Initializes a notification timer object to the Not-Signaled state.
KeInitializeTimerEx: Initializes a notification or synchronization timer object to the Not-Signaled state.
KeInitializeEvent: Initializes an event object as a synchronization (single waiter) or notification (multiple waiters) type event and sets up its initial state (Signaled or Not-Signaled).
ExInitializeFastMutex: Initializes a fast mutex variable, used to synchronize mutually exclusive access to a shared resource by a set of threads.
KeInitializeMutex: Initializes a mutex object at a given level number as set to the Signaled state.
KeInitializeSemaphore: Initializes a semaphore object to a given count and specifies an upper bound the count can attain.
IoCreateNotificationEvent: Initializes a named notification event to be used to synchronize access between two or more components. Notification events are not auto-resetting.
IoCreateSynchronizationEvent: Initializes a named synchronization event to be used to serialize access to hardware between two otherwise unrelated drivers.
PsCreateSystemThread: Creates a kernel-mode thread associated with a given process object or with the default system process; returns a handle for the thread.
PsTerminateSystemThread: Terminates the current thread and satisfies as many waits as possible for the current thread object.
KeSetBasePriorityThread: Sets up the runtime priority, relative to the system process, for a driver-created thread.
KeSetPriorityThread: Sets up the runtime priority for a driver-created thread with a real-time priority attribute.
MmIsThisAnNtAsSystem: Returns TRUE if the current platform is a server, indicating that more resources are likely to be necessary to process I/O requests than if the machine is a client.
MmQuerySystemSize: Returns whether a small, medium, or large amount of memory is available on the current platform.
ExInitializeNPagedLookasideList: Initializes a lookaside list of nonpaged memory. After a successful initialization, fixed-size blocks can be allocated from and freed to the lookaside list.
ExInitializePagedLookasideList: Initializes a lookaside list of paged memory. After a successful initialization, fixed-size blocks can be allocated from and freed to the lookaside list.
ExInitializeZone: Initializes a zone header for a caller-allocated zone from which fixed-size entries can be allocated and to which entries can be released.
ExInitializeResourceLite: Initializes a resource, for which the caller provides the storage, to be used for synchronization by a set of threads.
ExReinitializeResourceLite: Reinitializes an existing resource variable.
ExDeleteResourceLite: Deletes a caller-initialized resource from the system’s resource list.
ObReferenceObjectByHandle: Returns a pointer to the object body and handle information (attributes and granted access rights), given the handle for an object, the object’s type, and a mask, specifying the desired access to the object, and the access mode (user or kernel, for which access is always granted). A successful call increments the reference count for the object.
ObReferenceObjectByPointer: Increments the reference count for a given object so the caller can ensure that the object is not removed from the system while the caller is using it.
ObDereferenceObject: Releases a reference to an object (decrements the reference count), given a pointer to the object body.
RtlInitString: Sets up the specified string in a buffer.
RtlInitAnsiString: Sets up the specified ANSI string in a buffer.
RtlInitUnicodeString: Sets up the specified Unicode string in a buffer.
InitializeObjectAttributes: Sets up a parameter of type OBJECT_ATTRIBUTES for a subsequent call to a ZwCreateXxx or ZwOpenXxx routine.
ZwCreateDirectoryObject: Creates a directory object with the specified object attributes and allowed access; returns a handle for the directory object.
ZwCreateFile: Creates or opens a file object representing a physical, logical, or virtual device, a directory, a data file, or a volume; returns a handle for the file object.
ZwCreateKey: Creates or opens a key object in the registry; returns a handle for the key object.
ZwDeleteKey: Deletes an existing, open key in the registry when the last handle for the key is closed.
ZwMakeTemporaryObject: Resets an opened object’s “permanent” attribute, so that the object and its name can be deleted when the reference count for the object becomes zero.
ZwClose: Releases the handle for an opened object, causing the handle to become invalid and decrementing the reference count of the object handle.