用IoGetDeviceObjectPointer打开的设备如何关闭？

When unloading, a driver can dereference the file object as a means of indirectly dereferencing the device object. To do so, the driver calls ObDereferenceObject from its Unload routine, passing the file object pointer returned by GetDeviceObjectPointer.

再打pp :D

no :D
但是不至于死机吧？ :o

用 ObDereferenceObject(...)

请求再打pp  :D
必须在DriverUnload里面调用吗？

我把它们用在是在同一个函数serialeventtracking中
ObReferenceObject(readerx->pFileObj);
用完了就
ObDereferenceObject(readerx->pFileObj);

2000下没问题，xp下为什么不行泥？

还有就是
NTSTATUS
  IoGetDeviceObjectPointer(
  IN PUNICODE_STRING  ObjectName,
  IN ACCESS_MASK  DesiredAccess,
  OUT PFILE_OBJECT  *FileObject,
  OUT PDEVICE_OBJECT  *DeviceObject
  );
返回两个pointer，是不是只需要reference dereference FileObject就可以？？
有没有必要reference dereference返回的DeviceObject呢？
几位高手多多指教指教

不错，只需要reference dereference FileObject就可以
因为我们在用IoGetDeviceObjectPointer的时候，系统会先通过ZwOpenFile,ObRefenencrObjectHandle来获得目标设备的ＦＩＬＥＯＢＪ，然后通过这个ＦＩＬＥＯＢＪ来用IoGetRelatedDeviceObject获得目标设备对象，所以也是为什么在退出前需要dereference FileObject，另外ＤＤＫ里也有说明
This routine also returns a pointer to the corresponding file object. When unloading, a driver can dereference the file object as a means of indirectly dereferencing the device object. To do so, the driver calls ObDereferenceObject from its Unload routine, passing the file object pointer returned by IoGetDeviceObjectPointer. Failure to dereference the device object in a driver\'s Unload routine prevents the next-lower driver from being unloaded. However, drivers that close the file object before the unload process must take out an extra reference on the device object before dereferencing the file object. Otherwise, dereferencing the file object can lead to a premature deletion of the device object.

另外在IoGetRelatedDeviceObject里系统会调用IoGetAttachedDevice来搜索设备栈，找到其顶层设备对象返回给你，所以也是为什么ＤＤＫ里说IoGetDeviceObjectPointer establishes a \"connection\" between the caller and the next-lower-level driver.也就是说给你的并不一定是目标设备对象的指针，如果其上有过滤驱动的话，给你的将是最上层的过滤设备对象指针，从而可以确保你的对象能够始终处于设备栈顶，当然你也可以把自己的设备插到栈当中，不过当中的很多调整工作，也够受的了，嘿嘿．．．．．．

IoGetDeviceObjectPointer应该自己就增加了对设备的引用了吧，不用再ObReferenceObjectByPointer了。
DDK里面说：
However, drivers that close the file object before the unload process must take out an extra reference on the device object before dereferencing the file object. Otherwise, dereferencing the file object can lead to a premature deletion of the device object.
意思就是只要不关闭file object ，就可以使用device object，如果要在unload之前关闭file object而又想继续使用device object，才需要增加对device object的引用。
不知道可以混点分不？