-1

I have a driver installed that responds to DeviceIoControl calls with the handle "\\.\ATKACPI". Is there a way to find out which driver provides or responds to that handle, or any other handle in general?

MrSomeone
  • 71
  • 1
  • 11
  • 1
    Using Google is always a good idea. Querying for "atkacpi" takes you straight to the Asus support page. – Hans Passant May 14 '23 at 17:07
  • Quit being smart. I'm asking about ANY handle, not just the asus one. Although admittedly I could've mentioned that. And googling atkacpi gives a lot of garbage. – MrSomeone May 14 '23 at 17:15
  • in code or by using some tools manually ? and what is the target ? – RbMm May 14 '23 at 17:25
  • Both if that's possible. Not sure what you mean by target, but I want to know all possible handles for `DeviceIoControl` – MrSomeone May 14 '23 at 17:27
  • *I want to know* - what concrete you want know and how use this ? – RbMm May 14 '23 at 17:28
  • I want to know which .sys file provides which path that can be opened with `CreateFileW` and then passed to `DeviceIoControl` – MrSomeone May 14 '23 at 17:30
  • you can use `ZwQueryObject` with `ObjectNameInformation` for get path that can be opened with `NtOpenFile` (but not in all case) – RbMm May 14 '23 at 17:34

1 Answers1

0

I didn't quite figure it out, but sysinternal's WinObj tool can list all named device objects. Alternatively, you could call NtOpenDirectoryObject with "\Device" then call NtQueryDirectoryObject on the handle to list all handles there.

MrSomeone
  • 71
  • 1
  • 11