Finding out which driver responds to which IO handle passed to a `DeviceIoControl` Call

67 Views Asked by At

I have a driver installed that responds to DeviceIoControl calls with the handle "\\.\ATKACPI". Is there a way to find out which driver provides or responds to that handle, or any other handle in general?

1

There are 1 best solutions below

0
MrSomeone On

I didn't quite figure it out, but sysinternal's WinObj tool can list all named device objects. Alternatively, you could call NtOpenDirectoryObject with "\Device" then call NtQueryDirectoryObject on the handle to list all handles there.