From e9cd7f9415353853cf46a940e75e2c5b9d663efa Mon Sep 17 00:00:00 2001 From: Alan Jowett Date: Fri, 6 Mar 2026 13:51:02 -0800 Subject: [PATCH] Export IoFileObjectType mock Add a mock for IoFileObjectType following the existing ExEventObjectType pattern. This is needed by ebpf-for-windows which references IoFileObjectType in ebpf_handle_kernel.c for ObReferenceObjectByHandle calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- inc/usersim/ob.h | 1 + src/Source.def | 1 + src/ob.cpp | 3 +++ 3 files changed, 5 insertions(+) diff --git a/inc/usersim/ob.h b/inc/usersim/ob.h index 776d1f6..29df01b 100644 --- a/inc/usersim/ob.h +++ b/inc/usersim/ob.h @@ -12,6 +12,7 @@ _IRQL_requires_max_(DISPATCH_LEVEL) USERSIM_API LONG_PTR ObfDereferenceObject(_I typedef struct _OBJECT_TYPE* POBJECT_TYPE; USERSIM_API extern POBJECT_TYPE* ExEventObjectType; +USERSIM_API extern POBJECT_TYPE* IoFileObjectType; typedef struct _OBJECT_HANDLE_INFORMATION { diff --git a/src/Source.def b/src/Source.def index 53f77dc..abd9bd8 100644 --- a/src/Source.def +++ b/src/Source.def @@ -6,6 +6,7 @@ LIBRARY EXPORTS ExEventObjectType + IoFileObjectType FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 diff --git a/src/ob.cpp b/src/ob.cpp index 9f97256..0f27781 100644 --- a/src/ob.cpp +++ b/src/ob.cpp @@ -11,6 +11,9 @@ static std::map _object_references; static POBJECT_TYPE _ExEventObjectType = nullptr; USERSIM_API __declspec(align(8)) POBJECT_TYPE* ExEventObjectType = &_ExEventObjectType; +static POBJECT_TYPE _IoFileObjectType = nullptr; +USERSIM_API __declspec(align(8)) POBJECT_TYPE* IoFileObjectType = &_IoFileObjectType; + _IRQL_requires_max_(DISPATCH_LEVEL) USERSIM_API LONG_PTR ObfReferenceObject(_In_ PVOID object) {