每个驱动程序会创建一个或多个设备对象,每个设备对象都会有一个指针指向下一个设备对象
Device结构体源码
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT { CSHORT Type; USHORT Size; LONG ReferenceCount; struct _DRIVER_OBJECT *DriverObject; struct _DEVICE_OBJECT *NextDevice; struct _DEVICE_OBJECT *AttachedDevice; struct _IRP *CurrentIrp; PIO_TIMER Timer; ULONG Flags; // See above: DO_... ULONG Characteristics; // See ntioapi: FILE_... __volatile PVPB Vpb; PVOID DeviceExtension; DEVICE_TYPE DeviceType; CCHAR StackSize; union { LIST_ENTRY ListEntry; WAIT_CONTEXT_BLOCK Wcb; } Queue; ULONG AlignmentRequirement; KDEVICE_QUEUE DeviceQueue; KDPC Dpc; ULONG ActiveThreadCount; PSECURITY_DESCRIPTOR SecurityDescriptor; KEVENT DeviceLock; USHORT SectorSize; USHORT Spare1; struct _DEVOBJ_EXTENSION *DeviceObjectExtension; PVOID Reserved; } DEVICE_OBJECT; typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
字段说明:
DriverObject | 指向驱动程序中的驱动对象,同属于一个驱动对象的设备对象指向的是同一个驱动对象。 |
NextDevice | 这个参数记录下一个设备对象的指针 |
AttachedDevice | 这个参数记录自己被哪一个设备对象所挂载,如果DriverA创建设备对象DeviceA,DriverB创建设备对象DeviceB,并且DeviceB在设备栈的上层,而DeviceA在设备栈的下层,则DeviceA的AttachedDevice属性为DeviceB的地址,而DeviceB的AttachedDevice属性为NULL |