NT驱动笔记

驱动对象  

typedef struct _DRIVER_OBJECT {  
    CSHORT Type;  
    CSHORT Size;  
  
    //  
    // The following links all of the devices created by a single driver  
    // together on a list, and the Flags word provides an extensible flag  
    // location for driver objects.  
    //  
  
    PDEVICE_OBJECT DeviceObject;  
    ULONG Flags;  
  
    //  
    // The following section describes where the driver is loaded.  The count  
    // field is used to count the number of times the driver has had its  
    // registered reinitialization routine invoked.  
    //  
  
    PVOID DriverStart;  
    ULONG DriverSize;  
    PVOID DriverSection;  
    PDRIVER_EXTENSION DriverExtension;  
  
    //  
    // The driver name field is used by the error log thread  
    // determine the name of the driver that an I/O request is/was bound.  
    //  
  
    UNICODE_STRING DriverName;  
  
    //  
    // The following section is for registry support.  Thise is a pointer  
    // to the path to the hardware information in the registry  
    //  
  
    PUNICODE_STRING HardwareDatabase;  
  
    //  
    // The following section contains the optional pointer to an array of  
    // alternate entry points to a driver for "fast I/O" support.  Fast I/O  
    // is performed by invoking the driver routine directly with separate  
    // parameters, rather than using the standard IRP call mechanism.  Note  
    // that these functions may only be used for synchronous I/O, and when  
    // the file is cached.  
    //  
  
    PFAST_IO_DISPATCH FastIoDispatch;  
  
    //  
    // The following section describes the entry points to this particular  
    // driver.  Note that the major function dispatch table must be the last  
    // field in the object so that it remains extensible.  
    //  
  
    PDRIVER_INITIALIZE DriverInit;  
    PDRIVER_STARTIO DriverStartIo;  
    PDRIVER_UNLOAD DriverUnload;  
    PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];  
  
} DRIVER_OBJECT;  
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;   

设备对象：

struct _DEVICE_OBJECT (sizeof=184)
+00 int16 Type
+02 uint16 Size
+04 int32 ReferenceCount
+08 struct _DRIVER_OBJECT *DriverObject
+0c struct _DEVICE_OBJECT *NextDevice
+10 struct _DEVICE_OBJECT *AttachedDevice
+14 struct _IRP *CurrentIrp
+18 struct _IO_TIMER *Timer
+1c uint32 Flags
+20 uint32 Characteristics
+24 struct _VPB *Vpb
+28 void *DeviceExtension
+2c uint32 DeviceType
+30 char StackSize
+34 union __unnamed62 Queue
+34 struct _LIST_ENTRY ListEntry
+34 struct _LIST_ENTRY *Flink
+38 struct _LIST_ENTRY *Blink
+34 struct _WAIT_CONTEXT_BLOCK Wcb
+34 struct _KDEVICE_QUEUE_ENTRY WaitQueueEntry
+34 struct _LIST_ENTRY DeviceListEntry
+34 struct _LIST_ENTRY *Flink
+38 struct _LIST_ENTRY *Blink
+3c uint32 SortKey
+40 byte Inserted
+44 function *DeviceRoutine
+48 void *DeviceContext
+4c uint32 NumberOfMapRegisters
+50 void *DeviceObject
+54 void *CurrentIrp
+58 struct _KDPC *BufferChainingDpc
+5c uint32 AlignmentRequirement
+60 struct _KDEVICE_QUEUE DeviceQueue
+60 int16 Type
+62 int16 Size
+64 struct _LIST_ENTRY DeviceListHead
+64 struct _LIST_ENTRY *Flink
+68 struct _LIST_ENTRY *Blink
+6c uint32 Lock
+70 byte Busy
+74 struct _KDPC Dpc
+74 int16 Type
+76 byte Number
+77 byte Importance
+78 struct _LIST_ENTRY DpcListEntry
+78 struct _LIST_ENTRY *Flink
+7c struct _LIST_ENTRY *Blink
+80 function *DeferredRoutine
+84 void *DeferredContext
+88 void *SystemArgument1
+8c void *SystemArgument2
+90 uint32 *Lock
+94 uint32 ActiveThreadCount
+98 void *SecurityDescriptor
+9c struct _KEVENT DeviceLock
+9c struct _DISPATCHER_HEADER Header
+9c byte Type
+9d byte Absolute
+9e byte Size
+9f byte Inserted
+a0 int32 SignalState
+a4 struct _LIST_ENTRY WaitListHead
+a4 struct _LIST_ENTRY *Flink
+a8 struct _LIST_ENTRY *Blink
+ac uint16 SectorSize
+ae uint16 Spare1
+b0 struct _DEVOBJ_EXTENSION *DeviceObjectExtension
+b4 void *Reserved

NT式驱动模板：

#pragma once

#ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#ifdef __cplusplus
}
#endif 

#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")

#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")

#define arraysize(p) (sizeof(p)/sizeof((p)[0]))

typedef struct _DEVICE_EXTENSION {
	PDEVICE_OBJECT pDevice;
	UNICODE_STRING ustrDeviceName;	//设备名称
	UNICODE_STRING ustrSymLinkName;	//符号链接名
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

// 函数声明

NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
                                          IN PIRP pIrp);

#include "Driver.h"

/************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
      pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
			IN PDRIVER_OBJECT pDriverObject,
			IN PUNICODE_STRING pRegistryPath	) 
{
	NTSTATUS status;
	KdPrint(("Enter DriverEntry
"));

	//注册其他驱动调用函数入口
	pDriverObject->DriverUnload = HelloDDKUnload;
	pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
	pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
	pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
	pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;
	
	//创建驱动设备对象
	status = CreateDevice(pDriverObject);

	KdPrint(("DriverEntry end
"));
	return status;
}

/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
		IN PDRIVER_OBJECT	pDriverObject) 
{
	NTSTATUS status;
	PDEVICE_OBJECT pDevObj;
	PDEVICE_EXTENSION pDevExt;
	
	//创建设备名称
	UNICODE_STRING devName;
	RtlInitUnicodeString(&devName,L"\Device\MyDDKDevice");
	
	//创建设备
	status = IoCreateDevice( pDriverObject,
						sizeof(DEVICE_EXTENSION),
						&(UNICODE_STRING)devName,
						FILE_DEVICE_UNKNOWN,
						0, TRUE,
						&pDevObj );
	if (!NT_SUCCESS(status))
		return status;

	pDevObj->Flags |= DO_BUFFERED_IO;
	pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
	pDevExt->pDevice = pDevObj;
	pDevExt->ustrDeviceName = devName;
	//创建符号链接
	UNICODE_STRING symLinkName;
	RtlInitUnicodeString(&symLinkName,L"\??\HelloDDK");
	pDevExt->ustrSymLinkName = symLinkName;
	status = IoCreateSymbolicLink( &symLinkName,&devName );
	if (!NT_SUCCESS(status)) 
	{
		IoDeleteDevice( pDevObj );
		return status;
	}
	return STATUS_SUCCESS;
}

/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
      pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject) 
{
	PDEVICE_OBJECT	pNextObj;
	KdPrint(("Enter DriverUnload
"));
	pNextObj = pDriverObject->DeviceObject;
	while (pNextObj != NULL) 
	{
		PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
			pNextObj->DeviceExtension;

		//删除符号链接
		UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
		IoDeleteSymbolicLink(&pLinkName);
		pNextObj = pNextObj->NextDevice;
		IoDeleteDevice( pDevExt->pDevice );
	}
}

/************************************************************************
* 函数名称:HelloDDKDispatchRoutine
* 功能描述:对读IRP进行处理
* 参数列表:
      pDevObj:功能设备对象
      pIrp:从IO请求包
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
					 IN PIRP pIrp) 
{
	KdPrint(("Enter HelloDDKDispatchRoutine
"));
	NTSTATUS status = STATUS_SUCCESS;
	// 完成IRP
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = 0;	// bytes xfered
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	KdPrint(("Leave HelloDDKDispatchRoutine
"));
	return status;
}