21,616
社区成员




#include <ntddk.h>
#define INITCODE code_seg("INIT")
typedef struct _DEVICE_EXTENSION{
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName;
UNICODE_STRING ustrSymLinkName;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;
extern "C" NTSTATUS CreateDevice(
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
UNICODE_STRING szDevName;
RtlInitUnicodeString(&szDevName,L"\\Device\\MyWDKDevice");
status=IoCreateDevice(pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)szDevName,
FILE_DEVICE_UNKNOWN,
0,TRUE,&pDevObj);
if(!NT_SUCCESS(status))
return status;
pDevObj->Flags|=DO_BUFFERED_IO;
pDevExt=(PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice=pDevObj;
pDevExt->ustrDeviceName=szDevName;
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\?\\HelloWDK");
pDevExt->ustrSymLinkName=symLinkName;
status=IoCreateSymbolicLink(&symLinkName,&szDevName);
if(!NT_SUCCESS(status))
{
IoDeleteDevice(pDevObj);
return status;
}
return STATUS_SUCCESS;
}
extern "C" VOID RaiseIRQL()
{
KIRQL oldIrql;
ASSERT(KeGetCurrentIrql()<=DISPATCH_LEVEL);
if(KeGetCurrentIrql()==PASSIVE_LEVEL)
{
DbgPrint("PASSIVE_LEVEL");
DbgPrint("%d",KeGetCurrentIrql());
KeRaiseIrql(DISPATCH_LEVEL,&oldIrql);
}
DbgPrint("%d",KeGetCurrentIrql());
KeLowerIrql(oldIrql);
if(KeGetCurrentIrql()==PASSIVE_LEVEL)
{
DbgPrint("PASSIVE_LEVEL recover");
DbgPrint("%d",KeGetCurrentIrql());
}
}
extern "C" VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
DbgPrint("Enter DriverUnload\n");
pNextObj=pDriverObject->DeviceObject;
while(pNextObj!=NULL)
{
PDEVICE_EXTENSION pDevExt=(PDEVICE_EXTENSION)pNextObj->DeviceExtension;
UNICODE_STRING pLinkName=pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj=pNextObj->NextDevice;
IoDeleteDevice(pDevExt->pDevice);
}
DbgPrint("DriverUnload Complete!\n");
}
extern "C" NTSTATUS DDKDispatchRoutine(
IN PDEVICE_OBJECT pDeviceObj,
IN PIRP pIrp)
{
DbgPrint("Enter DDKDispatchRoutine \n");
PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(pIrp);
static CHAR* irpname[]=
{
"IRP_MJ_CREATE",
"IRP_MJ_CREATE_NAMED_PIPE",
"IRP_MJ_CLOSE",
"IRP_MJ_READ",
"IRP_MJ_WRITE",
"IRP_MJ_QUERY_INFORMATION",
"IRP_MJ_SET_INFORMATION",
"IRP_MJ_QUERY_EA",
"IRP_MJ_SET_EA",
"IRP_MJ_FLUSH_BUFFERS",
"IRP_MJ_QUERY_VOLUME_INFORMATION",
"IRP_MJ_SET_VOLUME_INFORMATION",
"IRP_MJ_DIRECTORY_CONTROL",
"IRP_MJ_FILE_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CONTROL",
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
"IRP_MJ_SHUTDOWN",
"IRP_MJ_LOCK_CONTROL",
"IRP_MJ_CLEANUP",
"IRP_MJ_CREATE_MAILSLOT",
"IRP_MJ_QUERY_SECURITY",
"IRP_MJ_MJ_POWER",
"IRP_MJ_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CHANGE",
"IRP_MJ_QUERY_QUOTA",
"IRP_MJ_SET_QUOTA",
"IRP_MJ_PNP"
};
UCHAR type=stack->MajorFunction;
if(type>=ARRAYSIZE(irpname))
DbgPrint("UnKnown TRP,major type is %x\n",type);
else
DbgPrint("\t%s\n",irpname[type]);
NTSTATUS status=STATUS_SUCCESS;
pIrp->IoStatus.Status=status;
pIrp->IoStatus.Information=0;
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
DbgPrint("Leave DispatchRoutine\n");
return status;
}
#pragma INITCODE
extern "C" NTSTATUS DriverEntry(
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload=DriverUnload;
/*
PEPROCESS pEProcess=PsGetCurrentProcess();
PTSTR pName=(PSTR)((ULONG)pEProcess+0x16c);
DbgPrint("%s\n",pName);
RaiseIRQL();
*/
DbgPrint("DriverEntry Started!\n");
pDriverObject->MajorFunction[IRP_MJ_CREATE]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLEANUP]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_SET_INFORMATION]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN]=DDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL]=DDKDispatchRoutine;
NTSTATUS status=CreateDevice(pDriverObject);
DbgPrint("DriverEntry Ended!\n");
return STATUS_SUCCESS;
}
#include <ntddk.h>
#define INITCODE code_seg("INIT")
typedef struct _DEVICE_EXTENSION{
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName;
UNICODE_STRING ustrSymLinkName;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;
extern "C" NTSTATUS CreateDevice(
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
UNICODE_STRING szDevName;
RtlInitUnicodeString(&szDevName,L"\\Device\\MyWDKDevice");
status=IoCreateDevice(pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)szDevName,
FILE_DEVICE_UNKNOWN,
0,TRUE,&pDevObj);
if(!NT_SUCCESS(status))
return status;
pDevObj->Flags|=DO_BUFFERED_IO;
pDevExt=(PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice=pDevObj;
pDevExt->ustrDeviceName=szDevName;
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\?\\HelloWDK");
pDevExt->ustrSymLinkName=symLinkName;
status=IoCreateSymbolicLink(&symLinkName,&szDevName);
if(!NT_SUCCESS(status))
{
IoDeleteDevice(pDevObj);
return status;
}
return STATUS_SUCCESS;
}
extern "C" VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
DbgPrint("Enter DriverUnload\n");
pNextObj=pDriverObject->DeviceObject;
while(pNextObj!=NULL)
{
PDEVICE_EXTENSION pDevExt=(PDEVICE_EXTENSION)pNextObj->DeviceExtension;
UNICODE_STRING pLinkName=pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj=pNextObj->NextDevice;
IoDeleteDevice(pDevExt->pDevice);
}
DbgPrint("DriverUnload Complete!\n");
}
#pragma INITCODE
extern "C" NTSTATUS DriverEntry(
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload=DriverUnload;
DbgPrint("DriverEntry Started!\n");
NTSTATUS status=CreateDevice(pDriverObject); //没有这行就不会错
DbgPrint("DriverEntry Ended!\n");
return STATUS_SUCCESS;
}