
IRP_MJ_READ的派遣函数中调用该函数总是失败,返回代码是:#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
换了个方法:ObreferecnByName 返回的代码呢是: #define STATUS_OBJECT_TYPE_MISMATCH ((NTSTATUS)0xC0000024L)
然而在初始化创建驱动设备的时候是可以的:

以下是所有代码:
/****************.h*********************//
#pragma once
#include <Ntifs.h>
#define ArraySize(p) (sizeof(p)/sizeof(p[0]))
#define MAX_PROCESS_SIZE 1024
#define PAGECODE code_seg("PAGE")
#define INITCODE code_seg("INIT")
#define LOCKCODE code_seg()
#define Print(p) KdPrint((p));
#define PAGEDATA data_seg("PAGE")
#define INITDATA data_seg("INIT")
#define LOCKDATA data_seg()
typedef struct _DEVICE_EXTENSION{
PDEVICE_OBJECT pdv;
UNICODE_STRING devName;
UNICODE_STRING devSymLikn;
PUCHAR DeviceBuff;
ULONG BuffLength;
PIRP pIrp;
PDEVICE_OBJECT pTragetDevice;
PVOID VirutalArrd;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;
#pragma LOCKCODE
VOID UnInstallDriver(PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pdev = pDriverObject->DeviceObject;
while(pdev != NULL)
{
PDEVICE_EXTENSION pdevExt =(PDEVICE_EXTENSION)pdev->DeviceExtension;
KdPrint(("SumLink----%S",pdevExt->devSymLikn));
IoDeleteSymbolicLink(&(pdevExt->devSymLikn));
pdev = pdevExt->pdv->NextDevice;
IoDeleteDevice(pdevExt->pdv);
}
Print("UninStall Complete\n");
}
#pragma LOCKCODE
NTSTATUS DeviceRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
Print("Steup Routine\n");
pIrp->IoStatus.Information = 0;
pIrp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
typedef struct RW_CONTEXT
{
PMDL NewMdl;
PMDL OldMdl;
ULONG Length;
ULONG ReadSize;
ULONG AlreadlyLength;
ULONG_PTR VirtualAddress;
PDEVICE_EXTENSION pDevExt;
PIRP UserIrp;
PDEVICE_OBJECT pTarDevice;
KEVENT Uevent;
}RWCONTEST,*PRWCONTEXT;
#define Ioctl_Read CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_OUT_DIRECT,FILE_ANY_ACCESS)
NTKERNELAPI
NTSTATUS
ObReferenceObjectByName(
__in PUNICODE_STRING ObjectName,
__in ULONG Attributes,
__in_opt PACCESS_STATE AccessState,
__in_opt ACCESS_MASK DesiredAccess,
__in POBJECT_TYPE ObjectType,
__in KPROCESSOR_MODE AccessMode,
__inout_opt PVOID ParseContext,
__out PVOID *Object
);
extern POBJECT_TYPE IoDeviceObjectType;
/**********************.c*********************/
#include "..\Include\inc.h"
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject);
NTSTATUS OperatoeDevice(PDEVICE_OBJECT pDrviceObject,PIRP pIrp);
NTSTATUS IoCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp, PVOID Context);
NTSTATUS CreateIrpRoutine(PDEVICE_OBJECT pDeviceObjec,PIRP pIrp);
NTSTATUS CloseDeviceIrpRoutine(PDEVICE_OBJECT pDevcieObject,PIRP pIrp);
#pragma INITCODE
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
NTSTATUS status = STATUS_SUCCESS;
int i =0;
Print("start DriverEntry Device B\n");
for (i;i<ArraySize(pDriverObject->MajorFunction);i++)
{
pDriverObject->MajorFunction[i] = CloseDeviceIrpRoutine;
}
pDriverObject->MajorFunction[IRP_MJ_READ] = OperatoeDevice;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = CloseDeviceIrpRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE]= CloseDeviceIrpRoutine;
pDriverObject->DriverUnload = UnInstallDriver;
status = CreateDevice(pDriverObject);
if (!NT_SUCCESS(status))
{
Print("Create Device Failed\n");
return status;
}
return STATUS_SUCCESS;
}
#pragma INITCODE
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING pDevName;
PDEVICE_OBJECT pdev;
PDEVICE_EXTENSION pDevExt;
PDEVICE_OBJECT DEVICEOBJECT;
PFILE_OBJECT FileObject;
PDEVICE_OBJECT pTarget;
UNICODE_STRING TargetDeviceName;
Print("Starup Driver B \n");
RtlInitUnicodeString(&pDevName,L"\\Device\\MyDeviceName");
RtlInitUnicodeString(&TargetDeviceName,L"\\Device\\MoonDeviceA");
status = IoCreateDevice(pDriverObject,sizeof(DEVICE_EXTENSION),&pDevName,FILE_DEVICE_UNKNOWN,0,TRUE,&pdev);
if (!NT_SUCCESS(status))
{
Print("Create Device B failed\n");
return status;
}
pDevExt = (PDEVICE_EXTENSION)pdev->DeviceExtension;
pDevExt->devName = pDevName;
pdev->Flags |=DO_DIRECT_IO;
pDevExt->pdv = pdev;
KdPrint(("Create DeviceB Successful\n"));
status = IoGetDeviceObjectPointer(&TargetDeviceName,FILE_ALL_ACCESS,&FileObject,&DEVICEOBJECT);
if (!NT_SUCCESS(status))
{
KdPrint(("Get TarDevice Point Failed\n"));
IoDeleteDevice(pdev);
return status;
}
pTarget = IoAttachDeviceToDeviceStack(pdev,DEVICEOBJECT);
pDevExt->pTragetDevice = pTarget;
if (!pTarget)
{
KdPrint(("Ioattach failed\n"));
IoDeleteDevice(pdev);
ObDereferenceObject(FileObject);
return STATUS_INSUFFICIENT_RESOURCES;
}
pdev->Flags |=(pTarget->Flags &(DO_DIRECT_IO | DO_BUFFERED_IO));
pdev->Flags &=~DO_DEVICE_INITIALIZING;
pdev->Characteristics = pTarget->Characteristics;
pdev->DeviceType = pTarget->DeviceType;
ObDereferenceObject(FileObject);
return STATUS_SUCCESS;
}
#pragma PAGECODE
NTSTATUS CreateIrpRoutine(PDEVICE_OBJECT pDeviceObjec,PIRP pIrp)
{
NTSTATUS status = STATUS_SUCCESS;
PDEVICE_EXTENSION pdev = (PDEVICE_EXTENSION)pDeviceObjec->DeviceExtension;
IoSkipCurrentIrpStackLocation(pIrp);
IoCallDriver(pdev->pTragetDevice,pIrp);
KdPrint(("CreateIrpRoutine\n"));
return status;
}
#pragma PAGECODE
NTSTATUS CloseDeviceIrpRoutine(PDEVICE_OBJECT pDevcieObject,PIRP pIrp)
{
PDEVICE_EXTENSION pdevExt;
ULONG Type;
PIO_STACK_LOCATION stack;
static char* irpname[] =
{
"IRP_MJ_CREATE",
"IRP_MJ_CREATE_NAMED_PIPE",
"IRP_MJ_CLOSE",
"IRP_MJ_READ",
"IRP_MJ_WRITE",
"IRP_MJ_QUERY_INFORMATION",
"IRP_MJ_SET_INFORMATION",
"IRP_MJ_QUERY_EA",
"IRP_MJ_SET_EA",
"IRP_MJ_FLUSH_BUFFERS",
"IRP_MJ_QUERY_VOLUME_INFORMATION",
"IRP_MJ_SET_VOLUME_INFORMATION",
"IRP_MJ_DIRECTORY_CONTROL",
"IRP_MJ_FILE_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CONTROL",
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
"IRP_MJ_SHUTDOWN",
"IRP_MJ_LOCK_CONTROL",
"IRP_MJ_CLEANUP",
"IRP_MJ_CREATE_MAILSLOT",
"IRP_MJ_QUERY_SECURITY",
"IRP_MJ_SET_SECURITY",
"IRP_MJ_POWER",
"IRP_MJ_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CHANGE",
"IRP_MJ_QUERY_QUOTA",
"IRP_MJ_SET_QUOTA",
"IRP_MJ_PNP",
};
stack= IoGetCurrentIrpStackLocation(pIrp);
Type = stack->MajorFunction;
if(Type >= ArraySize(irpname))
{
KdPrint(("Unknown Irp\n"));
}
else
{
KdPrint(("Irp Type == %s",irpname[Type]));
}
pdevExt = (PDEVICE_EXTENSION)pDevcieObject->DeviceExtension;
IoSkipCurrentIrpStackLocation(pIrp);
IoCallDriver(pdevExt->pTragetDevice,pIrp);
KdPrint(("CloseDeviceIrpRoutine\n"));
return STATUS_SUCCESS;
}
#pragma LOCKCODE
NTSTATUS IoCompleteRoutine(PDEVICE_OBJECT pDeviceObject,PIRP pIrp, PVOID Context)
{
PRWCONTEXT pContext= (PRWCONTEXT)Context;
PIO_STACK_LOCATION stack;
ULONG stareLong;
KdPrint(("IoCompleteRoutine---\n"));
if (pContext && NT_SUCCESS(pIrp->IoStatus.Status))
{
pContext->AlreadlyLength += pIrp->IoStatus.Information;
pContext->Length -= pIrp->IoStatus.Information;
if(pContext->Length)
{
if (pContext->Length > MAX_PROCESS_SIZE)
{
stareLong = MAX_PROCESS_SIZE;
}
else
{
stareLong = pContext->Length;
}
MmPrepareMdlForReuse((PMDL)pContext->NewMdl);
IoBuildPartialMdl(pContext->UserIrp->MdlAddress,(PMDL)pContext->NewMdl,(PVOID)pContext->VirtualAddress,stareLong);
pContext->VirtualAddress += stareLong;
pContext->Length -=stareLong;
IoCopyCurrentIrpStackLocationToNext(pIrp);
stack = IoGetNextIrpStackLocation(pIrp);
stack->Parameters.Read.Length = stareLong;
stack->Parameters.Write.Length =stareLong;
IoSetCompletionRoutine(pIrp,IoCompleteRoutine,pContext,TRUE,TRUE,TRUE);
IoCallDriver(pContext->pTarDevice,pIrp);
return STATUS_MORE_PROCESSING_REQUIRED;
}
else
{
pContext->UserIrp->IoStatus.Information = pContext->AlreadlyLength;
}
}
return STATUS_MORE_PROCESSING_REQUIRED;
}
#pragma PAGECODE
NTSTATUS OperatoeDevice(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
NTSTATUS status =STATUS_SUCCESS;
PDEVICE_OBJECT pTarDev;
UNICODE_STRING TarName;
PIRP pNewIrp;
PMDL pNewMdl;
PFILE_OBJECT pFileObject;
//HANDLE handle;
IO_STATUS_BLOCK TarBlock;
PIO_STACK_LOCATION stack;
PVOID UserVirtualAddress;
ULONG UserVirtualSize;
PRWCONTEXT pConText;
PUCHAR ReadBuff;
ULONG max_read_size;
ULONG LastReadSize;
KEVENT Revent;
// PDRIVER_OBJECT pDriverObject;
stack = IoGetCurrentIrpStackLocation(pIrp);
KeInitializeEvent(&Revent,NotificationEvent,FALSE);
RtlInitUnicodeString(&TarName,L"\\Device\\MoonDeviceA");
status = IoGetDeviceObjectPointer(&TarName,FILE_ALL_ACCESS,&pFileObject,&pTarDev);
if(!NT_SUCCESS(status))
{
KdPrint(("error COde == %08X",status));
status = STATUS_UNSUCCESSFUL;
goto IrpState;
}
UserVirtualAddress = MmGetMdlVirtualAddress(pIrp->MdlAddress);
UserVirtualSize = MmGetMdlByteCount(pIrp->MdlAddress);
KdPrint(("User Mdl == %08X\n",UserVirtualAddress));
KdPrint(("Use Mdl length == %d\n",UserVirtualSize));
// status = ObReferenceObjectByName(&TarName,OBJ_CASE_INSENSITIVE,NULL,FILE_ALL_ACCESS,IoDeviceObjectType,KernelMode,NULL,(PVOID*)&pTarDev);
// //status = IoGetDeviceObjectPointer(&TarName,FILE_ALL_ACCESS,&pFileObject,&pTarDev);
// if(!NT_SUCCESS(status))
// {
// KdPrint(("error COde == %08X",status));
// status = STATUS_UNSUCCESSFUL;
// goto IrpState;
// }
// KdPrint(("ObReferenceObjectByName-----\n"));
// status = ObOpenObjectByPointer(pTarDev,0,0,PROCESS_ALL_ACCESS,NULL,KernelMode,&handle);
// if(!NT_SUCCESS(status))
// {
// status = STATUS_UNSUCCESSFUL;
// goto IrpState;
// }
// status = ObReferenceObjectByHandle(handle,FILE_ALL_ACCESS,*IoFileObjectType,KernelMode,(PVOID*)&pFileObject,NULL);
// KdPrint(("ObReferenceObjectByHandle-----\n"));
// if(!NT_SUCCESS(status))
// {
// status = STATUS_UNSUCCESSFUL;
// }
pConText =(PRWCONTEXT) ExAllocatePool(PagedPool,sizeof(RWCONTEST));
pConText->Length = UserVirtualSize ;
pConText->OldMdl = pIrp->MdlAddress;
if(UserVirtualSize > MAX_PROCESS_SIZE)
{
max_read_size = MAX_PROCESS_SIZE;
}
else
{
max_read_size= UserVirtualSize;
}
ReadBuff =(PUCHAR) ExAllocatePool(PagedPool,max_read_size);
pNewIrp = IoBuildSynchronousFsdRequest(IRP_MJ_READ,pTarDev,ReadBuff,max_read_size,0,&Revent,&TarBlock);
KdPrint(("IoBuildAsynchronousFsdRequest-----\n"));
if (pNewIrp == NULL)
{
status = STATUS_UNSUCCESSFUL;
goto IrpState;
}
pNewMdl = IoAllocateMdl(UserVirtualAddress,UserVirtualSize,FALSE,FALSE,pNewIrp);
pNewIrp->MdlAddress = pNewMdl;
pConText->NewMdl = pNewMdl;
pConText->AlreadlyLength=0;
pConText->AlreadlyLength = max_read_size;
pConText->VirtualAddress = (ULONG_PTR)UserVirtualAddress+max_read_size ;
pConText->UserIrp = pIrp;
KeInitializeEvent(&(pConText->Uevent),NotificationEvent,FALSE);
IoCopyCurrentIrpStackLocationToNext(pNewIrp);
IoSetCompletionRoutine(pNewIrp,IoCompleteRoutine,pConText,TRUE,TRUE,TRUE);
LastReadSize = pConText->AlreadlyLength;
status = IoCallDriver(pTarDev,pNewIrp);
IrpState:
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = LastReadSize;//pConText->AlreadlyLength;
//if(IoFreeMdl !=NULL)
//IoFreeMdl(pNewMdl);
//if(pConText != NULL)
//ExFreePool(pConText);
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return status;
}
转载自:http://tudian2007.blog.163.com/blog/static/3156641320137295338938/Windows 驱动中获取指定的设备对象 众所周知应用层要和驱动层通讯的话需要先打开驱动设备对象,因为驱动设备名只是对内核模式中的驱动...
一丶理论知识,什么是过滤. 过滤就是在不影响上层跟下层的情况下,加入我们的新一层的设备. 当请求数据发送过来的时候.我们可以对这个数据进行操作.... ...二丶过滤使用的API....NTSTATUSIoAttachDevice(INPDEVICE_OBJECTSo...
内核对象(Kernel Object)是Winodws操作系统中最核心的一个概念,本章主要介绍“内核对象”整个抽象概念的共性,而不针对具体的某个内核对象。 这一章介绍了“内核对象”的公共属性:usage count(使用计数) 和...
进行过滤的最主要的方法是对一个设备对象(Device Object)进行绑定。通过编程可以生成一个虚拟设备对象,并“绑定”(Attach)在一个真实的设备上。一旦绑定,则本来操作系统发送给真实设备的请求,就会首先发送...
学习了几个月的内核编程,现在对Windows驱动开发又了更加深入的认识,特别是对IRP的分层处理逻辑有了深入认识。 总结起来就几句话: 当irp下来的时候,你要根据实际情况,进行处理 1> 无处理,继续往下传 ...
在Windows系统上与安全软件相关的驱动开发过程中,“过滤(filter)”是极其重要的一个概念。过滤是在不影响上层和下层...进行过滤的最主要方法是对一个设备对象(Device Object)进行绑定。通过编程生成一个虚拟...
过滤驱动程序 过滤驱动程序可以修改已有驱动的功能,...活,不用设置注册表,直接在内存中寻找设备对象,然后自行创建过滤驱动并将自己附加在这个驱动之 上。 过滤驱动的入口函数需要将所有的IRP都设置
文章目录过滤的概念设备绑定的内核API之一绑定示例设备绑定的内核API之二生成过滤设备并绑定从名字获得设备对象绑定所有串口代码完整代码 过滤的概念 过滤–是一个极其重要的概念。它是在不影响上层和下层接口的...
一、过滤的概念 “过滤”(filter)是极其重要的一个概念... 通过编程可以生成一个虚拟的设备对象,并“绑定”(Attach)在一个真实的设备上。一旦绑定,则本来操作系统发送给真实设备 的请求,就会首先发送到...
文章目录串口的过滤7.1 过滤的概念7.1.1 设备绑定的内核API之一7.1.2 设备绑定的内核API之二7.1.3 生成过滤设备并绑定7.1.4 从名字获得设备对象7.1.5 绑定所有串口7.2 获得实际数据7.2.1 请求的区分7.2.2 请求的结局...
第三章 串口过滤 ...进行过滤的最主要的方法是对一个设备对象(DO)进行绑定。 我们可以首先认为:一个真实的设备对应一个设备对象(实际对应关系可能复杂的多)。通过编程生成一个虚拟的DO,并Attac
在Windows系统上与安全软件相关的驱动开发过程中,“过滤(filter)”是极其重要的一个概念。过滤是在不影响上层和下层接口的情况下,在Windows系统内核中加入新的层,从而不需要修改上层的软件和下层的真实驱动,就...
第三章 串口过滤 在windows系统上与安全软件相关的驱动开发中,“过滤”(filter)是...我们可以首先认为:一个真实的设备对应一个设备对象(实际对应关系可能复杂的多)。通过编程生成一个虚拟的DO,并Attach在一个...
绑定设备的内核API函数: NTSTATUS IoAttachDevice( IN PDEVICE_OBJECT SourceDevice , //调用者生成的用来过滤的虚拟设备 IN PUNICODE_STRING TargetDevice , //要被绑定的目标设备(设备名字) ...
每个驱动对象代表一个已经加载的内核驱动程序,指向驱动对象结构的指针常常作为DriverEntry,AddDevice,Unload等函数的参数。 驱动对象结构是半透明的(即结构中只有部分域是公开的),其中公开的域包括...
进行过滤的最主要的方法是对一个设备对象(Device Object)进行绑定。通过编程可以生成一个虚拟设备对象,并“绑定”(Attach)在一个真实的设备上。一旦绑定,则本来操作系统发送给真实设...
一个修改NT内核的真实RootKit 创建时间:2003-06-14 文章属性:翻译 文章提交:TOo2y (too2y_at_safechina.net) ...------------------[ Phrack 杂志 --- 卷标 9 | 期刊 55 ] ...------------------[ 一个修改NT...
一个简单的串口过滤驱动框架用来对串口的读写进行过滤。 注意问题: 用来和应用层通信的buffer区域有三种方式。 完成的读写分发函数的方式特殊还未搞懂? //以下为完整代码 #include #include ...
Windows 远程内核漏洞注入作者:Barnaby Jack译:北极星2003EMAIL:zhangjingsheng_nbu@yahoo.com.cn说明:只翻译原资料的所有技术相关部分, 忽略了一小部分冗余信息。-----------------------------------------...
Windows 远程内核漏洞注入作者:Barnaby Jack译:北极星2003EMAIL:zhangjingsheng_nbu@yahoo.com.cn说明:只翻译原资料的所有技术相关部分, 忽略了一小部分冗余信息。-----------------------------------------...
第7章 串口的过滤
jdk1.8 64位官方正式版 jdk-8u91-windows
C#入门必看含有100个例字,每个例子都是针对C#的学习关键知识点设计的,是学习C#必须知道的一些程序例子,分享给大家,需要的可以下载
《Python数据分析与挖掘实战》的ppt 内容详细 讲解清楚
这本面试手册包含了Java基础、Java集合、JVM、Spring、Spring Boot、Spring Cloud、Mysql、Redis、RabbitMQ、Dubbo、Netty、分布式及架构设计等方面的技术点。内容难度参差,满足初中高级Java工程师的面试需求。
xshell6 和 xftp6个人版,直接安装即可使用。
从0开始,Linux云计算系列课程,包含Linux初级运维、运维、初级架构师、云计算运维及开发..... a:0:{}
matlab2018a种子,包括百度网盘链接,迅雷链接等。可用迅雷下载
七夕节、情人节表白用的HTML源码(两款)