在拖了几天,调了快一天之后,问题终于在新年的第一天解决,庆贺一下O(∩_∩)O~
在“北极星2003”的CSDN博客上看到说用ObReferenceObjectByName来输出驱动程序的基本信息,结果我去测试的时候无情的蓝屏了。找了好久,终于发现了原因所在。因为博客上的代码是C++,而ObReferenceObjectByName是NativeAPI,所以需要做一个声明,C++用了extern “C”,而我的是C语言,用了ifdef宏定义,忘了加extern了,结果导致了蓝屏。
用WinDbg调试的时候,已进入ObReferenceObjectByName函数,系统就崩溃了,根本无法继续调试。还好最后发现了问题的所在。下面把代码贴出来
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
| #include <ntddk.h>
// 注意对于NativeAPI的声明
// C语言要加上extern
// C++要加上extern "C"
extern NTSTATUS ObReferenceObjectByName(
IN PUNICODE_STRING ObjectPath,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *ObjectPtr
);
extern POBJECT_TYPE *IoDeviceObjectType;
// 卸载例程
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("--------------------------------\n");
}
// 获取信息
NTSTATUS GetInfo()
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
PDRIVER_OBJECT pTestObject = NULL;
UNICODE_STRING uniDriverName;
WCHAR DriverNameBuffer[] = L"\\Driver\\HelloDDK";
RtlInitUnicodeString(&uniDriverName, DriverNameBuffer);
status = ObReferenceObjectByName( &uniDriverName,
OBJ_CASE_INSENSITIVE,
NULL,
0,
*IoDeviceObjectType,
KernelMode,
NULL,
&pTestObject);
if(!NT_SUCCESS(status))
{
DbgPrint("ObReferenceObjectByName Failure!\n");
return status;
}
DbgPrint("Driver Name : %wZ\n", &uniDriverName);
DbgPrint("Load Address : 0x%08X\n", pTestObject->DriverStart);
DbgPrint("Driver Size : %d\n", pTestObject->DriverSize);
DbgPrint("Driver Object : 0x%08X\n", pTestObject->DriverExtension->DriverObject);
DbgPrint("FastIo Dispatch : 0x%08X\n", pTestObject->FastIoDispatch);
DbgPrint("StartIo Entry : 0x%08X\n", pTestObject->DriverStartIo);
DbgPrint("Add Device Entry: : 0x%08X\n", pTestObject->DriverExtension->AddDevice);
DbgPrint("Unload Routine : 0x%08X\n", pTestObject->DriverUnload);
ObDereferenceObject(pTestObject);
return status;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,
PUNICODE_STRING pRegistryPath)
{
NTSTATUS status;
DbgPrint("--------------------------------\n");
pDriverObject->DriverUnload = DriverUnload;;
GetInfo();
return STATUS_SUCCESS;
} |