fasm driver 驱动编程

1. 支持x86，x64的结构定义的统一(指针用PVOID)，由此只需要维护一套结构体(对齐用PADDING)，如下演示:

struct DRIVER_OBJECT
    Type                INT16
    Size                INT16
                        PADDING 4
    DeviceObject        PVOID
    Flags               ULONG
                        PADDING 4
    DriverStart         PVOID
    DriverSize          ULONG
                        PADDING 4
    DriverSection       PVOID
    DriverExtension     PVOID
    DriverName          UNICODE_STRING
    HardwareDatabase    PVOID
    FastIoDispatch      PVOID
    DriverInit          PVOID
    DriverStartIo       PVOID
    DriverUnload        PVOID
    MajorFunction       PVOID (IRP_MJ_MAXIMUM_FUNCTION + 1) dup (?)
ends

2. 最简单的一个测试 (编译 fasm.exe fist.asm fist.sys) :

format  PE DLL native 4.0 at 10000h
entry   DriverEntry
include 'win32.inc'
;====================================================================
section '.text' code readable executable notpageable

proc DriverEntry lpDriverObject, lpusRegistryPath
    invoke  DbgPrint,szLoad
    mov     eax,[lpDriverObject]
    mov     [eax+DRIVER_OBJECT.DriverUnload],DriverUnload
    xor     eax,eax
	ret
endp

proc DriverUnload lpDriverObject
    invoke  DbgPrint,szUnload
	ret
endp
;====================================================================
section '.data' data readable writeable notpageable
    szLoad      db 'first: Hello, my fasm driver!',0
    szUnload    db 'first: Our driver is unloading…',0
;====================================================================
section 'INIT' import code discardable executable readable writeable
    library ntoskrnl,'ntoskrnl.exe'

    ; import	ntoskrnl,\
        ; DbgPrint,'DbgPrint'
    include 'api/ntoskrnl.inc'
;====================================================================
section '.reloc' fixups data readable discardable

3.生成的PE信息

文件名：            fist.sys
----------------------------------------------------------
运行平台：          0x014C
节区数量：          4
文件标记：          0x210E
建议装入地址：      0x00010000
可选头结构的长度:   0x00E0
数据目录结构的数量: 16

----------------------------------------------------------
节区名称  节区大小  虚拟地址  Raw_尺寸  Raw_偏移  节区属性
----------------------------------------------------------
.text     00000030  00000220  00000040  00000220  68000020
.data     0000003F  00000260  00000040  00000260  C8000040
INIT      00000054  000002A0  00000060  000002A0  E2000020
.reloc    00000012  00000300  00000020  00000300  42000040
----------------------------------------------------------

导入表所处的节：    INIT
----------------------------------------------------------
导入库：            ntoskrnl.exe
----------------------------------------------------------
OriginalFirstThunk  000002D8
TimeDateStamp       00000000
ForwarderChain      00000000
FirstThunk          000002E0
----------------------------------------------------------
导入序号            导入函数名称
----------------------------------------------------------
00000000            DbgPrint

4. Debugview查看打印: