DRIVER_OBJECT

DRIVER_OBJECT

  (2011-08-08 10:17:43)

转载▼

标签：  it

typedef struct _DRIVER_OBJECT { 

   CSHORT Type; 

   CSHORT Size; 

   PDEVICE_OBJECT DeviceObject;           // 指向设备对象，所有的设备对象构成一个链表 

   ULONG Flags;                           // 驱动程序标志 

   PVOID DriverStart;                     // 驱动程序映像起始地址 

   ULONG DriverSize;                      // 驱动程序映像大小 

   PVOID DriverSection;                   // 指向驱动程序映像的内存区对象 

   PDRIVER_EXTENSION DriverExtension;     // 指向驱动程序对象的扩展部分 

   UNICODE_STRING DriverName;             // 驱动程序名称 

   PUNICODE_STRING HardwareDatabase;      // 指向注册表中包含硬件信息的路径 

   PFAST_IO_DISPATCH FastIoDispatch;      // 指向快速I/O的分发结构 

   PDRIVER_INITIALIZE DriverInit;         // 驱动程序的初始化例程 

   PDRIVER_STARTIO DriverStartIo;         // 驱动程序的启动I/O例程 

   PDRIVER_UNLOAD DriverUnload;           // 驱动程序的卸载例程 

   PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; 

} DRIVER_OBJECT; 

 

DRIVER_OBJECT STRUCT ; sizeof= 0A8h

_Type SWORD ? ; 0000h  (IO_TYPE_DRIVER = 4)  (original field name Type)

_Size SWORD ? ; 0004h  (original name Size)

 

; The following links all of the devices created by a single driver

; together on a list, and the Flags word provides an extensible flag

; location for driver objects.

 

DeviceObject PVOID ? ; 0004h PTR DEVICE_OBJECT

Flags DWORD ? ; 0008h

 

; The following section describes where the driver is loaded.  The count

; field is used to count the number of times the driver has had its

; registered reinitialization routine invoked.

 

DriverStart PVOID ? ; 000Ch

DriverSize DWORD ? ; 0010h

DriverSection PVOID ? ; 0014h

DriverExtension PVOID ? ; 0018h PTR DRIVER_EXTENSION

 

; The driver name field is used by the error log thread

; determine the name of the driver that an I/O request is/was bound.

 

DriverName UNICODE_STRING <> ; 001Ch

; The following section is for registry support.  Thise is a pointer

; to the path to the hardware information in the registry

 

HardwareDatabase PVOID ? ; 0024h PTR UNICODE_STRING

 

; The following section contains the optional pointer to an array of

; alternate entry points to a driver for "fast I/O" support.  Fast I/O

; is performed by invoking the driver routine directly with separate

; parameters, rather than using the standard IRP call mechanism.  Note

; that these functions may only be used for synchronous I/O, and when

; the file is cached.

 

FastIoDispatch PVOID ? ; 0028h PTR FAST_IO_DISPATCH

 

; The following section describes the entry points to this particular

; driver.  Note that the major function dispatch table must be the last

; field in the object so that it remains extensible.

 

DriverInit PVOID ? ; 002Ch

DriverStartIo PVOID ? ; 0030h

DriverUnload PVOID ? ; 0034h

MajorFunction PVOID (IRP_MJ_MAXIMUM_FUNCTION + 1) dup(?) ; 0038h

 

DRIVER_OBJECT ENDS

PDRIVER_OBJECT typedef PTR DRIVER_OBJECT

分享：  分享到新浪Qing 

0

喜欢

阅读 (9) ┊  评论  (0) ┊ 收藏 (0)  ┊ 转载 (1) ┊  喜欢 ▼  ┊ 打印 ┊ 举报

已投稿到：	排行榜  圈子

前一篇： DEVICE_OBJECT

后一篇： __try,__except,__finally