1.安装WDK7600和VC6.0
2.VC6.0设置Include/lib/Executable目录
Include包含部分:
F:\WINDDK\7600.16385.1\INC\DDK
F:\WINDDK\7600.16385.1\INC\API
F:\WINDDK\7600.16385.1\INC\CRT
Lib连接库包含部分:
F:\WINDDK\7600.16385.1\LIB\WXP\I386
Executable包含部分
F:\WINDDK\7600.16385.1\BIN\X86\X86
C/C++选项的Option填写:
Debug
/nologo /Gz /MT /W3 /WX /Z7 /Od /D _X86_=1 /D i386=1 /D "STD_CALL" /D WIN32=100 /D _WIN32_WINNT=0x0501 /D WINVER=0x0501 /D DBG=1 /Fo"Debug/" /Fd"Debug/" /FD /GS- /c
Release
/nologo /Gz /MT /W3 /WX /Z7 /Od /D _X86_=1 /D i386=1 /D "STD_CALL" /D WIN32=100 /D _WIN32_WINNT=0x0501 /D WINVER=0x0501 /D DBG=0 /Fo"Release/" /Fd"Release/" /FD /GS- /c
Link选项的Option填写:
NT式驱动:
Debug
ntoskrnl.lib /nologo /base:"0x10000" /stack:0x400000,0x1000 /entry:"DriverEntry" /subsystem:console /incremental:no /pdb:"Debug/Demo.pdb" /map:"Debug/Demo.map" /debug /machine:I386 /nodefaultlib /out:"Demo/Demo.sys" /subsystem:native /driver /SECTION:INIT,D /RELEASE /IGNORE:4078
Release
ntoskrnl.lib /nologo /base:"0x10000" /stack:0x400000,0x1000 /entry:"DriverEntry" /subsystem:console /incremental:no /pdb:"Release/Demo.pdb" /map:"Release/Demo.map" /debug /machine:I386 /nodefaultlib /out:"Demo/Demo.sys" /subsystem:native /driver /SECTION:INIT,D /RELEASE /IGNORE:4078
WDM式驱动:
wdm.lib ntoskrnl.lib /nologo /base:"0x10000" /stack:0x400000,0x1000 /entry:"DriverEntry" /subsystem:console /incremental:no /pdb:"Debug/Demo.pdb" /map:"Debug/Demo.map" /debug /machine:I386 /nodefaultlib /out:"Demo/Demo.sys" /subsystem:native /driver /SECTION:INIT,D /RELEASE /IGNORE:4078
新建一个CPP文件:
#ifdef__cplusplus
extern"C"
{
#endif
#include<NTDDK.h>
#ifdef__cplusplus
};
#endif
#define INITCODE code_seg("INIT") //入口函数一般需要放在INIT标识的内存中 INIT标识指明该函数只是在加载的时候需要载入内存,而当驱动加载成功后,改函数可以从内存中卸载掉
#define PAGECODE code_seg("PAGE") //表示内存不足时,可以被置换到硬盘
#pragma INITCODE
extern"C" NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
return status;
}