Windows下驱动监控设备热插拔

1、初始化设备热插拔消息，注册回调函数
代码如下：

#include <fltKernel.h>
#include <wdmguid.h>

DEFINE_GUID(GUID_DEVINTERFACE_USB_DEVICE,
	0xA5DCBF10, 0x6530, 0x11D2, 0x90, 0x1F, 0x00, 0xC0, 0x4F, 0xB9, 0x51, 0xED);

PVOID g_notificationEntry = NULL;

//回调函数
NTSTATUS NotificationCallback(IN PVOID NotificationStructure,IN PVOID Context);

//初始化设备热插拔消息
NTSTATUS HotPlugInit(_In_ PDRIVER_OBJECT DriverObject)
{
	NTSTATUS status = STATUS_SUCCESS;
	//初始化设备热插拔消息，注册回调函数
	status = IoRegisterPlugPlayNotification(
		EventCategoryDeviceInterfaceChange,
		PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES,
		&GUID_DEVINTERFACE_USB_DEVICE,
		DriverObject,
		NotificationCallback,
		NULL, &g_notificationEntry
	);

	//判断是否注册成功
	if (!NT_SUCCESS(status))
	{
		KdPrint(("%s:%d(%s) [HotPlug]IoRegisterPlugPlayNotification err:%p\n", __FILE__, __LINE__, __FUNCTION__, status));

		return status;
	}

	return status;
}

//回调函数
NTSTATUS NotificationCallback(
	IN PVOID NotificationStructure,
	IN PVOID Context
)
{
	if (NULL == NotificationStructure)
	{
		return STATUS_SUCCESS;
	}

	PDEVICE_INTERFACE_CHANGE_NOTIFICATION notification = (PDEVICE_INTERFACE_CHANGE_NOTIFICATION)NotificationStructure;

	if(notification->SymbolicLinkName->Length < MAX_PATH * sizeof(WCHAR))
	{
		//处理USB符号链接名
	}

	//USB的classid
	//notification->InterfaceClassGuid

	//USB的插拔状态
	//notification->Event
	//GUID_DEVICE_INTERFACE_ARRIVAL		插入
	//GUID_DEVICE_INTERFACE_REMOVAL		拔出


	//无效参数
	//STATUS_INVALID_PARAMETER;
	//拒绝访问
	//STATUS_ACCESS_DENIED
	return STATUS_SUCCESS;
}

2、卸载注册函数
代码如下：

VOID FreeHotPlug()
{
	if (g_notificationEntry)
	{
		IoUnregisterPlugPlayNotification(g_notificationEntry);
		g_notificationEntry = NULL;
	}
}

驱动完整代码如下:

#include <fltKernel.h>
#include <wdmguid.h>

DEFINE_GUID(GUID_DEVINTERFACE_USB_DEVICE,
	0xA5DCBF10, 0x6530, 0x11D2, 0x90, 0x1F, 0x00, 0xC0, 0x4F, 0xB9, 0x51, 0xED);

PVOID g_notificationEntry = NULL;

//回调函数
NTSTATUS NotificationCallback(IN PVOID NotificationStructure,IN PVOID Context);
//初始化
NTSTATUS HotPlugInit(_In_ PDRIVER_OBJECT DriverObject);
//卸载
VOID FreeHotPlug();
//卸载驱动
NTSTATUS ZrWorldDriverUnload(PDRIVER_OBJECT Driver)


NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject,_In_ PUNICODE_STRING RegistryPath)
{
    NTSTATUS status = STATUS_SUCCESS;
    UNREFERENCED_PARAMETER( RegistryPath );
	
	DriverObject->DriverUnload = ZrWorldDriverUnload;

	status = HotPlugInit(DriverObject);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("Hot Init Fail:%p\n",status));
		return status;
	}

	return status;
}

NTSTATUS ZrWorldDriverUnload(PDRIVER_OBJECT Driver)
{
	FreeHotPlug();
	return STATUS_SUCCESS;
}

//初始化设备热插拔消息
NTSTATUS HotPlugInit(_In_ PDRIVER_OBJECT DriverObject)
{
	NTSTATUS status = STATUS_SUCCESS;
	//初始化设备热插拔消息，注册回调函数
	status = IoRegisterPlugPlayNotification(
		EventCategoryDeviceInterfaceChange,
		PNPNOTIFY_DEVICE_INTERFACE_INCLUDE_EXISTING_INTERFACES,
		&GUID_DEVINTERFACE_USB_DEVICE,
		DriverObject,
		NotificationCallback,
		NULL, &g_notificationEntry
	);

	//判断是否注册成功
	if (!NT_SUCCESS(status))
	{
		KdPrint(("%s:%d(%s) [HotPlug]IoRegisterPlugPlayNotification err:%p\n", __FILE__, __LINE__, __FUNCTION__, status));

		return status;
	}

	return status;
}

//回调函数
NTSTATUS NotificationCallback(
	IN PVOID NotificationStructure,
	IN PVOID Context
)
{
	if (NULL == NotificationStructure)
	{
		return STATUS_SUCCESS;
	}

	PDEVICE_INTERFACE_CHANGE_NOTIFICATION notification = (PDEVICE_INTERFACE_CHANGE_NOTIFICATION)NotificationStructure;

	if(notification->SymbolicLinkName->Length < MAX_PATH * sizeof(WCHAR))
	{
		//处理USB符号链接名
	}

	//USB的classid
	//notification->InterfaceClassGuid

	//USB的插拔状态
	//notification->Event
	//GUID_DEVICE_INTERFACE_ARRIVAL		插入
	//GUID_DEVICE_INTERFACE_REMOVAL		拔出


	//无效参数
	//STATUS_INVALID_PARAMETER;
	//拒绝访问
	//STATUS_ACCESS_DENIED
	return STATUS_SUCCESS;
}

VOID FreeHotPlug()
{
	if (g_notificationEntry)
	{
		IoUnregisterPlugPlayNotification(g_notificationEntry);
		g_notificationEntry = NULL;
	}
}

至此，监控热插拔的驱动完成，所有的操作均可在回调函数中操作，不管是获取设备数据还是拒绝访问，都可以灵活的根据实际场景进行控制。