ring3通过METHOD_BUFFERED、METHOD_IN_DIRECT两种常用方式和ring0级交互读文件测试

为了熟悉ring3和ring0交互过程，写了个简单的程序测试一下，以便加深印象。

本文通过测试METHOD_BUFFERED、METHOD_IN_DIRECT方式读某磁盘下固定的文件，关于ring0和ring3通信方式具体见如下链接

http://book.51cto.com/art/201107/275240.htm

具体代码如下：

ring3：

#include <Windows.h>
#include <winioctl.h>
#include <stdio.h>

#define BUFFERSIZE 1024
//两种读写方式
#define IOCTL_DO_BUFFER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_IN_DIRECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_IN_DIRECT, FILE_ANY_ACCESS)


//
//
void Usage(char *proc)
{
	printf(
		"%s -b  // buffer io\n"
		"%s -d  // direct io\n",
		proc, proc
		);
}

int main(int argc, char* argv[])
{
	if(argc != 2)
	{
		Usage(argv[0]);
		return 0;
	}
	char OutBufer[BUFFERSIZE];
	bool ret = true;
	DWORD dwLength = 0; //实际读到的文件大小
	HANDLE hDevice = CreateFile(
						"\\\\.\\KeReadSL",
						GENERIC_READ | GENERIC_WRITE,
						0,
						NULL,
						OPEN_EXISTING,
						FILE_ATTRIBUTE_SYSTEM,
						NULL);
	if(hDevice == INVALID_HANDLE_VALUE)
	{
		printf("Failed to open device ---- errorcode = %d ...\n",GetLastError());
		return 0;
	}
	if(strcmp(argv[1], "-b") == 0)
	{
		printf("Read File by Buffer Io way...\n");
		ret = DeviceIoControl(hDevice,
			IOCTL_DO_BUFFER,
			NULL,
			0,
			OutBufer,
			BUFFERSIZE,
			&dwLength,
			NULL);
	}
	else if (strcmp(argv[1], "-d") == 0)
	{
		printf("Read File by Direct Io way...\n");
		ret = DeviceIoControl(hDevice,
			IOCTL_IN_DIRECT,
			NULL,
			0,
			OutBufer,
			BUFFERSIZE,
			&dwLength,
			NULL);
	}
	else
	{
		Usage(argv[0]);
		ret = false;
	}
	
	if(ret)
	{
		OutBufer[dwLength] = '\0';
		printf("Congratulation!!!\nReadData: %s\n",OutBufer);
	}
	CloseHandle(hDevice);
	return 0;
}

ring0

#include <ntddk.h>

#define IOCTL_DO_BUFFER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_IN_DIRECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_IN_DIRECT, FILE_ANY_ACCESS)

typedef struct _DEVICE_EXTENSION
{
	PDEVICE_OBJECT pDevice;
	UNICODE_STRING ustrDeviceName;  //设备名称
	UNICODE_STRING ustrSymlinkName;  //符号链接名称

}DEVICE_EXTENSION, *PDEVICE_EXTENSION;
//
// 读文件（为了方便，测试读取c盘下一个小的test.txt文件）
ULONG KeReadFileData(UCHAR* OutputBuffer, ULONG BufferSize, ULONG* ReadSize)
{
	OBJECT_ATTRIBUTES objectAtrtributes;
	IO_STATUS_BLOCK iostatus;
	HANDLE hFile;
	//初始化文件路径

	UNICODE_STRING ustrFilePath;
	RtlInitUnicodeString(&ustrFilePath, L"\\??\\C:\\test.txt");

	InitializeObjectAttributes(&objectAtrtributes, &ustrFilePath, OBJ_CASE_INSENSITIVE, NULL, NULL);
	//打开文件
	NTSTATUS zwStatus = ZwCreateFile(&hFile,
								GENERIC_READ,
								&objectAtrtributes,
								&iostatus,
								NULL,
								FILE_ATTRIBUTE_NORMAL,
								FILE_SHARE_READ,
								FILE_OPEN,
								FILE_SYNCHRONOUS_IO_NONALERT,
								NULL,
								0);
	if(!NT_SUCCESS(zwStatus))
	{
		KdPrint(("The file is not exist!\n"));
		return 0;
	}
	//获取文件长度
	FILE_STANDARD_INFORMATION fsi;
	zwStatus = ZwQueryInformationFile(hFile,
									&iostatus,
									&fsi,
									sizeof(FILE_STANDARD_INFORMATION),
									FileStandardInformation);
	if(!NT_SUCCESS(zwStatus))
	{
		KdPrint(("Failed to ZwQueryInformationFile ...\n"));
		ZwClose(hFile);
		return 0;
	}
	ULONG DataSizeReaded = BufferSize < fsi.EndOfFile.QuadPart ? BufferSize : fsi.EndOfFile.QuadPart;  //实际读取文件的大小
	//读取文件
	zwStatus =ZwReadFile(hFile,
					NULL,
					NULL,
					NULL,
					&iostatus,
					OutputBuffer,
					DataSizeReaded,
					NULL,
					NULL
					);
	if(!NT_SUCCESS(zwStatus))
	{
		KdPrint(("Failed to ZwReadFile ...\n"));
		ZwClose(hFile);
		return 0;
	}
	KdPrint(("The program really read %d byutes ...\n",iostatus.Information));
	*ReadSize = iostatus.Information;
	ZwClose(hFile);
	return 1;
}
//
//创建设备
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject, UNICODE_STRING devname, UNICODE_STRING symLinkName)
{
	NTSTATUS status;
	PDEVICE_OBJECT pDevObj;
	PDEVICE_EXTENSION pDevExt;
	//创建设备
	status = IoCreateDevice(pDriverObject,
		sizeof(DEVICE_EXTENSION),
		&devname,
		FILE_DEVICE_UNKNOWN,
		0,
		TRUE,
		&pDevObj);
	if(!NT_SUCCESS(status))
		return status;
	pDevObj->Flags |= DO_BUFFERED_IO;
	pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
	pDevExt->pDevice = pDevObj;
	pDevExt->ustrDeviceName = devname;
	pDevExt->ustrSymlinkName = symLinkName;
	KdPrint(("devname = %wZ\nsymbollink = %wZ\n",&devname, &symLinkName));
	//创建设备链接
	status = IoCreateSymbolicLink(&symLinkName, &devname);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("Failed to IoCreateSymbolicLink and delete DeviceObject --- errorcode = %d ...\n",status));
		IoDeleteDevice(pDevObj);
		return status;
	}
	return status;
}


//卸载驱动
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	PDEVICE_OBJECT pNextObj;
	KdPrint(("Enter DriverUnload...\n"));
	pNextObj = pDriverObject->DeviceObject;
	//循环遍历删除所有该驱动上的设备
	while(pNextObj != NULL)
	{
		//设备的名称和链接名称均在扩展结构中存储
		PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;
		//删除符号链接
		UNICODE_STRING LinkName = pDevExt->ustrSymlinkName;
		IoDeleteSymbolicLink(&LinkName);
		pNextObj = pNextObj->NextDevice;
		IoDeleteDevice(pDevExt->pDevice);
	}
}

//处理消息
NTSTATUS DeviceIoControlDispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	NTSTATUS status = STATUS_SUCCESS;
	KdPrint(("Enter DeviceIoControlDispatch ...\n"));
	//得到当前栈
	PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
	//得到输如缓冲区大小
	ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
	//输出缓冲区大小
	ULONG cbout = stack->Parameters.DeviceIoControl.OutputBufferLength;
	//得到IOCTL码
	ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
	//实际读取文件大小
	ULONG ReadSize = 0;
	//判断文件操作方式
	switch(code)
	{
	case IOCTL_DO_BUFFER: //缓冲区方式操作仅进行读文件测试)
		{
			UCHAR* OutputBuffer = (UCHAR*)pIrp->AssociatedIrp.SystemBuffer;
			if(!KeReadFileData(OutputBuffer, cbout, &ReadSize))
				status = STATUS_UNSUCCESSFUL;
			break;
		}
	case IOCTL_IN_DIRECT: //直接文件操作
		{
			//将缓冲区映射到内核模式下地址
			UCHAR* OutputBuffer = (UCHAR*)MmGetSystemAddressForMdlSafe(pIrp->MdlAddress, NormalPagePriority);
			if(!KeReadFileData(OutputBuffer, cbout, &ReadSize))
				status = STATUS_UNSUCCESSFUL;
			break;
		}
	default:
		{
			status = STATUS_INVALID_VARIANT;
		}
	}
	//设置IRP的完成状态
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = ReadSize;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	KdPrint(("Leave DeviceIoControlDispatch ...\n"));
	return status;
}

//IRP请求处理函数
NTSTATUS MyDispatchFunction(PDEVICE_OBJECT device, PIRP irp)
{
	//获得当前IRP调用的栈空间
	PIO_STACK_LOCATION irpsp = IoGetCurrentIrpStackLocation(irp);
	NTSTATUS status = STATUS_INVALID_PARAMETER;
	//处理各种请求
	switch(irpsp->MajorFunction)
	{
	case IRP_MJ_CREATE:    //此IRP需做简单处理，否则CreateFile打开设备链接出错
		{
			//简单返回一个IRP成功三部曲
			irp->IoStatus.Information = 0;
			irp->IoStatus.Status = STATUS_SUCCESS;
			IoCompleteRequest(irp,IO_NO_INCREMENT);
			//应用层，打开设备后 打印此字符串，仅为测试
			DbgPrint("congratulations gay,open device");
			status = irp->IoStatus.Status;
			break;
		}
	case IRP_MJ_CLOSE:
		{
			irp->IoStatus.Information = 0;
			irp->IoStatus.Status = STATUS_SUCCESS;
			IoCompleteRequest(irp,IO_NO_INCREMENT);
			//应用层，打开设备后 打印此字符串，仅为测试
			DbgPrint("congratulations gay,close device");
			status = irp->IoStatus.Status;
			break;
		}
	case IRP_MJ_READ:
		{
			break;
		}
	default:
		{
			DbgPrint("unknow request!!!");
			break;
		}
	}

	return status;
}

NTSTATUS 
	DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath) 
{
	DbgPrint("Enter DriverEntry\n");
//	KdPrint(("Enter DriverEntry\n"));
	NTSTATUS status;
	//设置派遣函数
	for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
		pDriverObject->MajorFunction[i] = MyDispatchFunction;

	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceIoControlDispatch;
	pDriverObject->DriverUnload = DriverUnload;

	//创建设备和链接
	UNICODE_STRING ustrDevName, ustrSymbolicName;
	RtlInitUnicodeString(&ustrDevName,  L"\\Device\\KeRead");
	RtlInitUnicodeString(&ustrSymbolicName, L"\\DosDevices\\KeReadSL");
	status = CreateDevice(pDriverObject, ustrDevName, ustrSymbolicName);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("Failed to Create Device ...\n"));
		return STATUS_UNSUCCESSFUL;
	}
	KdPrint(("Exit DriverEntry\n"));
	return STATUS_SUCCESS;
}