NT式驱动安装卸载

TestDDK125096.sys

#include <ntddk.h>

#ifdef __cplusplus
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath);
#endif
void TestDDK125096Unload(IN PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Goodbye from TestDDK125096!\n");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath)
{
	
	DbgPrint("Hello from TestDDK125096!\n");
	DriverObject->DriverUnload = TestDDK125096Unload;
	return STATUS_SUCCESS;
}

 

exe安装卸载部分

#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <winsvc.h>
#include <shlwapi.h>
#pragma comment (lib,"shlwapi.lib")

//安装启动驱动
BOOL LoadNTDriver(TCHAR* lpDriverName,TCHAR* lpDriverPathName);

//停止卸载驱动
BOOL UnLoadSys(TCHAR * szSvrName); 


int main (void)
{
	TCHAR m_szFileName[MAX_PATH]={0};
	TCHAR m_szFileTitle[MAX_PATH]={0};

	OPENFILENAME m_ofn;
	memset(&m_ofn, 0, sizeof(OPENFILENAME));
	m_ofn.lStructSize = sizeof(OPENFILENAME);
	m_ofn.lpstrFile = m_szFileName;
	m_ofn.nMaxFile = ARRAYSIZE(m_szFileName);
	m_ofn.lpstrDefExt = NULL;
	m_ofn.lpstrFileTitle = m_szFileTitle;
	m_ofn.nMaxFileTitle = ARRAYSIZE(m_szFileTitle);
	m_ofn.lpstrFilter=TEXT("驱动文件(*.sys)\0*.sys\0All Files(*.*)\0*.*\0\0");
	m_ofn.Flags=OFN_ENABLEHOOK | OFN_EXPLORER;
	//打开文件对话框
	if(GetOpenFileName(&m_ofn))
	{
		//去掉文件扩展名做驱动名
		LPCTSTR lpstr=PathFindExtension(m_szFileTitle);
		TCHAR *pdest = _tcsstr( m_szFileTitle,lpstr);
		m_szFileTitle[pdest-m_szFileTitle] = 0;

		//安装驱动--手动启动
		LoadNTDriver(m_szFileTitle,m_szFileName);
	}

	getchar();
	getchar();
	//卸载停止驱动
	UnLoadSys(m_szFileTitle);
	getchar();
	getchar();

	return 0;
}

BOOL LoadNTDriver(TCHAR* lpDriverName,TCHAR* lpDriverPathName)
{
	BOOL bRet = FALSE;

	SC_HANDLE hServiceMgr=NULL;//SCM管理器的句柄
	SC_HANDLE hServiceDDK=NULL;//NT驱动程序的服务句柄

	//打开服务控制管理器
	hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );

	if( hServiceMgr == NULL )  
	{
		//OpenSCManager失败
		printf( "OpenSCManager() Faild %d ! \n", GetLastError() );
		bRet = FALSE;
		goto BExit;
	}


	//创建驱动所对应的服务
	hServiceDDK = CreateService( hServiceMgr,
		lpDriverName, //驱动程序的在注册表中的名字  
		lpDriverName, // 注册表驱动程序的 DisplayName 值  
		SERVICE_ALL_ACCESS, // 加载驱动程序的访问权限  
		SERVICE_KERNEL_DRIVER,// 表示加载的服务是驱动程序  
		SERVICE_DEMAND_START, // 注册表驱动程序的 Start 值  
		SERVICE_ERROR_IGNORE, // 注册表驱动程序的 ErrorControl 值  
		lpDriverPathName, // 注册表驱动程序的 ImagePath 值  
		NULL,  
		NULL,  
		NULL,  
		NULL,  
		NULL);  

	DWORD dwRtn;
	//判断服务是否失败
	if( hServiceDDK == NULL )  
	{  
		dwRtn = GetLastError();
		if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS )  
		{  
			//由于其他原因创建服务失败
			printf( "CrateService() 失败 %d ! \n", dwRtn );  
			bRet = FALSE;
			goto BExit;
		}  
		else  
		{
			//服务创建失败，是由于服务已经创立过
			printf( "CrateService() 服务创建失败，是由于服务已经创立过 ERROR is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! \n" );  
		}

		// 驱动程序已经加载，只需要打开  
		hServiceDDK = OpenService( hServiceMgr, lpDriverName, SERVICE_ALL_ACCESS );  
		if( hServiceDDK == NULL )  
		{
			//如果打开服务也失败，则意味错误
			dwRtn = GetLastError();  
			printf( "OpenService() 失败 %d ! \n", dwRtn );  
			bRet = FALSE;
			goto BExit;
		}  
		else 
		{
			printf( "OpenService() 成功 ! \n" );
		}
	}  
	else  
	{
		printf( "CrateService() 成功 ! \n" );
	}

	//开启此项服务
	bRet= StartService( hServiceDDK, NULL, NULL );  
	if( !bRet )  //开启服务不成功
	{  
		printf( "StartService() 失败 服务可能已经开启%d ! \n", dwRtn );  
	}
	else
	{
		printf("服务启动成功\n");
	}
	bRet = TRUE;

	//离开前关闭句柄
BExit:
	if(hServiceDDK)
	{
		CloseServiceHandle(hServiceDDK);
	}
	if(hServiceMgr)
	{
		CloseServiceHandle(hServiceMgr);
	}
	return bRet;
}

BOOL UnLoadSys(TCHAR * szSvrName)
{
	//一定义所用到的变量
	BOOL bRet = FALSE;
	SC_HANDLE hSCM=NULL;//SCM管理器的句柄,用来存放OpenSCManager的返回值
	SC_HANDLE hService=NULL;//NT驱动程序的服务句柄，用来存放OpenService的返回值
	SERVICE_STATUS SvrSta;
	//二打开SCM管理器
	hSCM = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );  
	if( hSCM == NULL )  
	{
		//带开SCM管理器失败
		printf( "OpenSCManager() Faild %d ! \n", GetLastError() );  
		bRet = FALSE;
		goto BeforeLeave;
	}  
	else  
	{
		//打开SCM管理器成功
		printf( "OpenSCManager() ok ! \n" );  
	}
	//三打开驱动所对应的服务
	hService = OpenService( hSCM, szSvrName, SERVICE_ALL_ACCESS );  

	if( hService == NULL )  
	{
		//打开驱动所对应的服务失败 退出
		printf( "OpenService() Faild %d ! \n", GetLastError() );  
		bRet = FALSE;
		goto BeforeLeave;
	}  
	else  
	{  
		printf( "OpenService() ok ! \n" );  //打开驱动所对应的服务 成功
	}  
	//四停止驱动程序，如果停止失败，只有重新启动才能，再动态加载。  
	if( !ControlService( hService, SERVICE_CONTROL_STOP , &SvrSta ) )  
	{  
		printf( "用ControlService() 停止驱动程序失败 错误号:%d !\n", GetLastError() );  
	}  
	else  
	{
		//停止驱动程序成功
		printf( "用ControlService() 停止驱动程序成功 !\n" );  
	}  
	//五动态卸载驱动服务。  
	if( !DeleteService( hService ) )  //TRUE//FALSE
	{
		//卸载失败
		printf( "卸载失败:DeleteSrevice()错误号:%d !\n", GetLastError() );  
	}  
	else  
	{  
		//卸载成功
		printf( "卸载成功 !\n" );  

	}  
	bRet = TRUE;

	//六 离开前关闭打开的句柄
BeforeLeave:
	if(hService>0)
	{
		CloseServiceHandle(hService);
	}
	if(hSCM>0)
	{
		CloseServiceHandle(hSCM);
	}
	return bRet;	
}