EXE部分
#include <stdio.h>
#include <Windows.h>
#include <WinIoCtl.h>
#include "Ioctl.h"
int main (void)
{
char linkname[]="\\\\.\\HelloDDK";
HANDLE hDevice = CreateFileA(linkname,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OVERLAPPED, //此处设置FILE_FLAG_OVERLAPPED
NULL);
if (hDevice == INVALID_HANDLE_VALUE)
{
printf("Win32 error code: %d\n",GetLastError());
return 1;
}
DWORD dwOutput;
DWORD dwMircoSeconds=1000*1000*1;
DeviceIoControl(hDevice, IOCTL_WAIT_METHOD1, &dwMircoSeconds, sizeof(DWORD), NULL, 0, &dwOutput, NULL);
DeviceIoControl(hDevice, IOCTL_WAIT_METHOD2, &dwMircoSeconds, sizeof(DWORD), NULL, 0, &dwOutput, NULL);
DeviceIoControl(hDevice, IOCTL_WAIT_METHOD3, &dwMircoSeconds, sizeof(DWORD), NULL, 0, &dwOutput, NULL);
DeviceIoControl(hDevice, IOCTL_WAIT_METHOD4, &dwMircoSeconds, sizeof(DWORD), NULL, 0, &dwOutput, NULL);
CloseHandle(hDevice);
getchar();
getchar();
return 0;
}
SYS部分
#include "hello.h"
#include "Ioctl.h"
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
DbgPrint("Hello from!\n");
DriverObject->DriverUnload = HelloUnload;
for (int i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
{
DriverObject->MajorFunction[i]=HelloDDKDispatchRoutine;
}
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=HelloDDKControl;
#if DBG
_asm int 3
#endif
//创建设备
CreateDevice(DriverObject);
return STATUS_SUCCESS;
}
//卸载函数
void HelloUnload(IN PDRIVER_OBJECT DriverObject)
{
#if DBG
_asm int 3
#endif
DbgPrint("Goodbye from!\n");
PDEVICE_OBJECT pNextObj=NULL;
pNextObj=DriverObject->DeviceObject;
while (pNextObj)
{
PDEVICE_EXTENSION pDevExt=(PDEVICE_EXTENSION)pNextObj->DeviceExtension;
//删除符号连接
IoDeleteSymbolicLink(&pDevExt->ustrSymLinkName);
//删除设备
IoDeleteDevice(pDevExt->pDevice);
pNextObj=pNextObj->NextDevice;
}
}
VOID WaitMicroSecond1(ULONG ulMircoSecond)
{
KEVENT kEvent={0};
DbgPrint("Thread WaitMicroSecond1 %d MircoSeconds...\n",ulMircoSecond);
//初始化一个未激发的内核事件
KeInitializeEvent(&kEvent,SynchronizationEvent,FALSE);
//等待事件的单位是100纳秒,将微秒转换成这个单位
//负数代表是从此刻到未来的某个时刻
LARGE_INTEGER timeout=RtlConvertLongToLargeInteger(-10*ulMircoSecond);
//在经过timeout后,线程继续运行
KeWaitForSingleObject(&kEvent,Executive,KernelMode,FALSE,&timeout);
DbgPrint("Thread is WaitMicroSecond1 runing again\n");
return;
}
VOID WaitMicroSecond2(ULONG ulMircoSecond)
{
DbgPrint("Thread WaitMicroSecond2 %d MircoSeconds..\n",ulMircoSecond);
//等待事件的单位是10纳秒,将微秒转换成这个单位
//负数代表是从此刻到未来的某个时刻
LARGE_INTEGER timeout=RtlConvertLongToLargeInteger(-10*ulMircoSecond);
//此种方法类似于KeWaitForSingleObject
//将当前线程进入睡眠状态,间隔时间奥转入运行状态
KeDelayExecutionThread(KernelMode,FALSE,&timeout);
DbgPrint("Thread is WaitMicroSecond2 again\n");
return;
}
VOID WaitMicroSecond3(ULONG ulMircoSecond)
{
DbgPrint("Thread WaitMicroSecond3 %d MircoSeconds...\n",ulMircoSecond);
//忙等待,此种方法属于忙等待,比较浪费CPU时间
//因此使用该方法不宜超过50微秒
KeStallExecutionProcessor(ulMircoSecond);
DbgPrint("Thread is WaitMicroSecond3 running again\n");
return;
}
VOID WaitMicroSecond4(ULONG ulMircoSecond)
{
DbgPrint("Thread WaitMicroSecond4 %d MircoSeconds....\n",ulMircoSecond);
//使用计时器
KTIMER kTimer; //内核计时器
//初始化计时器
KeInitializeTimer(&kTimer);
LARGE_INTEGER timeout = RtlConvertLongToLargeInteger(ulMircoSecond * -10);
//注意这个计时器没有和DPC对象关联
KeSetTimer(&kTimer,timeout,NULL);
KeWaitForSingleObject(&kTimer,Executive,KernelMode,FALSE,NULL);
DbgPrint("Thread is WaitMicroSecond4 running again\n");
}
NTSTATUS HelloDDKControl(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp)
{
#if DBG
_asm int 3
#endif
NTSTATUS status=STATUS_SUCCESS;
//获取当前堆栈
PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(pIrp);
//获取输入参数大小
ULONG cbin=stack->Parameters.DeviceIoControl.InputBufferLength;
//获取输出参数大小
ULONG cbout=stack->Parameters.DeviceIoControl.OutputBufferLength;
//得到IOCTL控制码
ULONG code=stack->Parameters.DeviceIoControl.IoControlCode;
//获取设备扩展
PDEVICE_EXTENSION pDevExt=(PDEVICE_EXTENSION)pDevObj->DeviceExtension;
//从用户模式传进来的微秒数
ULONG ulMircoSeconds=*(PULONG)pIrp->AssociatedIrp.SystemBuffer;
switch (code)
{
case IOCTL_WAIT_METHOD1:
{
DbgPrint("IOCTL_WAIT_METHOD1\n");
WaitMicroSecond1(ulMircoSeconds);
}
break;
case IOCTL_WAIT_METHOD2:
{
DbgPrint("IOCTL_WAIT_METHOD2\n");
WaitMicroSecond2(ulMircoSeconds);
}
break;
case IOCTL_WAIT_METHOD3:
{
DbgPrint("IOCTL_WAIT_METHOD3\n");
WaitMicroSecond3(ulMircoSeconds);
}
break;
case IOCTL_WAIT_METHOD4:
{
DbgPrint("IOCTL_WAIT_METHOD4\n");
WaitMicroSecond4(ulMircoSeconds);
}
break;
default:
status=STATUS_INVALID_VARIANT;
}
//设置IRP的完成状态
pIrp->IoStatus.Status=status;
pIrp->IoStatus.Information=0;
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return status;
}
//创建设备
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriver_Object)
{
//定义变量
NTSTATUS status=STATUS_SUCCESS;
PDEVICE_OBJECT pDevObj=NULL;
PDEVICE_EXTENSION pDevExt=NULL;
//初始化字符串
UNICODE_STRING devname;
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&devname,L"\\device\\hello");
RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");
//创建设备
status =IoCreateDevice(pDriver_Object,sizeof(DEVICE_EXTENSION),&devname,FILE_DEVICE_UNKNOWN,NULL,TRUE,&pDevObj);
if (!NT_SUCCESS(status))
{
DbgPrint("创建设备失败\n");
return status;
}
pDevObj->Flags |= DO_BUFFERED_IO;;
pDevExt=(PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice=pDevObj;
pDevExt->ustrDeviceName=devname;
pDevExt->ustrSymLinkName=symLinkName;
//创建符号连接
status =IoCreateSymbolicLink(&symLinkName,&devname) ;
if (!NT_SUCCESS(status))
{
DbgPrint("创建符号连接失败\n");
IoDeleteDevice(pDevObj);
return status;
}
return STATUS_SUCCESS;
}
//派遣函数
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrP)
{
//#if DBG
// _asm int 3
//#endif
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrP);
//建立一个字符串数组与IRP类型对应起来
static char* irpname[] =
{
"IRP_MJ_CREATE",
"IRP_MJ_CREATE_NAMED_PIPE",
"IRP_MJ_CLOSE",
"IRP_MJ_READ",
"IRP_MJ_WRITE",
"IRP_MJ_QUERY_INFORMATION",
"IRP_MJ_SET_INFORMATION",
"IRP_MJ_QUERY_EA",
"IRP_MJ_SET_EA",
"IRP_MJ_FLUSH_BUFFERS",
"IRP_MJ_QUERY_VOLUME_INFORMATION",
"IRP_MJ_SET_VOLUME_INFORMATION",
"IRP_MJ_DIRECTORY_CONTROL",
"IRP_MJ_FILE_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CONTROL",
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
"IRP_MJ_SHUTDOWN",
"IRP_MJ_LOCK_CONTROL",
"IRP_MJ_CLEANUP",
"IRP_MJ_CREATE_MAILSLOT",
"IRP_MJ_QUERY_SECURITY",
"IRP_MJ_SET_SECURITY",
"IRP_MJ_POWER",
"IRP_MJ_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CHANGE",
"IRP_MJ_QUERY_QUOTA",
"IRP_MJ_SET_QUOTA",
"IRP_MJ_PNP",
};
UCHAR type = stack->MajorFunction;
if (type >= CountArray(irpname))
KdPrint(("无效的IRP类型 %X\n", type));
else
KdPrint(("%s\n", irpname[type]));
pIrP->IoStatus.Status=STATUS_SUCCESS; //设置完成状态
pIrP->IoStatus.Information=0; //设置操作字节为0
IoCompleteRequest(pIrP,IO_NO_INCREMENT); //结束IRP派遣函数,第二个参数表示不增加优先级
return STATUS_SUCCESS;
}