#include <windows.h>
#include <stdio.h>
#include <process.h>
UINT WINAPI Thread(LPVOID context)
{
printf("Enter Thread\n");
OVERLAPPED overlap={0};
overlap.hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);
UCHAR buffer[10];
ULONG ulRead;
BOOL bRead = ReadFile(*(PHANDLE)context,buffer,10,&ulRead,&overlap);
WaitForSingleObject(overlap.hEvent,INFINITE);
return 0;
}
int main()
{
HANDLE hDevice =
CreateFile(L"\\\\.\\HelloDDK",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OVERLAPPED,//此处设置FILE_FLAG_OVERLAPPED
NULL );
if (hDevice == INVALID_HANDLE_VALUE)
{
printf("Open Device failed!");
return 1;
}
HANDLE hThread[2];
hThread[0] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);
hThread[1] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);
//主线程等待两个子线程结束
WaitForMultipleObjects(2,hThread,TRUE,INFINITE);
//创建IRP_MJ_CLEANUP IRP
CloseHandle(hDevice);
system("pause");
return 0;
}
#pragma once
#ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#ifdef __cplusplus
}
#endif
#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
#define INITCODE code_seg("INIT")
#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")
#define arraysize(p) (sizeof(p)/sizeof((p)[0]))
typedef struct _DEVICE_EXTENSION {
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName; //设备名称
UNICODE_STRING ustrSymLinkName; //符号链接名
KDEVICE_QUEUE device_queue; //设备队列
KDEVICE_QUEUE device_queue2;//设备队列2
KDEVICE_QUEUE device_queue3;//设备队列2
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;
// 函数声明
NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp);
NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp);
NTSTATUS HelloDDKCleanUp(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp);
NTSTATUS chuangjian(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp);
#include "Driver.h"
#pragma LOCKEDCODE
VOID MyStartIo(IN PDEVICE_OBJECT DeviceObject,IN PIRP pFistIrp)//设备对象 数据包(irp)
{
KdPrint(("进入的自定义的 MyStartIo1\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension;
PKDEVICE_QUEUE_ENTRY device_entry;
PIRP Irp = pFistIrp;
do
{
KEVENT event;
KeInitializeEvent(&event,NotificationEvent,FALSE);//初始化事件
//等3秒
LARGE_INTEGER timeout;
timeout.QuadPart = -3*1000*1000*10;
//定义一个3秒的延时,主要是为了模拟该IRP操作需要大概3秒左右时间
KeWaitForSingleObject(&event,Executive,KernelMode,FALSE,&timeout);
KdPrint(("打印读请求数据包 Complete a irp:%x\n",Irp));
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0; // no bytes xfered
IoCompleteRequest(Irp,IO_NO_INCREMENT);
device_entry=KeRemoveDeviceQueue(&pDevExt->device_queue);//从队列中删除
KdPrint(("删除读请求的元素 device_entry:%x\n",device_entry));
if (device_entry==NULL)
{
break;
}
Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);//irp的地址
}while(1);
KdPrint(("Leave MyStartIo1\n"));
}
VOID MyStartIo2(IN PDEVICE_OBJECT DeviceObject, IN PIRP pFistIrp)//设备对象 数据包(irp)
{
KdPrint(("进入的自定义的 MyStartIo2\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension;
PKDEVICE_QUEUE_ENTRY device_entry;
PIRP Irp = pFistIrp;
do
{
KEVENT event;
KeInitializeEvent(&event, NotificationEvent, FALSE);//初始化事件
//等3秒
LARGE_INTEGER timeout;
timeout.QuadPart = -3 * 1000 * 1000 * 10;
//定义一个3秒的延时,主要是为了模拟该IRP操作需要大概3秒左右时间
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);
KdPrint(("打印创建请求数据包 Complete a irp:%x\n", Irp));
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0; // no bytes xfered
IoCompleteRequest(Irp, IO_NO_INCREMENT);
device_entry = KeRemoveDeviceQueue(&pDevExt->device_queue2);//从队列中删除
KdPrint(("删除创建请求的元素 device_entry:%x\n", device_entry));
if (device_entry == NULL)
{
break;
}
Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);//irp的地址
} while (1);
KdPrint(("Leave MyStartIo2\n"));
}
VOID MyStartIo3(IN PDEVICE_OBJECT DeviceObject, IN PIRP pFistIrp)//设备对象 数据包(irp)
{
KdPrint(("进入的自定义的 MyStartIo3\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension;
PKDEVICE_QUEUE_ENTRY device_entry;
PIRP Irp = pFistIrp;
do
{
KEVENT event;
KeInitializeEvent(&event, NotificationEvent, FALSE);//初始化事件
//等3秒
LARGE_INTEGER timeout;
timeout.QuadPart = -3 * 1000 * 1000 * 10;
//定义一个3秒的延时,主要是为了模拟该IRP操作需要大概3秒左右时间
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);
KdPrint(("打印关闭请求数据包 Complete a irp:%x\n", Irp));
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0; // no bytes xfered
IoCompleteRequest(Irp, IO_NO_INCREMENT);
device_entry = KeRemoveDeviceQueue(&pDevExt->device_queue3);//从队列中删除
KdPrint(("删除关闭请求的元素 device_entry:%x\n", device_entry));
if (device_entry == NULL)
{
break;
}
Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);//irp的地址
} while (1);
KdPrint(("Leave MyStartIo3\n"));
}
/************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序,定位和申请硬件资源,创建内核对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath )
{
NTSTATUS status;
KdPrint(("Enter DriverEntry\n"));
//设置卸载函数
pDriverObject->DriverUnload = HelloDDKUnload;
//设置派遣函数
pDriverObject->MajorFunction[IRP_MJ_CREATE] = chuangjian;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKCleanUp;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKRead;
pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = HelloDDKDispatchRoutin;
//创建驱动设备对象
status = CreateDevice(pDriverObject);
KdPrint(("Leave DriverEntry\n"));
return status;
}
/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
//创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");
//创建设备
status = IoCreateDevice( pDriverObject,sizeof(DEVICE_EXTENSION),&(UNICODE_STRING)devName,FILE_DEVICE_UNKNOWN,0, TRUE,&pDevObj );
if (!NT_SUCCESS(status))
return status;
pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
RtlZeroBytes(&pDevExt->device_queue,sizeof(pDevExt->device_queue));
KeInitializeDeviceQueue(&pDevExt->device_queue);//初始化设备 一起初始化队列
KeInitializeDeviceQueue(&pDevExt->device_queue2);//初始化设备 一起初始化队列
KeInitializeDeviceQueue(&pDevExt->device_queue3);//初始化设备 一起初始化队列
//创建符号链接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
}
/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
//while (pNextObj != NULL)
//{
// PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
// pNextObj->DeviceExtension;
// //删除符号链接
// UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
// IoDeleteSymbolicLink(&pLinkName);
// pNextObj = pNextObj->NextDevice;
// IoDeleteDevice( pDevExt->pDevice );
//}
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName, L"\\??\\HelloDDK");
pNextObj = pDriverObject->DeviceObject;//我的第一个设备
IoDeleteSymbolicLink(&symLinkName);//删除符号连接
IoDeleteDevice(pDriverObject->DeviceObject);//删除设备
}
/************************************************************************
* 函数名称:HelloDDKDispatchRoutin
* 功能描述:对读IRP进行处理
* 参数列表:
pDevObj:功能设备对象
pIrp:从IO请求包
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutin\n"));
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
//建立一个字符串数组与IRP类型对应起来
static char* irpname[] =
{
"IRP_MJ_CREATE",
"IRP_MJ_CREATE_NAMED_PIPE",
"IRP_MJ_CLOSE",
"IRP_MJ_READ",
"IRP_MJ_WRITE",
"IRP_MJ_QUERY_INFORMATION",
"IRP_MJ_SET_INFORMATION",
"IRP_MJ_QUERY_EA",
"IRP_MJ_SET_EA",
"IRP_MJ_FLUSH_BUFFERS",
"IRP_MJ_QUERY_VOLUME_INFORMATION",
"IRP_MJ_SET_VOLUME_INFORMATION",
"IRP_MJ_DIRECTORY_CONTROL",
"IRP_MJ_FILE_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CONTROL",
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
"IRP_MJ_SHUTDOWN",
"IRP_MJ_LOCK_CONTROL",
"IRP_MJ_CLEANUP",
"IRP_MJ_CREATE_MAILSLOT",
"IRP_MJ_QUERY_SECURITY",
"IRP_MJ_SET_SECURITY",
"IRP_MJ_POWER",
"IRP_MJ_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CHANGE",
"IRP_MJ_QUERY_QUOTA",
"IRP_MJ_SET_QUOTA",
"IRP_MJ_PNP",
};
UCHAR type = stack->MajorFunction;
if (type >= arraysize(irpname))
KdPrint((" - Unknown IRP, major type %X\n", type));
else
KdPrint(("\t%s\n", irpname[type]));
//对一般IRP的简单操作,后面会介绍对IRP更复杂的操作
NTSTATUS status = STATUS_SUCCESS;
// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDispatchRoutin\n"));
return status;
}
VOID OnCancelIRP(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
KdPrint(("进入取消历程\n"));
//释放Cancel自旋锁
IoReleaseCancelSpinLock(Irp->CancelIrql);
//设置完成状态为STATUS_CANCELLED
Irp->IoStatus.Status = STATUS_CANCELLED;
Irp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( Irp, IO_NO_INCREMENT );
KdPrint(("进入取消历程\n"));
}
VOID OnCancelIRP2(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
KdPrint(("Enter CancelchuangjianIRP\n"));
//释放Cancel自旋锁
IoReleaseCancelSpinLock(Irp->CancelIrql);
//设置完成状态为STATUS_CANCELLED
Irp->IoStatus.Status = STATUS_CANCELLED;
Irp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest(Irp, IO_NO_INCREMENT);
KdPrint(("Leave CancelchuangjianIRP\n"));
}
NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp)
{
KdPrint(("进入读请求\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
IoMarkIrpPending(pIrp);//将IRP设置为挂起
IoSetCancelRoutine(pIrp,OnCancelIRP);//取消历程
KIRQL oldirql;
KeRaiseIrql(DISPATCH_LEVEL, &oldirql);//提升IRP至DISPATCH_LEVEL
KdPrint(("HelloDDKRead irp :%x\n",pIrp));
KdPrint(("DeviceQueueEntry:%x\n",&pIrp->Tail.Overlay.DeviceQueueEntry));
if (!KeInsertDeviceQueue(&pDevExt->device_queue, &pIrp->Tail.Overlay.DeviceQueueEntry))//插入到队列 系统历程处理 如果返回false(没有被插入)
MyStartIo(pDevObj,pIrp);//调用自定义StartIo
KeLowerIrql(oldirql);//将IRP降至原来IRQL
KdPrint(("Leave HelloDDKRead\n"));
//返回pending状态
return STATUS_PENDING;
}
NTSTATUS chuangjian(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
{
KdPrint(("进入创建请求\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
IoMarkIrpPending(pIrp);//将IRP设置为挂起
IoSetCancelRoutine(pIrp, OnCancelIRP);//取消历程
KIRQL oldirql;
KeRaiseIrql(DISPATCH_LEVEL, &oldirql);//提升IRP至DISPATCH_LEVEL
KdPrint(("HelloDDKchuangjian irp :%x\n", pIrp));
KdPrint(("DeviceQueueEntry:%x\n", &pIrp->Tail.Overlay.DeviceQueueEntry));
if (!KeInsertDeviceQueue(&pDevExt->device_queue2, &pIrp->Tail.Overlay.DeviceQueueEntry))//插入到队列 系统历程处理 如果返回false(没有被插入)
MyStartIo2(pDevObj, pIrp);//调用自定义StartIo
KeLowerIrql(oldirql);//将IRP降至原来IRQL
KdPrint(("Leave HelloDDKchuangjian\n"));
//返回pending状态
return STATUS_PENDING;
}
NTSTATUS HelloDDKCleanUp(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)//关闭历程
{
KdPrint(("进入关闭请求\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
IoMarkIrpPending(pIrp);//将IRP设置为挂起
IoSetCancelRoutine(pIrp, OnCancelIRP);//取消历程
KIRQL oldirql;
KeRaiseIrql(DISPATCH_LEVEL, &oldirql);//提升IRP至DISPATCH_LEVEL
KdPrint(("HelloDDKguanbi irp :%x\n", pIrp));
KdPrint(("DeviceQueueEntry:%x\n", &pIrp->Tail.Overlay.DeviceQueueEntry));
if (!KeInsertDeviceQueue(&pDevExt->device_queue3, &pIrp->Tail.Overlay.DeviceQueueEntry))//插入到队列 系统历程处理 如果返回false(没有被插入)
MyStartIo3(pDevObj, pIrp);//调用自定义StartIo
KeLowerIrql(oldirql);//将IRP降至原来IRQL
KdPrint(("Leave HelloDDKguanbi\n"));
//返回pending状态
return STATUS_PENDING;
}