Windows应用程序控制内核简单例子（通讯）

//应用程序例子
#include <iostream>
#include<Windows.h>
#define CW_DEV_SYM L"\\\\.\\slbkcdo_3948d33e"
int main() {
	HANDLE device = NULL;
	device = CreateFile(CW_DEV_SYM,GENERIC_READ|GENERIC_WRITE,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_SYSTEM,0);
	if (device==INVALID_HANDLE_VALUE) {
		printf("coworker demo:Open device failed.\r\n");
		return -1;
	}
	else {
		printf("coworker demo: Open device successfully. \r\n");
	}
	CloseHandle(device);
}

//内核驱动例子
#include<ntddk.h>
#include<ntstrsafe.h>
//提供一个Unload函数只是为了让这个程序能动态卸载
VOID DriverUnload(PDRIVER_OBJECT driver) {
	DbgPrint("first:Our driver is unloading...\r\n");
	
}
#define CWK_CDO_SYB_NAME L"\\??\\slbkcdo_3948d33e"
PDEVICE_OBJECT g_co = { 0 };//全局设备对象指针
const GUID  guid =
{ 0x8a32b368, 0x3249, 0x12e1, {0x92,0x16, 0x46, 0x1a, 0x21, 0x30, 0x29, 0x06} };
NTSTATUS InitDeviceAndSymbolic(IN PDRIVER_OBJECT driver) {
	UNICODE_STRING cdo_name = RTL_CONSTANT_STRING(L"\\Device\\cwk_3948d33e");
	NTSTATUS status = NULL;
	NTSTATUS driverStatus = NULL;
	UNICODE_STRING cdo_syb = RTL_CONSTANT_STRING(CWK_CDO_SYB_NAME);
	//生成符号链接
	IoDeleteSymbolicLink(&cdo_syb);//可能有同名的符号链接因此先删除
	driverStatus = IoCreateDevice(driver, 0, &cdo_name, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN
		, FALSE, &g_co);//创建设备对象
	status = IoCreateSymbolicLink(&cdo_syb, &cdo_name);
	if (!NT_SUCCESS(status)) {
		//如果设备删除设备对象
		//IoDeleteDevice(g_co);
		return status;
	}
	else {
		DbgPrint("成功");
	}
}

NTSTATUS cwkDispatch(IN PDEVICE_OBJECT dev,IN PIRP irp) {
	ULONG_PTR ret_len=sizeof(ULONG_PTR);
	PIO_STACK_LOCATION irpsp = IoGetCurrentIrpStackLocation(irp);//请求当前栈空间，栈空间结构是适用于内核的设备对象栈结构
#if DBG
	__asm int 3
#endif // DBG
	if (dev == g_co) {
		if (irpsp->MajorFunction == IRP_MJ_CREATE || irpsp->MajorFunction == IRP_MJ_CLOSE) {
			DbgPrint("IRP_MJ_CREATE||IRP_MJ_CLOSE STATUS=TURE");
			//返回输出提供了一个接受请求的缓冲区Information用来返回到底使用了多少输出空间
			irp->IoStatus.Information = ret_len;
			//返回状态
			irp->IoStatus.Status = STATUS_SUCCESS;
			//结束请求
			IoCompleteRequest(irp,IO_NO_INCREMENT);
			return STATUS_SUCCESS;

		}
		if (irpsp->MajorFunction==IRP_MJ_DEVICE_CONTROL) {
			DbgPrint("IRP_MJ_DEVICE_CONTROL STATUS=TRUE");
			//返回输出提供了一个接受请求的缓冲区Information用来返回到底使用了多少输出空间
			irp->IoStatus.Information = ret_len;
			//返回状态
			irp->IoStatus.Status = STATUS_SUCCESS;
			//结束请求
			IoCompleteRequest(irp, IO_NO_INCREMENT);
			return STATUS_SUCCESS;
		}
	}
	IoCompleteRequest(irp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path) {
	ULONG i;
	DbgPrint("内核通信测试DEMO");
	InitDeviceAndSymbolic(driver);
	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) {
		driver->MajorFunction[i] = cwkDispatch;
	}
	driver->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}
//DbgPrint("当前KernelModule中断级别:%d.\r\n",kil);
//设置一个卸载函数，便于这个函数退出