驱动对象 Driver_Object
CSHORT Type;
CSHORT Size;
ULONG Flags;
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
PDRIVER_STARTIO DriverStartIo;// 记录 StartIO 例程的函数地址
PDRIVER_UNLOAD DriverUnload;//指定驱动卸载时所用的回调函数地址
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];//函数指针数组, 每个成员都是一个处理IRP请求的派遣函数
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; // ntndis
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT
{
CSHORT Type;
USHORT Size;
LONG ReferenceCount;
struct _DRIVER_OBJECT *DriverObject; /*指向驱动程序中驱动对象的指针*/
struct _DEVICE_OBJECT *NextDevice;/*指向下一个设备对象的指针*/
struct _DEVICE_OBJECT *AttachedDevice;/当前驱动有更高一层驱动附加的话,指向高层驱动
struct _IRP *CurrentIrp;/*当前IRP结构*/
PIO_TIMER Timer;
ULONG Flags; /*设备对象的特性标志*/
ULONG Characteristics;
_volatile PVPB Vpb;
PVOID DeviceExtension; /*指向设备扩展对象的指针*/
DEVICE_TYPE DeviceType; /*指明设备类型*/
CCHAR StackSize; /*多层驱动下,堆栈的最小层数*/
union {
LIST_ENTRY ListEntry;
WAIT_CONTEXT_BLOCK Wcb;
} Queue;
ULONG AlignmentRequirement; /*内存对齐*/
KDEVICE_QUEUE DeviceQueue;
KDPC Dpc;
/*
*下列成员用于支持文件系统的互斥操作
*以便对文件系统处理线程使用设备的计数保持跟踪
*/
ULONG ActiveThreadCount;
PSECURITY_DESCRIPTOR SecurityDescriptor;
KEVENT DeviceLock;
USHORT SectorSize;
USHORT Spare1;
struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
PVOID Reserved;
} DEVICE_OBJECT;
typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
结构图