WDM HelloWord分析

typedef struct _DEVICE_EXTENSION
{
PDEVICE_OBJECT fdo;
PDEVICE_OBJECT NextStackDevice;
UNICODE_STRING ustrDeviceName;
UNICODE_STRING ustrSymLinkName;
}DEVICE_EXTENSION, *PDEVICE_EXTENSION;

DriverEntry

• 添加设备
  pDriverObject->DriverExTension->AddDevice = HelloWDMAddDevice

//HelloWDMAddDevice(PDRIVER_OBJECT pDriverObject, PDEVICE_OBJECT pPhysicalDeviceObject)

1. 创建设备
   Unicode_String devName;
   RtlInitUnicodeString(&devName, L"\Device\MyDevice");
   PDEVICE_OBJEJCT fdo; //获取创建的功能设备对象
   IoCreateDevice(pDriverObject, sizeof(DEVICE_EXTENSION), devName, file_device_unkonw,0,false, &fdo);
2. 初始化设备扩展:fdo\附加到设备栈后的设备对象指针\设备名称\设备符号名称
   • 将创建的功能设备对象添加到设备栈
     PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
     pdx->fdo = fdo;
     pdx->NextStackDevice = IoAttachDeviceToDeviceStack(fdo, PhysicalDeviceObject);
     UNICODE_STRING symLinkName;
     RtlInitUnicodeString(&symLinkName, “\??\Hello”);
     pdx->ustrDeviceName = devName;
     pdx->ustrSymLinkName = synLinkName;
3. 绑定符号名称与设备名称
   IoCreateSymbolicLink(&symLinkName,&devName);
4. 设置设备状态
   fdo->Flags |= DO_BUFFER_IO | DO_POWER_PAGEABLE;
   fdo->Flags &= ~DO_DEVICE_INITAILIZING;

• 设置分发例程
  1.IRP_MJ_PNP(PDEVICE_OBJECT fdo, PIRP irp)
  获取当前irp栈位置，用于确定具体调那个响应函数
  PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(irp);
  设置对应位置的响应函数
  static NTSTATUS (*fcntab[])(PDEVICE_EXTENSION pdx, PIRP Irp) =
  {
  DefaultPnpHandler, // IRP_MN_START_DEVICE
  DefaultPnpHandler, // IRP_MN_QUERY_REMOVE_DEVICE
  HandleRemoveDevice, // IRP_MN_REMOVE_DEVICE
  DefaultPnpHandler, // IRP_MN_CANCEL_REMOVE_DEVICE
  DefaultPnpHandler, // IRP_MN_STOP_DEVICE
  DefaultPnpHandler, // IRP_MN_QUERY_STOP_DEVICE
  DefaultPnpHandler, // IRP_MN_CANCEL_STOP_DEVICE
  DefaultPnpHandler, // IRP_MN_QUERY_DEVICE_RELATIONS
  DefaultPnpHandler, // IRP_MN_QUERY_INTERFACE
  DefaultPnpHandler, // IRP_MN_QUERY_CAPABILITIES
  DefaultPnpHandler, // IRP_MN_QUERY_RESOURCES
  DefaultPnpHandler, // IRP_MN_QUERY_RESOURCE_REQUIREMENTS
  DefaultPnpHandler, // IRP_MN_QUERY_DEVICE_TEXT
  DefaultPnpHandler, // IRP_MN_FILTER_RESOURCE_REQUIREMENTS
  DefaultPnpHandler, //
  DefaultPnpHandler, // IRP_MN_READ_CONFIG
  DefaultPnpHandler, // IRP_MN_WRITE_CONFIG
  DefaultPnpHandler, // IRP_MN_EJECT
  DefaultPnpHandler, // IRP_MN_SET_LOCK
  DefaultPnpHandler, // IRP_MN_QUERY_ID
  DefaultPnpHandler, // IRP_MN_QUERY_PNP_DEVICE_STATE
  DefaultPnpHandler, // IRP_MN_QUERY_BUS_INFORMATION
  DefaultPnpHandler, // IRP_MN_DEVICE_USAGE_NOTIFICATION
  DefaultPnpHandler, // IRP_MN_SURPRISE_REMOVAL
  };
  获取当前响应函数功能码执行对应的函数
  ULONG fcn = stack->MinorFunction;
  status = (*fcntab[fcn])(pdx, irp);
  2.OTHERS DispatchRoutine(PDEVICE_OBJECT fdo, PIRP irp)
  设置irp状态与信息
  irp.IoStatus.Statius = STATUS_SUCCESS;
  irp.IoStatus.Information = 0;
  设置请求完成
  IoCompleteRequest(irp, IO_NO_INCREMENT);
• 设置卸载函数
  pDriverObject->DriverUnload = HellUnload