注册关机通知

方法1:自己创建设备

处理IRP_MJ_SHUTDOWN irp回调 ,还需要调用IoRegisterShutdownNotification函数来关联设备.就可以成功的注册关机通知了.

#include "LoadFirst.h"
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
}

NTSTATUS DispatchShutDown(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
	KdPrint(("关机回调运行\n"));
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	pDriverObject->DriverUnload = DriverUnload;
	PDEVICE_OBJECT pDeviceObject;
	status=IoCreateDevice(pDriverObject, 0, NULL, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDeviceObject);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("设备创建失败\n"));
		return status;
	}
	pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = DispatchShutDown;
	IoRegisterShutdownNotification(pDeviceObject);

	KdPrint(("驱动加载成功\n"));
	return status;
}

方法2:寻找别的设备对象

#include "LoadFirst.h"
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
}

NTSTATUS DispatchShutDown(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
	KdPrint(("关机回调运行 other device\n"));
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	pDriverObject->DriverUnload = DriverUnload;
	PDEVICE_OBJECT pDeviceObject;
	
	UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(L"\\Device\\Null");
	PFILE_OBJECT pFileObject;

	status=IoGetDeviceObjectPointer(&DeviceName, FILE_ALL_ACCESS, &pFileObject, &pDeviceObject);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("获取设备指针失败\n"));
		return status;
	}
	pDeviceObject->DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = DispatchShutDown;
	IoRegisterShutdownNotification(pDeviceObject);

	KdPrint(("驱动加载成功\n"));
	return status;
}