纯属无聊的产物,请不要拍砖,先来看看汇编的,这个例子修改自4-F的KMD教程,我只是加了一句话而已T_T :
01 ;@echo off
02 ;goto make
03 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
04 ; simplest - Simplest possible kernel-mode driver
05 ;
06 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
07 .386
08 .model flat, stdcall
09 option casemap:none
10 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
11 ; I N C L U D E F I L E S
12 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
13 include /masm32/include/w2k/ntstatus.inc
14 include /masm32/include/w2k/ntddk.inc
15 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
16 ; C O D E
17 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
18 .code
19 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
20 ; DriverEntry
21 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
22 DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
23
24 invoke DdbPrint,$CTA0("Hello World!") ;; 打印消息,但得通过调试器或DbgView来捕捉
25
26 mov eax, STATUS_DEVICE_CONFIGURATION_ERROR ;;返回错误,使驱动被卸载
27 ret
28
29 DriverEntry endp
30 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
31 end DriverEntry
32 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
33 ; B U I L D I N G D R I V E R
34 ;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
35 :make
36 set drv=simplest
37 /masm32/bin/ml /nologo /c /coff %drv%.bat
38 /masm32/bin/link /nologo /driver /base:0x10000 /align:32 /out:%drv%.sys /subsystem:native %drv%.obj
39 del %drv%.obj
40 echo.
41 pause
这个驱动是用批处理进行编译的,下面的是C语言版的,更简单了,用的是驱动模板的生成文件,也是只修改了一
句话,嘿嘿,,,看来这一贴是水定了:
01
02 使用驱动模板生成/
03 extern "C"
04 {
05 #include <ntddk.h>
06 #include <ntddndis.h>
07 #include <pfhook.h>
08 }
09
10 NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)
11 {
12
13 DbgPrint("Hello world!"); //打印消息,但得通过调试器或DbgView来捕捉
14 return STATUS_DEVICE_CONFIGURATION_ERROR; //返回错误,使驱动被卸载
15
16 }
文件明显短了一半,但这种写法是不好的,至少也应该填充几个常用的例程,但这个是入门级的,所以能省一点
就省一点。似乎这两份代码都是豆腐工程......