过滤 基础 7.1

生成过滤设备

NTSTATUS
IoCreateDevice(
        INPDRIVER_OBJECT DriverObject,
        IN ULONG DeviceExtensionSize,
        IN PUNICODE_STRING DeviceName OPTIONAL,
        IN DEVICE_TYPE DeviceType,
        IN ULONG DeviceCharacteristics,
        IN BOOLEAN Exclusive,
        OUT PDEVICE_OBJECT *DeviceObject
);

根据名字来绑定功能的内核API

NTSTATUS 
        IoAttachDevice(
            IN PDEVICE_OBJECT      SourceDevice,
            IN PUNICODE_STRING  TargetDevice,  //this string is device's name
            OUT PDEVIE_OBJECT     *AttachDevice
);

绑定串口1

UNICODE_STRING com_name = RTL_CONSTANT_STRING(L"\\Device\\Serial0");
NTSTATUS status = IoAttachDevice(
com_filter_device,
&com_device_name,
&attach_device
);

没有名字(根据指针)来绑定功能的内核API

NTSTATUS 
        IoAttachDeviceToDeviceStackSafe(
            IN PDEVICE_OBJECT      SourceDevice,
            IN PDEVICE_OBJECT  TargetDevice,  //this string is not device's name
            IN OUT PDEVIE_OBJECT     *AttachDeviceToDeviceObject
);

生成一个设备并且绑定到另一设备上

NTSTATUS 
ccpAttachDevice(
PDRIVER_OBJECT driver,
PDRIVER_OBJECT oldobj,
PDRIVER_OBJECT *fltobj,
PDRIVER_OBJECT *next)
{
    NTSTATUS status;
    PDRIVER_OBJECT topdev = NULL;
//生成设备然后绑定
status = IoCreateDevice(driver,0,NULL,oldobj->DeviceType,0,FALSE,fltobj);
if (status != STATUS_SUCCESS)
        return status;

//拷贝重要标志位
if(oldobj->Flags & DO_BUFFERED_IO)
        (*fltobj)->Flag |= DO_BUFFED_IO;
if(oldobj->Flags & DO_RIRECT_IO)
        (*fltobj)->Flag |= DO_DIRECT_IO;
}

if(oldobj->Characteristics & FILE_DEVICE_SUCURE_OPEN)
        (*fltobj)->Characteristics |= FILE_DEVICE_SUCURE_OPEN;
(*fltobj)->Flag |= DO_POWER_PAGABLE;

//将一个设备绑定到另一个设备上
topdev = IoAttachDeviceToDeviceStack(*fltobj,oldobj);
if(topdev == NULL)
{
//如果绑定失败销毁设备返回错误
IoDeleteDevice(*fltobj);
*fltobj = NULL;
status = STATUS_UNSUCESSFUL;
return status;
}
*next = topdev;

//设置这个设备已经启动
(*fltobj)-> = (*fltobj)->Flags & ~DO_DEVICE_INITIALIZING;
return STATUS_SUCCESS;
}

从名字获得设备对象指针

include

define NTSTRSAFE_LIB

include