8.2.3 键盘过滤模块的DriverEntry

NTSTATUS DriverEntry(
                                        IN PDRIVER_OBJECT DriverObject,
                                        IＮ PUNICODE_STRING RegistryPath
                                        )
{   
        ULONG i;
        NTSTATUS status;
        KdPrint (("c2p.sys:entering DriverEntry\n"));

    //填写所有的分发函数的指针
    for(i=0;i<=IRP_MJ_MAXIMUM_FUNCTION;i++)
    {
        DriverObject->MajorFunction[i] = c2pDispatchGeneral;
    }

    //单独写一个read分发函数,因为过滤重要的是读取按键信息,所以这个函数单独写
    DriverObject->MajorFunction[IRP_MJ_READ] = c2pDispatchRead;

    //单独写一个IRP_MJ_POWER函数.因为这类请求中间要调用一个PoCallDriver和一个PoStartNextPOwerIrp
    DriverObject->MajorFunction[IRP_MJ_POWER] = c2pPower;

    //我们想知道什么时候绑定过的一个设备被卸载(比如从机器上拔掉了)所以专门写一个PNP(即插即用)分发函数
    DriverObject->MajorFunction[IRP_MJ_PNP] = c2pPnP;

    //卸载函数
    DriverObject->DriverUnload = c2pUnload;
    gDriverObject = DriverObject;

    //绑定所有的键盘设备
    status = c2pAttachDevices(DriverObject,RegisteryPath);
    return status;
    }       

实际中动态卸载的处理

VOID
c2pUnlaod(IN PDRIVER OBJECT DriverObject)
{
        PDEVICE_OBJECT DeviceObject;
        PDEVICE_OBJECT OldDeviceObject;
        PC2P_DEV_EXT devExt;

    LARGE_INTEGER lDelay;
    PRKTHREAD CurrentThread;
    //delay some time
    lDelay =     RtlConvertLongToLargeInteger(100*DELAY_ONE_MILLISECOND);
    CurrentThread = KeGetCurrentThread();
    //把当前的线程设置为低实时模式,以便让它的运行尽量少影响其他程序
    KeSetPriorittyThread(CurrentThread,LOW_REALTIME_PRIORITY);
    UNREFERENCED_PARAMETER(DriverObject);
    KdPrint(("DriverEntry unLoading...\n"));

    //遍历所有设备并一律解除绑定
    DeviceObject = DriverObject->DeviceObject;
    while(DeviceObject)
    {
        //解除绑定并且删除所有的设备
        c2pDetach(DeviceObject);
        DeviceObject = DeviceObject->NextDevice;
    }
    ASSERT(NULL == DriverObject);
//防止未决请求,gC2pKeyCount是个全局变量,每次来个请求就被加1,完成后减1,所有请求都完成才结束等待
    while(gC2pKeyCount)
    {
      KeDelayExecutionThread(KernelMode,FALSE,&lDelay);
    }
    KdPrint(("DriverEntry unLoad OK!\n"));
    return;
}