30、驱动程序调用驱动程序

最新推荐文章于 2023-04-25 13:13:01 发布

weixin_33811539

最新推荐文章于 2023-04-25 13:13:01 发布

阅读量339

点赞数

文章标签：操作系统

有两种方法，一种是以文件句柄的形式，另外一种是通过设备指针调用其它驱动程序。

1、以文件句柄形式调用

1）应用程序调用驱动A 调用驱动B

这种方法类似于在应用程序中调用驱动程序。

在应用程序中用CreateFile，ReadFile,CloseHandle来操作相应文件，驱动中用ZwCreateFile,ZwReadFile,Irp结束操作。

要注意：

ZwCreateFile，如果是同步打开设备，则参数DesiredAccess，设为SYNCHRONIZE，参数CreateOptions设为FILE_SYNCHRONOUS_IO_ALERT或者是FILE_SYNCHRONOUS_IO_NONALERT。如果是异步打开设备，则参数DesiredAccess，不设为SYNCHRONIZE，且CreateOptions不能指定为上面两者中任何其一。

代码

1 // DriverA
2 typedef struct _DEVICE_EXTENSION {
3 PDEVICE_OBJECT pDevice;
4 UNICODE_STRING ustrDeviceName; // 设备名称
5 UNICODE_STRING ustrSymLinkName; // 符号链接名
6
7 KDPC pollingDPC; // 存储DPC对象
8 KTIMER pollingTimer; // 存储计时器对象
9 PIRP currentPendingIRP; // 记录当前挂起的IRP
10 } DEVICE_EXTENSION, * PDEVICE_EXTENSION;
11
12 #pragma LOCKEDCODE
13 VOID OnTimerDpc( IN PKDPC pDpc,
14 IN PVOID pContext,
15 IN PVOID SysArg1,
16 IN PVOID SysArg2 )
17 {
18 PDEVICE_OBJECT pDevObj = (PDEVICE_OBJECT)pContext;
19 PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pDevObj -> DeviceExtension;
20
21 PIRP currentPendingIRP = pdx -> currentPendingIRP;
22
23 KdPrint(( " DriverA:complete the Driver A IRP_MJ_READ irp!\n " ));
24
25 // 设置完成状态为STATUS_CANCELLED
26 currentPendingIRP -> IoStatus.Status = STATUS_SUCCESS;
27 currentPendingIRP -> IoStatus.Information = 0 ; // bytes xfered
28 IoCompleteRequest( currentPendingIRP, IO_NO_INCREMENT );
29 }
30
31 /* ***********************************************************************
32 * 函数名称:CreateDevice
33 * 功能描述:初始化设备对象
34 * 参数列表:
35 pDriverObject:从I/O管理器中传进来的驱动对象
36 * 返回值:返回初始化状态
37 ************************************************************************ */
38 #pragma INITCODE
39 NTSTATUS CreateDevice (
40 IN PDRIVER_OBJECT pDriverObject)
41 {
42 NTSTATUS status;
43 PDEVICE_OBJECT pDevObj;
44 PDEVICE_EXTENSION pDevExt;
45
46 // 创建设备名称
47 UNICODE_STRING devName;
48 RtlInitUnicodeString( & devName,L " \\Device\\MyDDKDeviceA " );
49
50 // 创建设备
51 status = IoCreateDevice( pDriverObject,
52 sizeof (DEVICE_EXTENSION),
53 & (UNICODE_STRING)devName,
54 FILE_DEVICE_UNKNOWN,
55 0 , TRUE,
56 & pDevObj );
57 if ( ! NT_SUCCESS(status))
58 return status;
59
60 pDevObj -> Flags |= DO_BUFFERED_IO;
61 pDevExt = (PDEVICE_EXTENSION)pDevObj -> DeviceExtension;
62 pDevExt -> pDevice = pDevObj;
63 pDevExt -> ustrDeviceName = devName;
64
65 KeInitializeTimer( & pDevExt -> pollingTimer );
66
67 KeInitializeDpc( & pDevExt -> pollingDPC,
68 OnTimerDpc,
69 (PVOID) pDevObj );
70
71 // 创建符号链接
72 UNICODE_STRING symLinkName;
73 RtlInitUnicodeString( & symLinkName,L " \\??\\HelloDDKA " );
74 pDevExt -> ustrSymLinkName = symLinkName;
75 status = IoCreateSymbolicLink( & symLinkName, & devName );
76 if ( ! NT_SUCCESS(status))
77 {
78 IoDeleteDevice( pDevObj );
79 return status;
80 }
81 return STATUS_SUCCESS;
82 }
83 /* ***********************************************************************
84 * 函数名称:HelloDDKRead
85 * 功能描述:对读IRP进行处理
86 * 参数列表:
87 pDevObj:功能设备对象
88 pIrp:从IO请求包
89 * 返回值:返回状态
90 ************************************************************************ */
91 #pragma PAGEDCODE
92 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
93 IN PIRP pIrp)
94 {
95 KdPrint(( " DriverA:Enter A HelloDDKRead\n " ));
96
97 PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
98 pDevObj -> DeviceExtension;
99
100 // 将IRP设置为挂起
101 IoMarkIrpPending(pIrp);
102
103 // 将挂起的IRP记录下来
104 pDevExt -> currentPendingIRP = pIrp;
105
106 // 定义3秒后将IRP_MJ_READ的IRP完成
107 ULONG ulMicroSecond = 3000000 ;
108
109 // 将32位整数转化成64位整数
110 LARGE_INTEGER timeout = RtlConvertLongToLargeInteger( - 10 * ulMicroSecond);
111
112 KeSetTimer(
113 & pDevExt -> pollingTimer,
114 timeout,
115 & pDevExt -> pollingDPC );
116
117 KdPrint(( " DriverA:Leave A HelloDDKRead\n " ));
118
119 // 返回pending状态
120 return STATUS_PENDING;
121 }
122

代码

1 // DriverB
2 #pragma PAGEDCODE
3 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
4 IN PIRP pIrp)
5 {
6 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
7 NTSTATUS ntStatus = STATUS_SUCCESS;
8
9 UNICODE_STRING DeviceName;
10 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
11
12 // 初始化objectAttributes
13 OBJECT_ATTRIBUTES objectAttributes;
14 InitializeObjectAttributes( & objectAttributes,
15 & DeviceName,
16 OBJ_CASE_INSENSITIVE,
17 NULL,
18 NULL );
19
20 HANDLE hDevice;
21 IO_STATUS_BLOCK status_block;
22 // 同步打开设备
23 // 设定了FILE_SYNCHRONOUS_IO_NONALERT或者FILE_SYNCHRONOUS_IO_ALERT为同步打开设备
24 ntStatus = ZwCreateFile( & hDevice,
25 FILE_READ_ATTRIBUTES | SYNCHRONIZE,
26 & objectAttributes,
27 & status_block,
28 NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
29 FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL, 0 );
30
31 if (NT_SUCCESS(ntStatus))
32 {
33 ZwReadFile(hDevice,NULL,NULL,NULL, & status_block,NULL, 0 ,NULL,NULL);
34 }
35
36 ZwClose(hDevice);
37
38 // 完成IRP
39 pIrp -> IoStatus.Status = ntStatus;
40 pIrp -> IoStatus.Information = 0 ; // bytes xfered
41 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
42 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
43 return ntStatus;
44 }
45
46 /* ***********************************************************************
47 * 函数名称:HelloDDKDispatchRoutine
48 * 功能描述:对读IRP进行处理
49 * 参数列表:
50 pDevObj:功能设备对象
51 pIrp:从IO请求包
52 * 返回值:返回状态
53 ************************************************************************ */
54 #pragma PAGEDCODE
55 NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
56 IN PIRP pIrp)
57 {
58 KdPrint(( " DriverB:Enter B HelloDDKDispatchRoutine\n " ));
59 NTSTATUS ntStatus = STATUS_SUCCESS;
60 // 完成IRP
61 pIrp -> IoStatus.Status = ntStatus;
62 pIrp -> IoStatus.Information = 0 ; // bytes xfered
63 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
64 KdPrint(( " DriverB:Leave B HelloDDKDispatchRoutine\n " ));
65 return ntStatus;
66 }
67
68 #pragma PAGEDCODE
69 NTSTATUS HelloDDKCreate(IN PDEVICE_OBJECT pDevObj,
70 IN PIRP pIrp)
71 {
72 KdPrint(( " DriverB:Enter B HelloDDKCreate\n " ));
73 NTSTATUS ntStatus = STATUS_SUCCESS;
74 // 完成IRP
75 pIrp -> IoStatus.Status = ntStatus;
76 pIrp -> IoStatus.Information = 0 ; // bytes xfered
77 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
78
79 KdPrint(( " DriverB:Leave B HelloDDKCreate\n " ));
80
81 return ntStatus;
82 }
83
84 #pragma PAGEDCODE
85 NTSTATUS HelloDDKClose(IN PDEVICE_OBJECT pDevObj,
86 IN PIRP pIrp)
87 {
88 KdPrint(( " DriverB:Enter B HelloDDKClose\n " ));
89 NTSTATUS ntStatus = STATUS_SUCCESS;
90
91 PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pDevObj -> DeviceExtension;
92
93 // 完成IRP
94 pIrp -> IoStatus.Status = ntStatus;
95 pIrp -> IoStatus.Information = 0 ; // bytes xfered
96 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
97
98 KdPrint(( " DriverB:Leave B HelloDDKClose\n " ));
99
100 return ntStatus;
101 }

代码

1 // main
2 #include < windows.h >
3 #include < stdio.h >
4
5 int main()
6 {
7
8 HANDLE hDevice =
9 CreateFile( " \\\\.\\HelloDDKB " ,
10 GENERIC_READ | GENERIC_WRITE,
11 0 , // share mode none
12 NULL, // no security
13 OPEN_EXISTING,
14 FILE_ATTRIBUTE_NORMAL,
15 NULL ); // no template
16
17 if (hDevice == INVALID_HANDLE_VALUE)
18 {
19 printf( " Failed to obtain file handle to device "
20 " with Win32 error code: %d\n " ,
21 GetLastError() );
22 return 1 ;
23 }
24
25 DWORD dRet;
26 ReadFile(hDevice,NULL, 0 , & dRet,NULL);
27
28 CloseHandle(hDevice);
29
30 return 0 ;
31 }

同步示例代码 P296

代码

1 /* ***********************************************************************
2 * 函数名称:DriverEntry
3 * 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象
4 * 参数列表:
5 pDriverObject:从I/O管理器中传进来的驱动对象
6 pRegistryPath:驱动程序在注册表的中的路径
7 * 返回值:返回初始化驱动状态
8 ************************************************************************ */
9 #pragma INITCODE
10 extern " C " NTSTATUS DriverEntry (
11 IN PDRIVER_OBJECT pDriverObject,
12 IN PUNICODE_STRING pRegistryPath )
13 {
14 NTSTATUS ntStatus;
15 KdPrint(( " DriverB:Enter B DriverEntry\n " ));
16
17 // 注册其他驱动调用函数入口
18 pDriverObject -> DriverUnload = HelloDDKUnload;
19 pDriverObject -> MajorFunction[IRP_MJ_CREATE] = HelloDDKCreate;
20 pDriverObject -> MajorFunction[IRP_MJ_CLOSE] = HelloDDKClose;
21 pDriverObject -> MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
22 pDriverObject -> MajorFunction[IRP_MJ_READ] = HelloDDKRead;
23
24 // 创建驱动设备对象
25 ntStatus = CreateDevice(pDriverObject);
26
27 KdPrint(( " DriverB:Leave B DriverEntry\n " ));
28 return ntStatus;
29 }
30
31 /* ***********************************************************************
32 * 函数名称:CreateDevice
33 * 功能描述:初始化设备对象
34 * 参数列表:
35 pDriverObject:从I/O管理器中传进来的驱动对象
36 * 返回值:返回初始化状态
37 ************************************************************************ */
38 #pragma INITCODE
39 NTSTATUS CreateDevice (
40 IN PDRIVER_OBJECT pDriverObject)
41 {
42 NTSTATUS ntStatus;
43 PDEVICE_OBJECT pDevObj;
44 PDEVICE_EXTENSION pDevExt;
45
46 // 创建设备名称
47 UNICODE_STRING devName;
48 RtlInitUnicodeString( & devName,L " \\Device\\MyDDKDevicB " );
49
50 // 创建设备
51 ntStatus = IoCreateDevice( pDriverObject,
52 sizeof (DEVICE_EXTENSION),
53 & (UNICODE_STRING)devName,
54 FILE_DEVICE_UNKNOWN,
55 0 , TRUE,
56 & pDevObj );
57 if ( ! NT_SUCCESS(ntStatus))
58 return ntStatus;
59
60 pDevObj -> Flags |= DO_BUFFERED_IO;
61 pDevExt = (PDEVICE_EXTENSION)pDevObj -> DeviceExtension;
62 pDevExt -> pDevice = pDevObj;
63 pDevExt -> ustrDeviceName = devName;
64
65 // 创建符号链接
66 UNICODE_STRING symLinkName;
67 RtlInitUnicodeString( & symLinkName,L " \\??\\HelloDDKB " );
68 pDevExt -> ustrSymLinkName = symLinkName;
69 NTSTATUS status = IoCreateSymbolicLink( & symLinkName, & devName );
70 if ( ! NT_SUCCESS(status))
71 {
72 IoDeleteDevice( pDevObj );
73 return status;
74 }
75
76 return STATUS_SUCCESS;
77 }
78
79 /* ***********************************************************************
80 * 函数名称:HelloDDKUnload
81 * 功能描述:负责驱动程序的卸载操作
82 * 参数列表:
83 pDriverObject:驱动对象
84 * 返回值:返回状态
85 ************************************************************************ */
86 #pragma PAGEDCODE
87 VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
88 {
89 PDEVICE_OBJECT pNextObj;
90 KdPrint(( " DriverB:Enter B DriverUnload\n " ));
91 pNextObj = pDriverObject -> DeviceObject;
92
93 while (pNextObj != NULL)
94 {
95 PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
96 pNextObj -> DeviceExtension;
97
98 // 删除符号链接
99 UNICODE_STRING pLinkName = pDevExt -> ustrSymLinkName;
100 IoDeleteSymbolicLink( & pLinkName);
101 pNextObj = pNextObj -> NextDevice;
102 IoDeleteDevice( pDevExt -> pDevice );
103 }
104 KdPrint(( " DriverB:Enter B DriverUnload\n " ));
105 }
106
107 VOID CompleteDriverA_Read(PVOID context,PIO_STATUS_BLOCK pStatus_block,ULONG)
108 {
109 KdPrint(( " DriverB:The Driver A Read completed now!\n " ));
110 KeSetEvent((PKEVENT)context,IO_NO_INCREMENT,FALSE);
111 }
112
113 #pragma PAGEDCODE
114 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
115 IN PIRP pIrp)
116 {
117 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
118 NTSTATUS ntStatus = STATUS_SUCCESS;
119
120 UNICODE_STRING DeviceName;
121 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
122
123 // 初始化objectAttributes
124 OBJECT_ATTRIBUTES objectAttributes;
125 InitializeObjectAttributes( & objectAttributes,
126 & DeviceName,
127 OBJ_CASE_INSENSITIVE,
128 NULL,
129 NULL );
130
131 HANDLE hDevice;
132 IO_STATUS_BLOCK status_block;
133 // 异步打开设备
134 // 没有设定了FILE_SYNCHRONOUS_IO_NONALERT和FILE_SYNCHRONOUS_IO_ALERT为异步打开设备
135 ntStatus = ZwCreateFile( & hDevice,
136 FILE_READ_ATTRIBUTES, // 没有设SYNCHRONIZE
137 & objectAttributes,
138 & status_block,
139 NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
140 FILE_OPEN_IF, 0 ,NULL, 0 );
141
142 KEVENT event ;
143 // 初始化事件，用于异步读
144 KeInitializeEvent( & event ,SynchronizationEvent,FALSE);
145
146 LARGE_INTEGER offset = RtlConvertLongToLargeInteger( 0 );
147 if (NT_SUCCESS(ntStatus))
148 {
149 ntStatus = ZwReadFile(hDevice,NULL,CompleteDriverA_Read, & event , & status_block,NULL, 0 , & offset,NULL);
150 }
151
152 if (ntStatus == STATUS_PENDING)
153 {
154 KdPrint(( " DriverB:ZwReadFile return STATUS_PENDING!\n " ));
155 KdPrint(( " DriverB:Waiting... " ));
156 KeWaitForSingleObject( & event ,Executive,KernelMode,FALSE,NULL);
157 }
158 ZwClose(hDevice);
159
160 ntStatus = STATUS_SUCCESS;
161 // 完成IRP
162 pIrp -> IoStatus.Status = ntStatus;
163 pIrp -> IoStatus.Information = 0 ; // bytes xfered
164 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
165 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
166 return ntStatus;
167 }
168
169 /* ***********************************************************************
170 * 函数名称:HelloDDKDispatchRoutine
171 * 功能描述:对读IRP进行处理
172 * 参数列表:
173 pDevObj:功能设备对象
174 pIrp:从IO请求包
175 * 返回值:返回状态
176 ************************************************************************ */
177 #pragma PAGEDCODE
178 NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
179 IN PIRP pIrp)
180 {
181 KdPrint(( " DriverB:Enter B HelloDDKDispatchRoutine\n " ));
182 NTSTATUS ntStatus = STATUS_SUCCESS;
183 // 完成IRP
184 pIrp -> IoStatus.Status = ntStatus;
185 pIrp -> IoStatus.Information = 0 ; // bytes xfered
186 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
187 KdPrint(( " DriverB:Leave B HelloDDKDispatchRoutine\n " ));
188 return ntStatus;
189 }
190
191 #pragma PAGEDCODE
192 NTSTATUS HelloDDKCreate(IN PDEVICE_OBJECT pDevObj,
193 IN PIRP pIrp)
194 {
195 KdPrint(( " DriverB:Enter B HelloDDKCreate\n " ));
196 NTSTATUS ntStatus = STATUS_SUCCESS;
197 // 完成IRP
198 pIrp -> IoStatus.Status = ntStatus;
199 pIrp -> IoStatus.Information = 0 ; // bytes xfered
200 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
201
202 KdPrint(( " DriverB:Leave B HelloDDKCreate\n " ));
203
204 return ntStatus;
205 }
206
207 #pragma PAGEDCODE
208 NTSTATUS HelloDDKClose(IN PDEVICE_OBJECT pDevObj,
209 IN PIRP pIrp)
210 {
211 KdPrint(( " DriverB:Enter B HelloDDKClose\n " ));
212 NTSTATUS ntStatus = STATUS_SUCCESS;
213
214 PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pDevObj -> DeviceExtension;
215
216 // 完成IRP
217 pIrp -> IoStatus.Status = ntStatus;
218 pIrp -> IoStatus.Information = 0 ; // bytes xfered
219 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
220
221 KdPrint(( " DriverB:Leave B HelloDDKClose\n " ));
222
223 return ntStatus;
224 }

异步方式一示例代码 P298

说明 MSDN中ApcRoutine是保留参数，应当设为NULL。本例中，直接可将Event参数设置即可，不需要再整一个函数，就可达到目的。由于本例只是说明问题，摘自别人的代码，也就没有改动。

代码

1 #pragma PAGEDCODE
2 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
3 IN PIRP pIrp)
4 {
5 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
6 NTSTATUS ntStatus = STATUS_SUCCESS;
7
8 UNICODE_STRING DeviceName;
9 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
10
11 // 初始化objectAttributes
12 OBJECT_ATTRIBUTES objectAttributes;
13 InitializeObjectAttributes( & objectAttributes,
14 & DeviceName,
15 OBJ_CASE_INSENSITIVE,
16 NULL,
17 NULL );
18
19 HANDLE hDevice;
20 IO_STATUS_BLOCK status_block;
21
22 // 异步打开设备
23 ntStatus = ZwCreateFile( & hDevice,
24 FILE_READ_ATTRIBUTES, // 没有设SYNCHRONIZE
25 & objectAttributes,
26 & status_block,
27 NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
28 FILE_OPEN_IF, 0 ,NULL, 0 );
29
30 LARGE_INTEGER offset = RtlConvertLongToLargeInteger( 0 );
31 if (NT_SUCCESS(ntStatus))
32 {
33 ntStatus = ZwReadFile(hDevice,NULL,NULL,NULL, & status_block,NULL, 0 , & offset,NULL);
34 }
35
36 if (ntStatus == STATUS_PENDING)
37 {
38 KdPrint(( " DriverB:ZwReadFile return STATUS_PENDING!\n " ));
39
40 PFILE_OBJECT FileObject;
41 ntStatus = ObReferenceObjectByHandle(hDevice, EVENT_MODIFY_STATE, * ExEventObjectType,
42 KernelMode, (PVOID * ) & FileObject, NULL);
43 if (NT_SUCCESS(ntStatus))
44 {
45 KdPrint(( " DriverB:Waiting... " ));
46 KeWaitForSingleObject( & FileObject -> Event,Executive,KernelMode,FALSE,NULL);
47 KdPrint(( " DriverB:Driver A Read IRP completed now!\n " ));
48 ObDereferenceObject(FileObject);
49 }
50 }
51 ZwClose(hDevice);
52
53 ntStatus = STATUS_SUCCESS;
54 // 完成IRP
55 pIrp -> IoStatus.Status = ntStatus;
56 pIrp -> IoStatus.Information = 0 ; // bytes xfered
57 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
58 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
59 return ntStatus;
60 }

异步方式二示例代码 P298

说明：方式一通过将一个事件句柄传递给ZwReadFile，这个事件用来通知读取操作何时完成。方式二原理是：通过文件对象判断读取是否完毕；每打开一个设备，都会伴随存在一个关联的文件对象，利用ObReferenceObjectByHandle获取文件对象指针；当IRP_MJ_READ请求被结束后，文件对象的子域Event会被设备，因此可以用文件对象的子域进行判断。

2）通过符号链接打开设备

如何由符号链接得到设备名？

通过ZwOpenSymbolicLinkObject来得到符号链接的句柄，再通过ZwQuerySymbolicLinkObject来得到设备名。

代码

1 #pragma PAGEDCODE
2 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
3 IN PIRP pIrp)
4 {
5 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
6 NTSTATUS ntStatus = STATUS_SUCCESS;
7
8 UNICODE_STRING DeviceSymbolicLinkName;
9 RtlInitUnicodeString( & DeviceSymbolicLinkName, L " \\??\\HelloDDKA " );
10
11 // 初始化objectAttributes
12 OBJECT_ATTRIBUTES objectAttributes;
13 InitializeObjectAttributes( & objectAttributes,
14 & DeviceSymbolicLinkName,
15 OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
16 NULL,
17 NULL );
18
19 HANDLE hSymbolic;
20 // 设定了FILE_SYNCHRONOUS_IO_NONALERT或者FILE_SYNCHRONOUS_IO_ALERT为同步打开设备
21 ntStatus = ZwOpenSymbolicLinkObject( & hSymbolic,FILE_ALL_ACCESS, & objectAttributes);
22 #define UNICODE_SIZE 50
23 UNICODE_STRING LinkTarget;
24 LinkTarget.Buffer = (PWSTR)ExAllocatePool(PagedPool,UNICODE_SIZE);
25 LinkTarget.Length = 0 ;
26 LinkTarget.MaximumLength = UNICODE_SIZE;
27
28 ULONG unicode_length;
29 ntStatus = ZwQuerySymbolicLinkObject(hSymbolic, & LinkTarget, & unicode_length);
30
31 KdPrint(( " DriverB:The device name is %wZ\n " , & LinkTarget));
32
33 InitializeObjectAttributes( & objectAttributes,
34 & LinkTarget,
35 OBJ_CASE_INSENSITIVE,
36 NULL,
37 NULL );
38
39 HANDLE hDevice;
40 IO_STATUS_BLOCK status_block;
41 // 设定了FILE_SYNCHRONOUS_IO_NONALERT或者FILE_SYNCHRONOUS_IO_ALERT为同步打开设备
42 ntStatus = ZwCreateFile( & hDevice,
43 FILE_READ_ATTRIBUTES | SYNCHRONIZE,
44 & objectAttributes,
45 & status_block,
46 NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_READ,
47 FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL, 0 );
48
49 if (NT_SUCCESS(ntStatus))
50 {
51 ZwReadFile(hDevice,NULL,NULL,NULL, & status_block,NULL, 0 ,NULL,NULL);
52 }
53
54 ZwClose(hDevice);
55 ZwClose(hSymbolic);
56 ExFreePool(LinkTarget.Buffer);
57
58 ntStatus = STATUS_SUCCESS;
59 // 完成IRP
60 pIrp -> IoStatus.Status = ntStatus;
61 pIrp -> IoStatus.Information = 0 ; // bytes xfered
62 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
63 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
64 return ntStatus;
65 }

示例代码 P302

2、通过设备指针调用其他驱动程序

调用驱动程序

ZwReadFile内核函数内部会创建IRP_MJ_READ类型的IRP，然后把这个IRP传递到相应的派遣函数中。这一小节中，我们是通过自己“手动”构造各个IRP，然后将IRP传递到相应的驱动程序的派遣函数中。

2、通过IoGetDeviceObjectPointer 来获得设备指针。

1）每个内核中的句柄都会和一个内核对象的指针联系起来。如ZwCreateFile内核函数可以通过设备名打开设备句柄，这个句柄和一个文件对象的指针关联。IoGetDeviceObjectPointer 可以通过设备名获得文件对象指针。

Windows内核会为每一个对象指针保存一个“引用计数”，对象被创建时引用计数为1。引用这个对象，引用计数加1。只有引用对象为0时，对象才能被真正删除。ObDereferenceObject 来使引用计数减一。

第一次调用IoGetDeviceObjectPointer 时，会根据设备名打开设备，计数为1，相当于对对象发送IRP_MJ_CREATE。使用完后调用ObDereferenceObject最终关闭设备时，相当于发送IRP_MJ_CLOSE。

2）共有如下几种方法，IoBuildSynchronousFsdRequest ，IoBuildAsynchronousFsdRequest ，IoBuildDeviceIoControlRequest ，IoAllocateIrp 来创建IRP。前3种都是通过IoAllocateIrp 实现的。创建完IRP后，还有构建IRP的I/O堆栈，每层I/O堆栈对应一个设备对象。最后通过IoCallDriver 调用相应的驱动。

总结一下，步骤为：

先得到设备的指针-》通过设备指针创建RIP-》构造I/O堆栈-》调用IoCallDriver 。

（1）IoBuildSynchronousFsdRequest

IoBuildSynchronousFsdRequest 与IoBuildAsynchronousFsdRequest 的区别就是是否提供同步对象。事件会和IRP请求相关联，当IRP请求结束时该事件被触发。

Intermediate or highest-level drivers can call IoBuildSynchronousFsdRequest to set up IRPs for requests sent to lower-level drivers, only if the caller is running in a nonarbitrary thread context and at IRQL = PASSIVE_LEVEL.

IoBuildSynchronousFsdRequest allocates and sets up an IRP that can be sent to a device driver to perform a synchronous read, write, flush, or shutdown operation. The IRP contains only enough information to get the operation started.

IoBuildSynchronousFsdRequest returns a pointer to the IRP, or NULL if an IRP cannot be allocated.

代码

1 #pragma PAGEDCODE
2 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
3 IN PIRP pIrp)
4 {
5 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
6 NTSTATUS ntStatus = STATUS_SUCCESS;
7
8 UNICODE_STRING DeviceName;
9 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
10
11 PDEVICE_OBJECT DeviceObject = NULL;
12 PFILE_OBJECT FileObject = NULL;
13 // 得到设备对象句柄，计数器加1
14 // 如果是第一次调用IoGetDeviceObjectPointer，会打开设备，相当于调用ZwCreateFile
15 ntStatus = IoGetDeviceObjectPointer( & DeviceName,FILE_ALL_ACCESS, & FileObject, & DeviceObject);
16
17 KdPrint(( " DriverB:FileObject:%x\n " ,FileObject));
18 KdPrint(( " DriverB:DeviceObject:%x\n " ,DeviceObject));
19
20 if ( ! NT_SUCCESS(ntStatus))
21 {
22 KdPrint(( " DriverB:IoGetDeviceObjectPointer() 0x%x\n " , ntStatus ));
23
24 ntStatus = STATUS_UNSUCCESSFUL;
25 // 完成IRP
26 pIrp -> IoStatus.Status = ntStatus;
27 pIrp -> IoStatus.Information = 0 ; // bytes xfered
28 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
29 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
30
31 return ntStatus;
32 }
33
34 KEVENT event ;
35 KeInitializeEvent( & event ,NotificationEvent,FALSE);
36 IO_STATUS_BLOCK status_block;
37 LARGE_INTEGER offsert = RtlConvertLongToLargeInteger( 0 );
38
39 // 创建同步IRP
40 PIRP pNewIrp = IoBuildSynchronousFsdRequest(IRP_MJ_READ,
41 DeviceObject,
42 NULL, 0 ,
43 & offsert, & event , & status_block);
44 KdPrint(( " DriverB:pNewIrp:%x\n " ,pNewIrp));
45
46 PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(pNewIrp);
47 stack -> FileObject = FileObject;
48
49 // 调用DriverA，会一直调用到DriverA的派遣函数
50 NTSTATUS status = IoCallDriver(DeviceObject,pNewIrp);
51
52 if (status == STATUS_PENDING) {
53
54 // 如果DriverA的派遣函数没有完成IRP，则等待IRP完成
55 status = KeWaitForSingleObject(
56 & event ,
57 Executive,
58 KernelMode,
59 FALSE, // Not alertable
60 NULL);
61 status = status_block.Status;
62 }
63
64 // 将引用计数减1，如果此时计数器减为0，
65 // 则将关闭设备，相当于调用ZwClose
66 ObDereferenceObject( FileObject );
67
68
69 ntStatus = STATUS_SUCCESS;
70 // 完成IRP
71 pIrp -> IoStatus.Status = ntStatus;
72 pIrp -> IoStatus.Information = 0 ; // bytes xfered
73 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
74 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
75 return ntStatus;
76 }

示例代码 P306

另外，The IoGetCurrentIrpStackLocation routine returns a pointer to the caller’s stack location in the given IRP，IoGetNextIrpStackLocation returns a pointer to the next-lower-level driver's I/O stack location in the given IRP。

（2）IoBuildAsynchronousFsdRequest

可以通过IRP的 UserEvent子域来通知IRP请求的结束。调用IoBuildAsynchronousFsdRequest 创建IRP后，如果希望同步，即希望得到IRP被结束的通知，则需要设备UserEvent。当执行IoCompleteRequest时，OS会检查 IRP的UserEvent子域，如果非空，则它代表一个事件指针，IoCompleteRequest会设备这个事件。

代码

1 #pragma PAGEDCODE
2 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
3 IN PIRP pIrp)
4 {
5 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
6 NTSTATUS ntStatus = STATUS_SUCCESS;
7
8 UNICODE_STRING DeviceName;
9 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
10
11 PDEVICE_OBJECT DeviceObject = NULL;
12 PFILE_OBJECT FileObject = NULL;
13 // 得到设备对象指针
14 ntStatus = IoGetDeviceObjectPointer( & DeviceName,FILE_ALL_ACCESS, & FileObject, & DeviceObject);
15
16 KdPrint(( " DriverB:FileObject:%x\n " ,FileObject));
17 KdPrint(( " DriverB:DeviceObject:%x\n " ,DeviceObject));
18
19 if ( ! NT_SUCCESS(ntStatus))
20 {
21 KdPrint(( " DriverB:IoGetDeviceObjectPointer() 0x%x\n " , ntStatus ));
22
23 ntStatus = STATUS_UNSUCCESSFUL;
24 // 完成IRP
25 pIrp -> IoStatus.Status = ntStatus;
26 pIrp -> IoStatus.Information = 0 ; // bytes xfered
27 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
28 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
29
30 return ntStatus;
31 }
32
33 KEVENT event ;
34 KeInitializeEvent( & event ,NotificationEvent,FALSE);
35 IO_STATUS_BLOCK status_block;
36 LARGE_INTEGER offsert = RtlConvertLongToLargeInteger( 0 );
37
38 // 创建异步IRP
39 PIRP pNewIrp = IoBuildAsynchronousFsdRequest(IRP_MJ_READ,
40 DeviceObject,
41 NULL, 0 ,
42 & offsert, & status_block);
43 KdPrint(( " pNewIrp->UserEvent :%x\n " ,pNewIrp -> UserEvent));
44 // 设置pNewIrp->UserEvent，这样在IRP完成后可以通知该事件
45 pNewIrp -> UserEvent = & event ;
46
47 KdPrint(( " DriverB:pNewIrp:%x\n " ,pNewIrp));
48
49 PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(pNewIrp);
50 stack -> FileObject = FileObject;
51
52 NTSTATUS status = IoCallDriver(DeviceObject,pNewIrp);
53
54 if (status == STATUS_PENDING) {
55 status = KeWaitForSingleObject(
56 & event ,
57 Executive,
58 KernelMode,
59 FALSE, // Not alertable
60 NULL);
61 status = status_block.Status;
62 }
63
64 ZwClose(FileObject);
65
66 // 关闭设备句柄
67 ObDereferenceObject( FileObject );
68
69 ntStatus = STATUS_SUCCESS;
70 // 完成IRP
71 pIrp -> IoStatus.Status = ntStatus;
72 pIrp -> IoStatus.Information = 0 ; // bytes xfered
73 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
74 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
75 return ntStatus;
76 }

示例代码 P309

（3）IoAllocateIrp

CreateFile,ZwCreateFile 等，都直接或间接的调用了IoAllocateIrp 。所以对设备的操作都会转化一个IRP，IRP会在驱动中被处理；IRP请求被结束，代表操作结束，IRP的完成状态就是操作的完成状态。所有的IRP最终都是由IoAllocateIrp 内核函数创建的。

整个Windows是个异步的框架，同步只是异步的一个特例；就像静止只是运行的一个特例一样。

IoAllocateIrp 创建IRP后，许多参数，如缓冲区等，用户自己填写。最终需要用IoFreeIrp删除IRP对象。

代码

1 #pragma PAGEDCODE
2 NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
3 IN PIRP pIrp)
4 {
5 KdPrint(( " DriverB:Enter B HelloDDKRead\n " ));
6 NTSTATUS ntStatus = STATUS_SUCCESS;
7
8 UNICODE_STRING DeviceName;
9 RtlInitUnicodeString( & DeviceName, L " \\Device\\MyDDKDeviceA " );
10
11 PDEVICE_OBJECT DeviceObject = NULL;
12 PFILE_OBJECT FileObject = NULL;
13 // 得到设备对象指针
14 ntStatus = IoGetDeviceObjectPointer( & DeviceName,FILE_ALL_ACCESS, & FileObject, & DeviceObject);
15
16 KdPrint(( " DriverB:FileObject:%x\n " ,FileObject));
17 KdPrint(( " DriverB:DeviceObject:%x\n " ,DeviceObject));
18
19 if ( ! NT_SUCCESS(ntStatus))
20 {
21 KdPrint(( " DriverB:IoGetDeviceObjectPointer() 0x%x\n " , ntStatus ));
22 ntStatus = STATUS_UNSUCCESSFUL;
23 // 完成IRP
24 pIrp -> IoStatus.Status = ntStatus;
25 pIrp -> IoStatus.Information = 0 ; // bytes xfered
26 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
27 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
28
29 return ntStatus;
30 }
31
32 KEVENT event ;
33 KeInitializeEvent( & event ,NotificationEvent,FALSE);
34
35 PIRP pNewIrp = IoAllocateIrp(DeviceObject -> StackSize,FALSE);
36 KdPrint(( " pNewIrp->UserEvent :%x\n " ,pNewIrp -> UserEvent));
37 pNewIrp -> UserEvent = & event ;
38
39 IO_STATUS_BLOCK status_block;
40 pNewIrp -> UserIosb = & status_block;
41 pNewIrp -> Tail.Overlay.Thread = PsGetCurrentThread();
42
43 // 因为DriverA是BUFFER IO设备
44 pNewIrp -> AssociatedIrp.SystemBuffer = NULL;
45
46 KdPrint(( " DriverB:pNewIrp:%x\n " ,pNewIrp));
47
48 PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(pNewIrp);
49 stack -> MajorFunction = IRP_MJ_READ;
50 stack -> MinorFunction = IRP_MN_NORMAL; // 0
51 stack -> FileObject = FileObject;
52
53 // 调用DriverA驱动
54 NTSTATUS status = IoCallDriver(DeviceObject,pNewIrp);
55
56 if (status == STATUS_PENDING) {
57 status = KeWaitForSingleObject(
58 & event ,
59 Executive,
60 KernelMode,
61 FALSE, // Not alertable
62 NULL);
63 KdPrint(( " STATUS_PENDING\n " ));
64 }
65
66 ObDereferenceObject( FileObject );
67 IoFreeIrp(pNewIrp);
68
69 ntStatus = STATUS_SUCCESS;
70 // 完成IRP
71 pIrp -> IoStatus.Status = ntStatus;
72 pIrp -> IoStatus.Information = 0 ; // bytes xfered
73 IoCompleteRequest( pIrp, IO_NO_INCREMENT );
74 KdPrint(( " DriverB:Leave B HelloDDKRead\n " ));
75 return ntStatus;
76 }

示例代码 P314

3、其他方法获得设备指针

ObReferenceObjectByName 是一个未公开的函数。ObReferenceObjectByName通过名字得到指针，而操作类型可以是设备对象，内核对象，互斥事件等；而 IoGetDeviceObjectPointer 只能得到设备对象指针。同样，ObReferenceObjectByName也维护了一个设备对象的引用计数，使用完后，也需要调用 ObDereferenceObject来使引用计数减一。

代码

示例代码 P316

weixin_33811539

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
30、驱动程序调用驱动程序

有两种方法，一种是以文件句柄的形式，另外一种是通过设备指针调用其它驱动程序。1、以文件句柄形式调用1）应用程序调用驱动A 调用驱动B这种方法类似于在应用程序中调用驱动程序。在应用程序中用CreateFile，ReadFile,CloseHandle来操作相应文件，驱动中用ZwCreateFile,ZwReadFile,Irp结束操作。要注意：ZwCrea...
复制链接

扫一扫