windows10驱动 x64--- 3环代码加载驱动（二）

一：了解驱动加载工具

平时调试.sys 我们都是用的驱动加载工具：open（打开驱动文件） —start（加载驱动） —stop（卸载驱动）—remove service（删除所在驱动的服务表）

这些驱动加载工具也是用代码实现的，如下示例

二：应用层–3环代码示例

#define _CRT_SECURE_NO_WARNINGS
#include <iostream>
#include <Windows.h>

#define DRIVER_NAME L"MyDriverHello"  
#define DRIVER_PATH L"MyDriverHello.sys"


BOOL DriverLoad(PCWSTR DriverName, PCWSTR DriverPath)
{
	//1 获取驱动完整路径
	WCHAR szDriverFullPath[MAX_PATH] = { 0 };
	GetFullPathNameW(DriverPath, MAX_PATH, szDriverFullPath, NULL);//根据驱动名获取完整路径
	std::wcout << szDriverFullPath << std::endl;
	//2 获取SCM管理器句柄
	SC_HANDLE hServiceMgr = NULL; // 初始化SCM管理器句柄	
	hServiceMgr = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);// 打开服务控制管理器获取SCM管理器句柄
	if (NULL == hServiceMgr)
	{
		std::cout << "OpenSCManagerW 失败:" << GetLastError() <<std::endl;
		return FALSE;
	}
	std::cout << "获取SCM管理器句柄成功并打开了SCM" << std::endl;



	//3 获取NT驱动程序服务句柄
	SC_HANDLE hServiceDDK = NULL; // NT驱动程序服务句柄
	hServiceDDK = CreateServiceW(
		hServiceMgr,
		DriverName,
		DriverName,
		SERVICE_ALL_ACCESS,
		SERVICE_KERNEL_DRIVER,
		SERVICE_DEMAND_START,
		SERVICE_ERROR_IGNORE,
		szDriverFullPath,
		NULL,
		NULL,
		NULL,
		NULL,
		NULL);

	if (NULL == hServiceDDK)
	{
		DWORD dwErr = GetLastError();
		if (dwErr != ERROR_IO_PENDING && dwErr != ERROR_SERVICE_EXISTS)
		{
			printf("创建驱动服务失败, %d\n", dwErr);
			return FALSE;
		}
	}
	std::cout << "把驱动放入了驱动服务中" << std::endl;


	// 打开指定驱动lpszDriverName获取到SC_HANDLE句柄
	hServiceDDK = OpenServiceW(hServiceMgr, DriverName, SERVICE_ALL_ACCESS);

	// go 开始运行驱动
	bool btmp = StartService(hServiceDDK, NULL, NULL);
	if (!btmp)
	{
		DWORD dwErr = GetLastError();
		if (dwErr != ERROR_SERVICE_ALREADY_RUNNING)
		{

			std::cout << "运行驱动服务失败:" << dwErr <<std::endl;
			return FALSE;
		}
	}
	std::cout << "运行驱动服务成功"<< std::endl;
	if (hServiceDDK)
	{
		CloseServiceHandle(hServiceDDK);
	}
	if (hServiceMgr)
	{
		CloseServiceHandle(hServiceMgr);
	}
	return TRUE;
}

void UnLoadDriver(PCWSTR lpszDriverName)
{
	SC_HANDLE hServiceMgr = OpenSCManagerW(0, 0, SC_MANAGER_ALL_ACCESS);
	SC_HANDLE hServiceDDK = OpenServiceW(hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS);
	SERVICE_STATUS SvrStatus;
	ControlService(hServiceDDK, SERVICE_CONTROL_STOP, &SvrStatus);
	DeleteService(hServiceDDK);
	if (hServiceDDK)
	{
		CloseServiceHandle(hServiceDDK);
	}
	if (hServiceMgr)
	{
		CloseServiceHandle(hServiceMgr);
	}
}

int main()
{
	if (!DriverLoad(DRIVER_NAME, DRIVER_PATH))
	{

		std::cout << "加载驱动失败" << std::endl;
		getchar();
		return -1;
	}
	getchar();
	UnLoadDriver(DRIVER_NAME);

	getchar();
	return 0;
}