驱动线程与事件

创建线程

NTSTATUS PsCreateSystemThread
(
    _Out_ PHANDLE ThreadHandle,							//句柄指针
    _In_ ULONG DesiredAccess,							//0
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes		//NULL
    _In_opt_  HANDLE ProcessHandle,						//NULL
    _Out_opt_ PCLIENT_ID ClientId,						//NULL
    _In_ PKSTART_ROUTINE StartRoutine,					//线程函数
    _In_opt_ PVOID StartContext							//传入线程的指针
    );

初始化事件

VOID
KeInitializeEvent (
    _Out_ PRKEVENT Event,		//初始化的事件
    _In_ EVENT_TYPE Type,		//事件类型
    _In_ BOOLEAN State			//初始化状态一般为	FALSE
    );

//等待事件(阻塞)

NTSTATUS KeWaitForSingleObject(
  _In_     PVOID           Object,			//事件
  _In_     KWAIT_REASON    WaitReason,		//Executive
  _In_     KPROCESSOR_MODE WaitMode,		//KernelMode
  _In_     BOOLEAN         Alertable,		//0
  _In_opt_ PLARGE_INTEGER  Timeout			//0
);

设置事件

LONG
KeSetEvent (
    _Inout_ PRKEVENT Event,			//要设置的事件
    _In_ KPRIORITY Increment,		//提示优先权
    _In_ _Literal_ BOOLEAN Wait		//修改状态	TRUE阻塞那就会执行
    );

案例

#include<ntddk.h>

//定义一个事件
static KEVENT g_event;

VOID Sleep(LONG msec)
{
	LARGE_INTEGER My_interval;
	My_interval.QuadPart = (-10 * 1000);
	My_interval.QuadPart *= msec;
	KeDelayExecutionThread(KernelMode, 0, &My_interval);
}

//线程回调
VOID ThreadProc(PVOID context)
{
	PUNICODE_STRING str = (PUNICODE_STRING)context;
	
	for (size_t i = 0; i < 10; i++)
	{
		KdPrint(("%wZ	%d\n", str, i));
		Sleep(1000);
	}

	//设置事件(设置后等待那立马会执行)
	KeSetEvent(&g_event, 0, TRUE);

	//结束自身
	PsTerminateSystemThread(STATUS_SUCCESS);
}


VOID MyThreadProc()
{

	UNICODE_STRING str = RTL_CONSTANT_STRING(L"Hello");
	HANDLE hThread = NULL;
	

	//初始化事件
	KeInitializeEvent(&g_event, SynchronizationEvent, FALSE);

	//创建线程
	NTSTATUS status = PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, (PKSTART_ROUTINE)ThreadProc, (PVOID)&str);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("CreateThread error!\n"));

		if (hThread != NULL)
			ZwClose(hThread);
		return;
	}
	ZwClose(hThread);


	//等待事件(阻塞)
	KeWaitForSingleObject(&g_event, Executive, KernelMode, 0, 0);

	//等待
	KdPrint(("完毕\n"));

}

//卸载
VOID MyUnload(PDRIVER_OBJECT pDriverObject)
{

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pUnicodeString)
{
	MyThreadProc();

	
	pDriverObject->DriverUnload = MyUnload;
	return STATUS_SUCCESS;
}