Windows驱动开发-使用内存模拟文件读写

// 驱动代码
#include <ntddk.h>

#define MAX_FILE_LEN 4096

// 设备扩展结构体
typedef struct _FileExtend
{
   
	PCHAR Buffer;
	ULONG Length;
} FileExtend, *PFileExtend;

// 卸载函数
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);

// 派遣函数-基本操作
NTSTATUS DispatchGeneric(IN PDEVICE_OBJECT DeviceObject, PIRP Irp);

// 派遣函数-读操作
NTSTATUS DispatchRead(IN PDEVICE_OBJECT DeviceObject, PIRP Irp);

// 派遣函数-写操作
NTSTATUS DispatchWrite(IN PDEVICE_OBJECT DeviceObject, PIRP Irp);

// 派遣函数-查询大小
NTSTATUS DispatchQueryInfo(IN PDEVICE_OBJECT DeviceObject, PIRP Irp);

// 入口函数
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
   
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING deviceName = RTL_CONSTANT_STRING(L"\\Device\\FileOperation");
	UNICODE_STRING deviceSymbolicLinkName = RTL_CONSTANT_STRING(L"\\??\\FileOperation");
	PDEVICE_OBJECT DeviceObject = NULL;
	ULONG sub = 0;
	PFileExtend FileExtend = NULL;

	UNREFERENCED_PARAMETER(RegistryPath);
	KdPrint(("驱动加载\n"));

	// 设置常规派遣函数
	for (sub = 0; sub <= IRP_MJ_MAXIMUM_FUNCTION; sub++)
	{
   
		DriverObject->MajorFunction[sub] = DispatchGeneric;
	}

	// 设置读操作
	DriverObject->MajorFunction[IRP_MJ_READ] = DispatchRead;

	// 设置写操作
	DriverObject->MajorFunction[IRP_MJ_WRITE] = DispatchWrite;

	// 查询操作
	DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = DispatchQueryInfo;

	// 创建设备
	status = IoCreateDevice(DriverObject, sizeof(FileExtend), &deviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &DeviceObject);
	if (!NT_SUCCESS(status))
	{
   
		KdPrint(("创建设备失败:%x\n", status));
		return status;
	}