使用设备对象指针来进行驱动调用驱动

// dest
#include <ntddk.h>

// 卸载函数
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("驱动卸载\n"));
	UNREFERENCED_PARAMETER(pDriverObject);

	UNICODE_STRING DevSymbolicLinkName = { 0 };
	RtlInitUnicodeString(&DevSymbolicLinkName, L"\\??\\DeviceObjectPointer");

	IoDeleteSymbolicLink(&DevSymbolicLinkName);

	if (pDriverObject->DeviceObject != NULL)
	{
		IoDeleteDevice(pDriverObject->DeviceObject);
	}
}

// 入口函数
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	PDEVICE_OBJECT pDevObj = NULL;
	UNICODE_STRING DevName = { 0 };
	UNICODE_STRING DevSymbolicLinkName = { 0 };

	KdPrint(("驱动加载\n"));
	UNREFERENCED_PARAMETER(pRegistryPath);

	RtlInitUnicodeString(&DevName, L"\\Device\\DeviceObjectPointer");
	RtlInitUnicodeString(&DevSymbolicLinkName, L"\\??\\DeviceObjectPointer");

	status = IoCreateDevice(pDriverObject, 0, &DevName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDevObj);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("创建设备失败:%x\n", status));
		return status;
	}

	status = IoCreateSymbolicLink(&DevSymbolicLinkName, &DevName);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("创建符号链接失败:%x\n", status));
		IoDeleteDevice(pDevObj);
		return status;
	}

	pDevObj->Flags |= DO_BUFFERED_IO;
	pDevObj->Flags &= ~DO_DEVICE_INITIALIZING;

	pDriverObject->DriverUnload = DriverUnload;


	return status;
}

// test
#include <ntddk.h>

// 卸载函数
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("卸载函数\n"));
	UNREFERENCED_PARAMETER(pDriverObject);
}

// 测试函数-同步
VOID CallDriverTestSync()
{
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING DevName = { 0 };
	OBJECT_ATTRIBUTES oa = { 0 };
	IO_STATUS_BLOCK block = { 0 };
	KEVENT Event = { 0 };
	LARGE_INTEGER offset = RtlConvertLongToLargeInteger(0);
	PDEVICE_OBJECT pDevObj = NULL;
	PFILE_OBJECT pFileObj = NULL;
	PIRP pIrp = NULL;
	PIO_STACK_LOCATION stack = NULL;

	RtlInitUnicodeString(&DevName, L"\\Device\\DeviceObjectPointer");
	InitializeObjectAttributes(&oa, &DevName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

	status = IoGetDeviceObjectPointer(&DevName, FILE_ANY_ACCESS, &pFileObj, &pDevObj);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("获取设备对象指针失败:%x\n", status));
		return;
	}

	KeInitializeEvent(&Event, SynchronizationEvent, FALSE);

	pIrp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, pDevObj, NULL, 0, &offset, &Event, &block);
	stack = IoGetNextIrpStackLocation(pIrp);
	stack->FileObject = pFileObj;

	status = IoCallDriver(pDevObj, pIrp);
	if (status == STATUS_PENDING)
	{
		KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);
		KdPrint(("读操作完成\n"));
	}

	ObDereferenceObject(pFileObj);
}

// 测试函数-异步
VOID CallDriverTestASync()
{
	NTSTATUS status = STATUS_SUCCESS;
	UNICODE_STRING DevName = { 0 };
	OBJECT_ATTRIBUTES oa = { 0 };
	IO_STATUS_BLOCK block = { 0 };
	KEVENT Event = { 0 };
	LARGE_INTEGER offset = RtlConvertLongToLargeInteger(0);
	PDEVICE_OBJECT pDevObj = NULL;
	PFILE_OBJECT pFileObj = NULL;
	PIRP pIrp = NULL;
	PIO_STACK_LOCATION stack = NULL;

	RtlInitUnicodeString(&DevName, L"\\Device\\DeviceObjectPointer");
	InitializeObjectAttributes(&oa, &DevName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);

	status = IoGetDeviceObjectPointer(&DevName, FILE_ANY_ACCESS, &pFileObj, &pDevObj);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("获取设备对象指针失败:%x\n", status));
		return;
	}

	KeInitializeEvent(&Event, SynchronizationEvent, FALSE);

	pIrp = IoBuildAsynchronousFsdRequest(IRP_MJ_READ, pDevObj, NULL, 0, &offset, &block);
	pIrp->UserEvent = &Event;
	stack = IoGetNextIrpStackLocation(pIrp);
	stack->FileObject = pFileObj;

	status = IoCallDriver(pDevObj, pIrp);
	if (NT_SUCCESS(status))
	{
		if (status == STATUS_PENDING)
		{
			KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);
			KdPrint(("读操作完成\n"));
		}
	}
	else
	{
		KdPrint(("失败:%x\n", status));
	}


	ObDereferenceObject(pFileObj);
}

// 入口函数
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	NTSTATUS status = STATUS_SUCCESS;

	KdPrint(("驱动加载\n"));
	UNREFERENCED_PARAMETER(pRegistryPath);

	pDriverObject->DriverUnload = DriverUnload;

	return status;
}