WDM模式驱动简单例子

代码：

///
///
/// Copyright (c) 2014 - <company name here>
///
/// Original filename: HelloWdm.cpp
/// Project          : HelloWdm
/// Date of creation : 2014-07-02
/// Author(s)        : <author name(s)>
///
/// Purpose          : <description>
///
/// Revisions:
///  0000 [2014-07-02] Initial revision.
///
///

// $Id$

#ifdef __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef __cplusplus
}; // extern "C"
#endif

#include "HelloWdm.h"

static const GUID WdmHello1 = { 0xf8f8064c, 0xee05, 0x41ea, { 0x99, 0xd5, 0x55, 0x36, 0x5a, 0xb8, 0x17, 0x18 } };
// {F8F8064C-EE05-41ea-99D5-55365AB81718}

/*
#ifdef __cplusplus
namespace { // anonymous namespace to limit the scope of this global variable!
#endif
PDRIVER_OBJECT pdoGlobalDrvObj = 0;
#ifdef __cplusplus
}; // anonymous namespace
#endif*/


typedef struct _DEVICE_EXTENSION 
{
	PDEVICE_OBJECT pFdo;
	PDEVICE_OBJECT pNextStackDev;
	UNICODE_STRING interfaceName;

}DEVICE_EXTENSION,*PDEVICE_EXTENSION;


NTSTATUS HELLOWDM_DispatchCreateClose(
    IN PDEVICE_OBJECT		DeviceObject,
    IN PIRP					Irp
    )
{
    NTSTATUS status = STATUS_SUCCESS;
    Irp->IoStatus.Status = status;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

NTSTATUS HELLOWDM_DispatchDeviceControl(
    IN PDEVICE_OBJECT		DeviceObject,
    IN PIRP					Irp
    )
{
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

    switch(irpSp->Parameters.DeviceIoControl.IoControlCode)
    {
    case IOCTL_HELLOWDM_OPERATION:
        // status = SomeHandlerFunction(irpSp);
        break;
    default:
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        Irp->IoStatus.Information = 0;
        break;
    }

    status = Irp->IoStatus.Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

VOID HELLOWDM_DriverUnload(
    IN PDRIVER_OBJECT		DriverObject
    )
{
    KdPrint(("HELLOWDM_DriverUnload...."));
}



NTSTATUS HelloWdmAddDevice(PDRIVER_OBJECT pDriverObj,PDEVICE_OBJECT pPhysicalDeviceObj)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	PDEVICE_OBJECT pFdo;

	status = IoCreateDevice(pDriverObj,sizeof(DEVICE_EXTENSION),NULL,FILE_DEVICE_UNKNOWN,0,FALSE,&pFdo);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("IoCreateDevice Error:0x%x",status));
		return status;
	}

	PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pFdo->DeviceExtension;
	pDevExt->pFdo =   pFdo;

	pDevExt->pNextStackDev = IoAttachDeviceToDeviceStack(pFdo,pPhysicalDeviceObj);
	if (pDevExt->pNextStackDev == NULL)
	{
		KdPrint(("IoAttachDeviceToDeviceStack Error:0x%x",status));
		IoDeleteDevice(pFdo);
		return status;
	}


	status = IoRegisterDeviceInterface(pPhysicalDeviceObj,&WdmHello1,NULL,&pDevExt->interfaceName);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("IoRegisterDeviceInterface Error:0x%x",status));
		IoDeleteDevice(pFdo);
		return status;
	}

	KdPrint(("%wZ\n",&pDevExt->interfaceName));

	status = IoSetDeviceInterfaceState(&pDevExt->interfaceName,TRUE);
	if (!NT_SUCCESS(status))
	{
		KdPrint(("IoSetDeviceInterfaceState Error:0x%x",status));
		IoDeleteDevice(pFdo);
		return status;

	}


	//设置缓冲区方式
	pFdo->Flags |= DO_BUFFERED_IO | DO_POWER_PAGABLE;
	pFdo->Flags &= ~DO_DEVICE_INITIALIZING;


	return status;

}



#pragma  code_seg("PAGE")
NTSTATUS DefaultPnpHandler(PDEVICE_EXTENSION pdx,PIRP irp)
{

 	IoSkipCurrentIrpStackLocation(irp);
 	return IoCallDriver(pdx->pNextStackDev,irp);
}


#pragma  code_seg("PAGE")
NTSTATUS HandleStartDevice(PDEVICE_EXTENSION pdx,PIRP irp)
{

	NTSTATUS status = STATUS_UNSUCCESSFUL;

	KdPrint(("HandleStartDevice enter"));
	DefaultPnpHandler(pdx,irp);
	KdPrint(("HandleStartDevice leave"));

	return status;

}


#pragma  code_seg("PAGE")
NTSTATUS HandleRemoveDevice(PDEVICE_EXTENSION pdx,PIRP irp)
{

	KdPrint(("HandleRemoveDevice enter"));

	NTSTATUS status = STATUS_UNSUCCESSFUL;
	
	irp->IoStatus.Status = STATUS_SUCCESS;
	status = DefaultPnpHandler(pdx,irp);

	IoSetDeviceInterfaceState(&pdx->interfaceName,FALSE);

	RtlFreeUnicodeString(&pdx->interfaceName);

	//把FDO从设备栈脱开
	if (pdx->pNextStackDev)
	{
		IoDetachDevice(pdx->pNextStackDev);
	}

	//删除FDO
	IoDeleteDevice(pdx->pFdo);

	KdPrint(("HandleRemoveDevice leave"));

	return status;

}


#define  arraySize(p)  (sizeof(p)/sizeof(p[0]))


NTSTATUS HelloWdmPnp(PDEVICE_OBJECT pDeviceObj,PIRP pIrp)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;
	PAGED_CODE();//Checked模式下有效，确保运行在irql足够低，允许分页的级别

	KdPrint(("HelloWdmPnp Enter..."));

	//获得设备扩展
	PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDeviceObj->DeviceExtension;

	//获得当前IO栈
	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);

	static NTSTATUS (*FunTab[])(PDEVICE_EXTENSION ,PIRP ) = {

		HandleStartDevice,		// IRP_MN_START_DEVICE
		DefaultPnpHandler,		// IRP_MN_QUERY_REMOVE_DEVICE
		HandleRemoveDevice,		// IRP_MN_REMOVE_DEVICE
		DefaultPnpHandler,		// IRP_MN_CANCEL_REMOVE_DEVICE
		DefaultPnpHandler,		// IRP_MN_STOP_DEVICE
		DefaultPnpHandler,		// IRP_MN_QUERY_STOP_DEVICE
		DefaultPnpHandler,		// IRP_MN_CANCEL_STOP_DEVICE
		DefaultPnpHandler,		// IRP_MN_QUERY_DEVICE_RELATIONS
		DefaultPnpHandler,		// IRP_MN_QUERY_INTERFACE
		DefaultPnpHandler,		// IRP_MN_QUERY_CAPABILITIES
		DefaultPnpHandler,		// IRP_MN_QUERY_RESOURCES
		DefaultPnpHandler,		// IRP_MN_QUERY_RESOURCE_REQUIREMENTS
		DefaultPnpHandler,		// IRP_MN_QUERY_DEVICE_TEXT
		DefaultPnpHandler,		// IRP_MN_FILTER_RESOURCE_REQUIREMENTS
		DefaultPnpHandler,		// 
		DefaultPnpHandler,		// IRP_MN_READ_CONFIG
		DefaultPnpHandler,		// IRP_MN_WRITE_CONFIG
		DefaultPnpHandler,		// IRP_MN_EJECT
		DefaultPnpHandler,		// IRP_MN_SET_LOCK
		DefaultPnpHandler,		// IRP_MN_QUERY_ID
		DefaultPnpHandler,		// IRP_MN_QUERY_PNP_DEVICE_STATE
		DefaultPnpHandler,		// IRP_MN_QUERY_BUS_INFORMATION
		DefaultPnpHandler,		// IRP_MN_DEVICE_USAGE_NOTIFICATION
		DefaultPnpHandler,		// IRP_MN_SURPRISE_REMOVAL

	};

	

	ULONG uFunc = pStack->MinorFunction;
	if (uFunc >= arraySize(FunTab))
	{
		status = DefaultPnpHandler(pDevExt,pIrp);
		return status;
	}


	static char* fcnname[] = 
	{
		"IRP_MN_START_DEVICE",
		"IRP_MN_QUERY_REMOVE_DEVICE",
		"IRP_MN_REMOVE_DEVICE",
		"IRP_MN_CANCEL_REMOVE_DEVICE",
		"IRP_MN_STOP_DEVICE",
		"IRP_MN_QUERY_STOP_DEVICE",
		"IRP_MN_CANCEL_STOP_DEVICE",
		"IRP_MN_QUERY_DEVICE_RELATIONS",
		"IRP_MN_QUERY_INTERFACE",
		"IRP_MN_QUERY_CAPABILITIES",
		"IRP_MN_QUERY_RESOURCES",
		"IRP_MN_QUERY_RESOURCE_REQUIREMENTS",
		"IRP_MN_QUERY_DEVICE_TEXT",
		"IRP_MN_FILTER_RESOURCE_REQUIREMENTS",
		"",
		"IRP_MN_READ_CONFIG",
		"IRP_MN_WRITE_CONFIG",
		"IRP_MN_EJECT",
		"IRP_MN_SET_LOCK",
		"IRP_MN_QUERY_ID",
		"IRP_MN_QUERY_PNP_DEVICE_STATE",
		"IRP_MN_QUERY_BUS_INFORMATION",
		"IRP_MN_DEVICE_USAGE_NOTIFICATION",
		"IRP_MN_SURPRISE_REMOVAL",
	};


	KdPrint(("PNP Request uFunc:%d (%s)\n",uFunc, fcnname[uFunc]));


	status = (*FunTab[uFunc])(pDevExt,pIrp);
	KdPrint(("HelloWdmPnp leave..."));
	return status;

}

#ifdef __cplusplus
extern "C" {
#endif
NTSTATUS DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    )
{
 
	KdPrint(("DriverEntry enter...."));


	DriverObject->DriverExtension->AddDevice = HelloWdmAddDevice;
	DriverObject->MajorFunction[IRP_MJ_PNP] = HelloWdmPnp;

    
	DriverObject->MajorFunction[IRP_MJ_CREATE] =
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = HELLOWDM_DispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HELLOWDM_DispatchDeviceControl;
    DriverObject->DriverUnload = HELLOWDM_DriverUnload;

	KdPrint(("DriverEntry leave...."));

    return STATUS_SUCCESS;
}
#ifdef __cplusplus
}; // extern "C"
#endif

INF文件：

;--------- Version Section ---------------------------------------------------

[Version]
Signature="$CHICAGO$";
Provider=WorldWang_Device
DriverVer=11/1/2007,3.0.0.3

; If device fits one of the standard classes, use the name and GUID here,
; otherwise create your own device class and GUID as this example shows.

Class=WorldWangDevice
ClassGUID={F8F8064C-EE05-41ea-99D5-55365AB81718}


;--------- SourceDiskNames and SourceDiskFiles Section -----------------------

; These sections identify source disks and files for installation. They are
; shown here as an example, but commented out.

[SourceDisksNames]
1 = "HelloWdm",Disk1,,

[SourceDisksFiles]
HelloWdm.sys = 1, ,

;--------- ClassInstall/ClassInstall32 Section -------------------------------

; Not necessary if using a standard class

; 9X Style
[ClassInstall]
Addreg=Class_AddReg

; NT Style
[ClassInstall32]
Addreg=Class_AddReg

[Class_AddReg]
HKR,,,,%DeviceClassName%
HKR,,Icon,,"-5"

;--------- DestinationDirs Section -------------------------------------------

[DestinationDirs]
YouMark_Files_Driver = 10,System32\Drivers

;--------- Manufacturer and Models Sections ----------------------------------

[Manufacturer]
%MfgName%=Mfg0

[Mfg0]

; PCI hardware Ids use the form
; PCI\VEN_aaaa&DEV_bbbb&SUBSYS_cccccccc&REV_dd
;改成你自己的ID
%DeviceDesc%=YouMark_DDI, PCI\VEN_9999&DEV_9999

;---------- DDInstall Sections -----------------------------------------------
; --------- Windows 9X -----------------

; Experimentation has shown that DDInstall root names greater than 19 characters
; cause problems in Windows 98

[YouMark_DDI]
CopyFiles=YouMark_Files_Driver
AddReg=YouMark_9X_AddReg

[YouMark_9X_AddReg]
HKR,,DevLoader,,*ntkern
HKR,,NTMPDriver,,HelloWdm.sys
HKR, "Parameters", "BreakOnEntry", 0x00010001, 0

; --------- Windows NT -----------------

[YouMark_DDI.NT]
CopyFiles=YouMark_Files_Driver
AddReg=YouMark_NT_AddReg

[YouMark_DDI.NT.Services]
Addservice = HelloWdm, 0x00000002, YouMark_AddService

[YouMark_AddService]
DisplayName = %SvcDesc%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %10%\System32\Drivers\HelloWdm.sys

[YouMark_NT_AddReg]
HKLM, "System\CurrentControlSet\Services\HelloWdm\Parameters",\
"BreakOnEntry", 0x00010001, 0


; --------- Files (common) -------------

[YouMark_Files_Driver]
HelloWdm.sys

;--------- Strings Section ---------------------------------------------------

[Strings]
ProviderName="WorldWang."
MfgName="WorldWang Soft"
DeviceDesc="Hello World WDM!"
DeviceClassName="WorldWang_Device"
SvcDesc="WorldWang"

不知道是什么问题，使用EzDriverInstaller.exe工具加载以后，在IRP_MJ_PNP派遣函数内，都调用次类型为IRP_MN_REMOVE_DEVICE的派遣函数将设备又直接卸载了，真搞不懂什么原因导致的？ 希望有人能解答，或者我搞明白后，会编辑文档。

找到问题所在了，在HandleStartDevice函数内，调用DefaultPnpHandler后没有把函数返回状态赋值给status，导致HandleStartDevice始终返回STATUS_UNSUCCESSFUL，因此驱动认为启动设备失败了，然后直接进行卸载操作了。

修改后的HandleStartDevice函数如下：

#pragma  code_seg("PAGE")
NTSTATUS HandleStartDevice(PDEVICE_EXTENSION pdx,PIRP irp)
{

	NTSTATUS status = STATUS_UNSUCCESSFUL;

	KdPrint(("HandleStartDevice enter"));
	status = DefaultPnpHandler(pdx,irp);
	KdPrint(("HandleStartDevice leave"));

	return status;

}