每个驱动程序会有唯一的DRIVER_OBJECT驱动对象与之对应,并且这个DRIVER_OBJECT是在驱动加载时候,被内核中的对象管理器所创建。它作为驱动一个实例被内核加载,并且内核对一个驱动只加载一个实例。确切的说,是由内核的I/O管理器负责加载的。驱动程序需要在DriveEntry中初始化。
typedef struct _DRIVER_OBJECT {
CSHORT Type;
CSHORT Size;
//
// The following links all of the devices created by a single driver
// together on a list, and the Flags word provides an extensible flag
//location for driver objects.
PDEVICE_OBJECT DeviceObject;//the first pointer Of links
ULONG Flags;
//
// The following section describes where the driver is loaded. The count
// field is used to count the number of times the driver has had its
// registered reinitialization routine invoked.
//
PVOID DriverStart;
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
//
// The driver name field