NTModel框架与通信(含使用服务加载驱动)

最新推荐文章于 2021-06-10 17:31:13 发布
最新推荐文章于 2021-06-10 17:31:13 发布
阅读量1.3k 收藏 1
点赞数 1
分类专栏： 驱动学习
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zhuhuibeishadiao/article/details/51027447
版权

原代码如下

#include <ntddk.h>
 
#define     DEVICE_NAME                 L"\\device\\NTModelDrv"
#define     LINK_NAME                   L"\\dosDevices\\NTModelDrv"
 
#define IOCTL_BASE  0x8000
#define MY_CTL_CODE(i) \
    CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)
 
#define IOCTL_HELLO MY_CTL_CODE(0)
 
typedef struct _DEVICE_EXTENSION {
    PDEVICE_OBJECT pDevice;
    UNICODE_STRING ustrDeviceName;  //设备名称
    UNICODE_STRING ustrSymLinkName; //符号链接名
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;
 
 
// function to dispatch the IRPs
NTSTATUS DispatchOK(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
   Irp->IoStatus.Status = STATUS_SUCCESS;
   IoCompleteRequest(Irp,IO_NO_INCREMENT);
   return STATUS_SUCCESS;
}
 
VOID DriverUnload (
    IN PDRIVER_OBJECT   pDriverObject) 
{
    UNICODE_STRING strLink;
    RtlInitUnicodeString(&strLink, LINK_NAME);
 
    IoDeleteSymbolicLink(&strLink);
    IoDeleteDevice(pDriverObject->DeviceObject);
    DbgPrint("[NTModelDrv] Unloaded\n"); }
 
NTSTATUS DispatchIoctl(
    PDEVICE_OBJECT pDevObj, 
    PIRP pIrp
    )
{
    NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
    PIO_STACK_LOCATION pIrpStack;
    ULONG uIoControlCode;
    PVOID pIoBuffer;
    ULONG uInSize;
    ULONG uOutSize;
 
    pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
    uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
    pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
    uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
    uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
 
    switch(uIoControlCode) 
    {
        case IOCTL_HELLO: 
        {
            DbgPrint("[NTModelDrv] Hello\n");
            status = STATUS_SUCCESS;
        }
        break;
    }
 
    if(status == STATUS_SUCCESS)
        pIrp->IoStatus.Information = uOutSize;
    else
        pIrp->IoStatus.Information = 0;
     
    /
    pIrp->IoStatus.Status = status;
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return status;
}
 
//处理应用层的write()函数
NTSTATUS DispatchWrite (
    IN PDEVICE_OBJECT   pDevObj,
    IN PIRP pIrp) 
{
    NTSTATUS    status = STATUS_SUCCESS;
    PVOID       userBuffer;
    PVOID       drvBuffer;
    ULONG       xferSize;
 
    //获得IRP堆栈的当前位置
    PIO_STACK_LOCATION pIrpStack =
        IoGetCurrentIrpStackLocation( pIrp );
    //获得当前写的长度和缓冲
    xferSize = pIrpStack->Parameters.Write.Length;
    userBuffer = pIrp->AssociatedIrp.SystemBuffer;
    drvBuffer = ExAllocatePoolWithTag(PagedPool, xferSize, 'tseT');
    if (drvBuffer == NULL)
    {
        status = STATUS_INSUFFICIENT_RESOURCES;
        xferSize = 0;
    }
    //将当前缓冲中的数据写入
    RtlCopyMemory( drvBuffer, userBuffer, xferSize );
    //完成IO，填写完成状态和传输的数据长度
        ExFreePool(drvBuffer);
        drvBuffer = NULL;
    pIrp->IoStatus.Status = status;
    pIrp->IoStatus.Information = xferSize;
    //完成IRP，不向下层传递
    IoCompleteRequest( pIrp, IO_NO_INCREMENT );
    return status;
}
//处理应用层的read()函数
NTSTATUS DispatchRead (
    IN PDEVICE_OBJECT   pDevObj,
    IN PIRP pIrp) 
{
    NTSTATUS    status = STATUS_SUCCESS;
    PVOID       userBuffer;
    ULONG       xferSize;
 
    //获取IRP堆栈的当前位置
    PIO_STACK_LOCATION pIrpStack =
        IoGetCurrentIrpStackLocation( pIrp );
    //获取传输的字节数和缓冲
    xferSize = pIrpStack->Parameters.Read.Length;
    userBuffer = pIrp->AssociatedIrp.SystemBuffer;   
    //从驱动中读数据
    RtlCopyMemory( userBuffer, L"Hello, world",
        xferSize );
    //填写IRP中的完成状态，结束IRP操作，不向下层发送
    pIrp->IoStatus.Status = status;
    pIrp->IoStatus.Information = xferSize;
    IoCompleteRequest( pIrp, IO_NO_INCREMENT );
    return status;
}
 
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
    UNICODE_STRING  DeviceName;
    UNICODE_STRING  LinkName;  
    NTSTATUS        status; 
    PDEVICE_OBJECT  pDriverDeviceObject;  
    PDEVICE_EXTENSION   pDevExt;
    ULONG i;
     
    //DbgPrint("Driver loaded.");
    pDriverObject->DriverUnload = DriverUnload;   
     
    // init strings
    RtlInitUnicodeString(&DeviceName, DEVICE_NAME);
    RtlInitUnicodeString(&LinkName, LINK_NAME);
     
    // to communicate with usermode, we need a device
    status = IoCreateDevice(
           pDriverObject,        // ptr to caller object
           sizeof(DEVICE_EXTENSION),  // extension device allocated byte number
           &DeviceName,         // device name 
           FILE_DEVICE_UNKNOWN, 
           0,                   // no special caracteristics
           FALSE,               // we can open many handles in same time
           &pDriverDeviceObject); // [OUT] ptr to the created object
            
    if ( !NT_SUCCESS(status) ) 
       return STATUS_NO_SUCH_DEVICE;
     
    pDriverDeviceObject-> Flags |= DO_BUFFERED_IO;
        pDevExt = (PDEVICE_EXTENSION)pDriverDeviceObject->DeviceExtension;
    pDevExt->pDevice = pDriverDeviceObject;
    pDevExt->ustrDeviceName = DeviceName;
 
    // we also need a symbolic link
    status = IoCreateSymbolicLink(&LinkName,&DeviceName);
    if( !NT_SUCCESS(status) ) 
    {
        IoDeleteDevice( pDriverDeviceObject );
        return STATUS_NO_SUCH_DEVICE;
    }  
 
    pDevExt->ustrSymLinkName = LinkName;
 
    for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
        pDriverObject->MajorFunction[i] = DispatchOK; 
     
    // handle IRPs
 
    pDriverObject->MajorFunction[IRP_MJ_READ]   = DispatchRead;
    pDriverObject->MajorFunction[IRP_MJ_WRITE]  = DispatchWrite;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl; 
 
    //Do other things...   
     
    return STATUS_SUCCESS;
}


上面是真正的框架
下面是测试使用的框架:


#include <ntddk.h>
 
#define DEVICE_NAME L"\\device\\ntmodeldrv"
#define LINK_NAME L"\\dosdevices\\ntmodeldrv"
 
#define IOCTRL_BASE 0x800
 
#define MYIOCTRL_CODE(i) \
    CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTRL_BASE+i, METHOD_BUFFERED,FILE_ANY_ACCESS)
 
#define CTL_HELLO MYIOCTRL_CODE(0)
#define CTL_PRINT MYIOCTRL_CODE(1)
#define CTL_BYE MYIOCTRL_CODE(2)
 
NTSTATUS DispatchCommon(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    pIrp->IoStatus.Status=STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
 
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}
 
NTSTATUS DispatchCreate(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    pIrp->IoStatus.Status=STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
 
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}
 
NTSTATUS DispatchRead(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    PVOID pReadBuffer = NULL;
    ULONG uReadLength = 0;
    PIO_STACK_LOCATION pStack = NULL;
    ULONG uMin = 0;
    ULONG uHelloStr = 0;
 
    uHelloStr = (wcslen(L"hello world")+1)*sizeof(WCHAR);
 
    pReadBuffer = pIrp->AssociatedIrp.SystemBuffer;
    pStack = IoGetCurrentIrpStackLocation(pIrp);
 
    uReadLength = pStack->Parameters.Read.Length;
    uMin = uReadLength>uHelloStr?uHelloStr:uReadLength;
 
    RtlCopyMemory(pReadBuffer, L"hello world", uMin);
 
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    pIrp->IoStatus.Information = uMin;
 
    IoCompleteRequest(pIrp,IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
 
}
 
NTSTATUS DispatchWrite(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    PVOID pWriteBuff = NULL;
    ULONG uWriteLength = 0;
    PIO_STACK_LOCATION pStack = NULL;
 
    PVOID pBuffer = NULL;
 
    pWriteBuff = pIrp->AssociatedIrp.SystemBuffer;
 
    pStack = IoGetCurrentIrpStackLocation(pIrp);
    uWriteLength = pStack->Parameters.Write.Length;
 
    pBuffer = ExAllocatePoolWithTag(PagedPool, uWriteLength, 'TSET');
    if(pBuffer == NULL)
    {
        pIrp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
        pIrp->IoStatus.Information = 0;
        IoCompleteRequest(pIrp,IO_NO_INCREMENT);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    memset(pBuffer, 0, uWriteLength);
 
    RtlCopyMemory(pBuffer, pWriteBuff, uWriteLength);
 
    ExFreePool(pBuffer);
    pBuffer=NULL;
 
 
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    pIrp->IoStatus.Information = uWriteLength;
 
    IoCompleteRequest(pIrp,IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
 
}
 
NTSTATUS DispatchIoctrl(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    ULONG uIoctrlCode = 0;
    PVOID pInputBuff = NULL;
    PVOID pOutputBuff = NULL;
 
    ULONG uInputLength = 0;
    ULONG uOutputLength = 0;
    PIO_STACK_LOCATION pStack = NULL;
 
    pInputBuff = pOutputBuff = pIrp->AssociatedIrp.SystemBuffer;
 
    pStack = IoGetCurrentIrpStackLocation(pIrp);
    uInputLength = pStack->Parameters.DeviceIoControl.InputBufferLength;
    uOutputLength = pStack->Parameters.DeviceIoControl.OutputBufferLength;
 
 
    uIoctrlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
 
    switch(uIoctrlCode)
    {
    case CTL_HELLO:
        DbgPrint("Hello iocontrol\n");
        break;
    case CTL_PRINT:
        DbgPrint("%ws\n", pInputBuff);
        break;
    case CTL_BYE:
        DbgPrint("Goodbye iocontrol\n");
        break;
    default:
        DbgPrint("Unknown iocontrol\n");
 
    }
 
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
    IoCompleteRequest(pIrp,IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
 
}
 
NTSTATUS DispatchClean(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    pIrp->IoStatus.Status=STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
 
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}
 
NTSTATUS DispatchClose(PDEVICE_OBJECT pObject, PIRP pIrp)
{
    pIrp->IoStatus.Status=STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
 
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}
 
 
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
    UNICODE_STRING uLinkName={0};
    RtlInitUnicodeString(&uLinkName, LINK_NAME);
    IoDeleteSymbolicLink(&uLinkName);
 
    IoDeleteDevice(pDriverObject->DeviceObject);
 
    DbgPrint("Driver unloaded\n");
 
}
 
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,
                     PUNICODE_STRING pRegPath)
{
    UNICODE_STRING uDeviceName = {0};
    UNICODE_STRING uLinkName={0};
    NTSTATUS ntStatus = 0;
    PDEVICE_OBJECT pDeviceObject = NULL;
    ULONG i=0;
 
    DbgPrint("Driver load begin\n");
 
    RtlInitUnicodeString(&uDeviceName, DEVICE_NAME);
    RtlInitUnicodeString(&uLinkName,LINK_NAME);
 
    ntStatus = IoCreateDevice(pDriverObject,
     0,&uDeviceName,FILE_DEVICE_UNKNOWN,0,FALSE,&pDeviceObject);
     
    if(!NT_SUCCESS(ntStatus))
    {
        DbgPrint("IoCreateDevice failed:%x", ntStatus);
        return ntStatus;
    }
 
    pDeviceObject->Flags |= DO_BUFFERED_IO;
 
    ntStatus = IoCreateSymbolicLink(&uLinkName,&uDeviceName);
    if(!NT_SUCCESS(ntStatus))
    {
        IoDeleteDevice(pDeviceObject);
        DbgPrint("IoCreateSymbolicLink failed:%x\n", ntStatus);
        return ntStatus;
    }
 
    for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION+1;i++)
    {
        pDriverObject->MajorFunction[i] = DispatchCommon;
    }
 
    pDriverObject->MajorFunction[IRP_MJ_CREATE]=DispatchCreate;
    pDriverObject->MajorFunction[IRP_MJ_READ]=DispatchRead;
    pDriverObject->MajorFunction[IRP_MJ_WRITE]=DispatchWrite;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DispatchIoctrl;
    pDriverObject->MajorFunction[IRP_MJ_CLEANUP]=DispatchClean;
    pDriverObject->MajorFunction[IRP_MJ_CLOSE]=DispatchClose;
 
    pDriverObject->DriverUnload=DriverUnload;
 
    DbgPrint("Driver load ok!\n");
 
    return STATUS_SUCCESS;
}


下面是R3加载驱动和通信代码:

#include <windows.h>  
#include <winsvc.h>  
#include <conio.h>  
#include <stdio.h>
#include <winioctl.h>
 
#define DRIVER_NAME "ntmodeldrv"
#define DRIVER_PATH ".\\ntmodeldrv.sys"
 
#define IOCTRL_BASE 0x8000
 
#define MYIOCTRL_CODE(i) \
    CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTRL_BASE+i, METHOD_BUFFERED,FILE_ANY_ACCESS)
 
#define CTL_HELLO MYIOCTRL_CODE(0)
#define CTL_PRINT MYIOCTRL_CODE(1)
#define CTL_BYE MYIOCTRL_CODE(2)
 
//装载NT驱动程序
BOOL LoadDriver(char* lpszDriverName,char* lpszDriverPath)
{
    //char szDriverImagePath[256] = "D:\\DriverTest\\ntmodelDrv.sys";
    char szDriverImagePath[256] = {0};
    //得到完整的驱动路径
    GetFullPathName(lpszDriverPath, 256, szDriverImagePath, NULL);
 
    BOOL bRet = FALSE;
 
    SC_HANDLE hServiceMgr=NULL;//SCM管理器的句柄
    SC_HANDLE hServiceDDK=NULL;//NT驱动程序的服务句柄
 
    //打开服务控制管理器
    hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
 
    if( hServiceMgr == NULL )  
    {
        //OpenSCManager失败
        printf( "OpenSCManager() Failed %d ! \n", GetLastError() );
        bRet = FALSE;
        goto BeforeLeave;
    }
    else
    {
        OpenSCManager成功
        printf( "OpenSCManager() ok ! \n" );  
    }
 
    //创建驱动所对应的服务
    hServiceDDK = CreateService( hServiceMgr,
        lpszDriverName, //驱动程序的在注册表中的名字  
        lpszDriverName, // 注册表驱动程序的 DisplayName 值  
        SERVICE_ALL_ACCESS, // 加载驱动程序的访问权限  
        SERVICE_KERNEL_DRIVER,// 表示加载的服务是驱动程序  
        SERVICE_DEMAND_START, // 注册表驱动程序的 Start 值  自动启动 开机启动 手动启动 禁用
        SERVICE_ERROR_IGNORE, // 注册表驱动程序的 ErrorControl 值  
        szDriverImagePath, // 注册表驱动程序的 ImagePath 值  
        NULL,  //GroupOrder HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList
        NULL,  
        NULL,  
        NULL,  
        NULL);  
 
    DWORD dwRtn;
    //判断服务是否失败
    if( hServiceDDK == NULL )  
    {  
        dwRtn = GetLastError();
        if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS )  
        {  
            //由于其他原因创建服务失败
            printf( "CrateService() Failed %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else 
        {
            //服务创建失败，是由于服务已经创立过
            printf( "CrateService() Failed Service is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! \n" );  
        }
 
        // 驱动程序已经加载，只需要打开  
        hServiceDDK = OpenService( hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS );  
        if( hServiceDDK == NULL )  
        {
            //如果打开服务也失败，则意味错误
            dwRtn = GetLastError();  
            printf( "OpenService() Failed %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else
        {
            printf( "OpenService() ok ! \n" );
        }
    }  
    else 
    {
        printf( "CrateService() ok ! \n" );
    }
 
    //开启此项服务
    bRet= StartService( hServiceDDK, NULL, NULL );  
    if( !bRet )  
    {  
        DWORD dwRtn = GetLastError();  
        if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_ALREADY_RUNNING )  
        {  
            printf( "StartService() Failed %d ! \n", dwRtn );  
            bRet = FALSE;
            goto BeforeLeave;
        }  
        else 
        {  
            if( dwRtn == ERROR_IO_PENDING )  
            {  
                //设备被挂住
                printf( "StartService() Failed ERROR_IO_PENDING ! \n");
                bRet = FALSE;
                goto BeforeLeave;
            }  
            else 
            {  
                //服务已经开启
                printf( "StartService() Failed ERROR_SERVICE_ALREADY_RUNNING ! \n");
                bRet = TRUE;
                goto BeforeLeave;
            }  
        }  
    }
    bRet = TRUE;
//离开前关闭句柄
BeforeLeave:
    if(hServiceDDK)
    {
        CloseServiceHandle(hServiceDDK);
    }
    if(hServiceMgr)
    {
        CloseServiceHandle(hServiceMgr);
    }
    return bRet;
}
 
//卸载驱动程序  
BOOL UnloadDriver( char * szSvrName )  
{
    BOOL bRet = FALSE;
    SC_HANDLE hServiceMgr=NULL;//SCM管理器的句柄
    SC_HANDLE hServiceDDK=NULL;//NT驱动程序的服务句柄
    SERVICE_STATUS SvrSta;
    //打开SCM管理器
    hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );  
    if( hServiceMgr == NULL )  
    {
        //带开SCM管理器失败
        printf( "OpenSCManager() Failed %d ! \n", GetLastError() );  
        bRet = FALSE;
        goto BeforeLeave;
    }  
    else 
    {
        //带开SCM管理器失败成功
        printf( "OpenSCManager() ok ! \n" );  
    }
    //打开驱动所对应的服务
    hServiceDDK = OpenService( hServiceMgr, szSvrName, SERVICE_ALL_ACCESS );  
 
    if( hServiceDDK == NULL )  
    {
        //打开驱动所对应的服务失败
        printf( "OpenService() Failed %d ! \n", GetLastError() );  
        bRet = FALSE;
        goto BeforeLeave;
    }  
    else 
    {  
        printf( "OpenService() ok ! \n" );  
    }  
    //停止驱动程序，如果停止失败，只有重新启动才能，再动态加载。  
    if( !ControlService( hServiceDDK, SERVICE_CONTROL_STOP , &SvrSta ) )  
    {  
        printf( "ControlService() Failed %d !\n", GetLastError() );  
    }  
    else 
    {
        //打开驱动所对应的失败
        printf( "ControlService() ok !\n" );  
    } 
     
 
    //动态卸载驱动程序。  
 
    if( !DeleteService( hServiceDDK ) )  
    {
        //卸载失败
        printf( "DeleteSrevice() Failed %d !\n", GetLastError() );  
    }  
    else 
    {  
        //卸载成功
        printf( "DelServer:deleteSrevice() ok !\n" );  
    }  
 
    bRet = TRUE;
BeforeLeave:
//离开前关闭打开的句柄
    if(hServiceDDK)
    {
        CloseServiceHandle(hServiceDDK);
    }
    if(hServiceMgr)
    {
        CloseServiceHandle(hServiceMgr);
    }
    return bRet;    
} 
 
void TestDriver()
{
    //测试驱动程序  
    HANDLE hDevice = CreateFile("\\\\.\\NTmodeldrv",  
        GENERIC_WRITE | GENERIC_READ,  
        0,  
        NULL,  
        OPEN_EXISTING,  
        0,  
        NULL);  
    if( hDevice != INVALID_HANDLE_VALUE )  
    {
        printf( "Create Device ok ! \n" );  
    }
    else 
    {
        printf( "Create Device Failed %d ! \n", GetLastError() ); 
        return;
    }
    CHAR bufRead[1024]={0};
    WCHAR bufWrite[1024]=L"Hello, world";
 
    DWORD dwRead = 0;
    DWORD dwWrite = 0;
 
    ReadFile(hDevice, bufRead, 1024, &dwRead, NULL);
    printf("Read done!\n");
    WriteFile(hDevice, bufWrite, (wcslen(bufWrite)+1)*sizeof(WCHAR), &dwWrite, NULL);
 
    printf("Write done!\n");
 
    CHAR bufInput[1024] ="Hello, world";
    CHAR bufOutput[1024] = {0};
    DWORD dwRet = 0;
 
    WCHAR bufFileInput[1024] =L"c:\\docs\\hi.txt";
 
    DeviceIoControl(hDevice, 
        CTL_PRINT, 
        bufFileInput, 
        sizeof(bufFileInput), 
        bufOutput, 
        sizeof(bufOutput), 
        &dwRet, 
        NULL);
    DeviceIoControl(hDevice, 
        CTL_HELLO, 
        NULL, 
        0, 
        NULL, 
        0, 
        &dwRet, 
        NULL);
 
    DeviceIoControl(hDevice, 
        CTL_BYE, 
        NULL, 
        0, 
        NULL, 
        0, 
        &dwRet, 
        NULL);
    printf("DeviceIoControl done!\n");
    CloseHandle( hDevice );
} 
 
int main(int argc, char* argv[])  
{
    //加载驱动
    BOOL bRet = LoadDriver(DRIVER_NAME,DRIVER_PATH);
    if (!bRet)
    {
        printf("LoadNTDriver error\n");
        return 0;
    }
    //加载成功
 
    printf( "press any key to create device!\n" );  
    getch();  
 
    TestDriver();
 
    //这时候你可以通过注册表，或其他查看符号连接的软件验证。  
    printf( "press any key to stop service!\n" );  
    getch();  
 
    //卸载驱动
    bRet = UnloadDriver(DRIVER_NAME);
    if (!bRet)
    {
        printf("UnloadNTDriver error\n");
        return 0;
    }
 
 
    return 0;  
}


下面是我自己的驱动模板

通信代码依旧是上面的 只是改了设备名和驱动名 和 testDriver中打开驱动的名称

#include <ntddk.h>

#define DEVICE_NAME L"\\device\\DjWow"
#define LINK_NAME L"\\dosdevices\\DjWow" //\\??\\xxxx


#define IOCTRL_BASE 0x800

#define IOCTL_CODE(i)\
	CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTRL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define CTL_HELLO IOCTL_CODE(0)
#define CTL_ULONG IOCTL_CODE(1)
#define CTL_WCHAR IOCTL_CODE(2)


NTSTATUS DispatchCommon(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}


NTSTATUS DispatchCreate(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}


NTSTATUS DispatchClose(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}


NTSTATUS DispatchClear(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}


NTSTATUS DispatchRead(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	PVOID pBuff = 0;
	ULONG pBuffLen = 0;
	ULONG pStackLen = 0;
	PIO_STACK_LOCATION pStack = 0;
	ULONG uMin = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	pBuff = pIrp->AssociatedIrp.SystemBuffer;

	pStack = IoGetCurrentIrpStackLocation(pIrp);

	pStackLen = pStack->Parameters.Read.Length;

	pBuffLen = (wcslen(L"hello world") + 1) * sizeof(WCHAR);

	uMin = pBuffLen < pStackLen ? pBuffLen:pStackLen;

	RtlCopyMemory(pBuff, L"hello wolrd", uMin);

	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = uMin;

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}


NTSTATUS DispatchWrite(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	PVOID pWriteBuff = 0;
	PVOID pBuff = 0;
	ULONG uWriteBuffLen = 0;
	PIO_STACK_LOCATION pStack = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	pWriteBuff = pIrp->AssociatedIrp.SystemBuffer;

	pStack = IoGetCurrentIrpStackLocation(pIrp);

	uWriteBuffLen = pStack->Parameters.Write.Length;

	pBuff = ExAllocatePoolWithTag(PagedPool, uWriteBuffLen,'TSET');

	if(pBuff == NULL)
	{
		pIrp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
		pIrp->IoStatus.Information = 0;
		return STATUS_INSUFFICIENT_RESOURCES;
	}

	RtlZeroMemory(pBuff, uWriteBuffLen);

	RtlCopyMemory(pBuff,pWriteBuff, uWriteBuffLen);

	ExFreePool(pBuff);
	pBuff = 0;

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = uWriteBuffLen;

	return STATUS_SUCCESS;
}


NTSTATUS DispatchIoctrl(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	PIO_STACK_LOCATION pStack = 0;
	PVOID pBuff = 0;
	ULONG uOutLen = 0;
	ULONG uInLen = 0;
	ULONG uCtlCode = 0;

	UNREFERENCED_PARAMETER(pDeviceObject);

	pStack = IoGetCurrentIrpStackLocation(pIrp);

	uOutLen = pStack->Parameters.DeviceIoControl.OutputBufferLength;
	uInLen = pStack->Parameters.DeviceIoControl.InputBufferLength;

	pBuff = pIrp->AssociatedIrp.SystemBuffer;

	uCtlCode = pStack->Parameters.DeviceIoControl.IoControlCode;

	switch (uCtlCode)
	{
	case CTL_HELLO:
		DbgPrint("hello!\n");
		break;
	case CTL_ULONG:
		{
			DbgPrint("pid:%d\n",*(ULONG*)pBuff);
			RtlCopyMemory(pBuff,L"ok",uOutLen);
			break;
		}
	case CTL_WCHAR:
			DbgPrint("%ws",pBuff);
			break;
	default:
		DbgPrint("UNKNUW CTLCODE!\n");
	}

	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = uOutLen;

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return STATUS_SUCCESS;
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	UNICODE_STRING strLinkName ={0};

	RtlInitUnicodeString(&strLinkName,LINK_NAME);

	IoDeleteSymbolicLink(&strLinkName);

	if(pDriverObject->DeviceObject)
	{
		IoDeleteDevice(pDriverObject->DeviceObject);
	}
	
	DbgPrint("DriverUnload");

	return;
}


NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
	UNICODE_STRING strDeviceName = {0};
	UNICODE_STRING strLinkName = {0};
	NTSTATUS status = 0;
	PDEVICE_OBJECT pDeviceObject = 0;
	ULONG i = 0;

	DbgPrint("[DJWOW]DriverEntry!\n");

	UNREFERENCED_PARAMETER(pRegPath);

	RtlInitUnicodeString(&strDeviceName, DEVICE_NAME);
	RtlInitUnicodeString(&strLinkName, LINK_NAME);

	status = IoCreateDevice(pDriverObject, 0, &strDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDeviceObject);

	if(!NT_SUCCESS(status))
	{
		DbgPrint("CretaDevice Faild:0x%x\n",status);
		return status;
	}

	pDeviceObject->Flags |= DO_BUFFERED_IO;

	status = IoCreateSymbolicLink(&strLinkName,&strDeviceName);

	if(!NT_SUCCESS(status))
	{
		IoDeleteDevice(pDeviceObject);
		DbgPrint("IoCreateSymbolicdLink Faild:0x%x\n",status);
		return status;
	}

	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION + 1; i++)
	{
		pDriverObject->MajorFunction[i] = DispatchCommon;
	}

	pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
	pDriverObject->MajorFunction[IRP_MJ_READ] = DispatchRead;
	pDriverObject->MajorFunction[IRP_MJ_WRITE] = DispatchWrite;
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctrl;
	pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
	pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = DispatchClear;

	pDriverObject->DriverUnload = DriverUnload;

	return STATUS_SUCCESS;

}


zhuhuibeishadiao
关注
  • 1
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
SFilter框架理解
zhuhuibeishadiao
04-18 8115
控制设备(接受我们自己的客服端)----过滤设备(接受别的进程的IRP) IRP栈每层对应的设备不同   绑定后返回的：最顶层的设备 看图 为什么返回最顶层,当我们的设备处理好后要发给下面的 而下面的第一个就是最顶层的设备 看图理解 过滤 分层驱动中再加一层而不影响它的上下层，以过滤它们之间的数据，对数据或行为进行安全控制。过滤是通过设备绑定实现的。 图：
NT式驱动基本结构
BpLife
12-04 1155
1.对于NT式驱动来说，主要的函数是DriveEntry函数，卸载函数，以及各个IRP的派遣函数 2.驱动加载过程与驱动入口函数（DriverEntry）    NTSTATUS DriveEntry(IN PDRIVER_OBJECT pDriverobject,   IN PUNICODE_STRING pRegistryPath);//函数名可以自己定义 DriverEntry主
驱动和服务加载工具
06-06
用于加载NT驱动的小工具，也可以用来加载服务，手动输入NT驱动的名称，选择相应的NT驱动，点击Load即可实现加载
利用API函数加载系统服务以加载驱动
hutao1101175783的专栏
04-21 757
利用API函数加载系统服务以加载驱动 基础知识： 一个服务由三部分组成，第一部分是ServiceControlManager(SCM)。每个WindowsNT/2000系统都有一个SCM，SCM存在于Service.exe中，在Windows启动的时候会自动运行，伴随着操作系统的启动和关闭而产生和终止。这个进程以系统特权运行，并且提供一个统一的、安全的手段去控制服务。它其实是一个RPCServer，因此我们可以远程安装和管理服务，不过这不在本文讨论的范围之内。SCM包含一个储存着已安装的服...
WINDOWS操作驱动学习 带服务加载驱动
weixin_30872499的博客
08-21 285
可以用这个工具查看 驱动运行负荷 如果内核模式运行时间陡然上升 则说明驱动程序消耗了大量的内核资源 windows 2000 通过 int 2eh winodws XP 通过 sysenter 进入内核模式 Native API 通过 软件中断方式进入到内核模式 并调用内核的系统服务 执行程序组件： 1对象管理程序 ...
内核编程学习笔记(002) 利用API函数加载系统服务以加载驱动
飘之境界_puztion
02-27 1956
<br /><br />利用API函数加载系统服务以加载驱动<br /><br />基础知识：<br />一个服务由三部分组成，第一部分是Service Control Manager(SCM)。每个Windows NT/2000系统都有一个SCM，SCM存在于Service.exe中，在Windows启动的时候会自动运行，伴随着操作系统的启动和关闭而产生和终止。这个进程以系统特权运行，并且提供一个统一的、安全的手段去控制服务。它其实是一个RPC Server，因此我们可以远程安装和管理服务，不过这不在本文
NT驱动开发基本框架
01-09
用于进行NT驱动开发的基础框架，比较适合App扩展到Ring0使用，附带源码，内有注释和说明，无版权，任何人可随意修改随意使用，当然最好也能发出来共享，要分是因为俺这账号要供多个懒人下载，请各位见谅！：-）
"嵌入式系统组件语言SaveCCM的形式化方法与案例研究
理论计算机科学电子笔记160（2006）127-140www.elsevier.com/locate/entcsSaveCCM：一种可分析的实时系统Jan Carlson1计算机科学与电子学系P. O. Box883，SE-72123，Vaüsterévas，SwedenJohnHakanson2和...
ntst-dos.zip
10-12
【标题】"ntst-dos.zip" 是一个包含与DOS操作系统相关的软件资源的压缩文件。这个文件集合可能是一个自启动盘或者一个用于系统维护和修复的工具集。 【描述】"ntst-doszip,ntst-dos" 暗示了这个压缩包可能是一个名...
NT式驱动三种加载方式详解（工具+手动+代码）
01-15
本文为自己整理的NT式驱动加载方式，主要是通过学习《驱动开发技术详解》所做的笔记和实验，详细介绍了工具加载、手动加载以及代码加载三种NT式驱动加载方式。并附有自己截取的图片以及编写的代码。
NT服务开发框架C++
03-22
NT服务开发框架C++
事件程序驱动代码html,技术分享 - NT驱动程序与用户层程序基于事件EVENT实现同步通信...
weixin_39828193的博客
06-10 196
背景之前我们在《NT驱动程序与用户层程序通信》这篇文章中讲了，用户层程序使用 DeviceIoControl 将 IOCTL 控制码、输入缓冲区、输出缓冲区传入到内核；内核响应 IRP_MJ_DEVICE_CONTRL 消息，并从 IRP 中获取传入的 IOCTL 控制码、输入缓冲区、输出缓冲区，以此实现数据的交互。但是，当内核层想主动传递数据到用户层，用户层又怎样才能知道呢？因为只有用户层知道内...
NT驱动框架复习
kernweak的博客
11-07 527
下面是NT框架 #include <ntddk.h> #define DEVICE_NAME L"\\device\\ntmodeldrv" //设备名device开头固定，后面随便取，一般和编译出的.sys一致，设备对象是驱动对象创建的，用来接收应用层发来的IRP请求。 #define LINK_NAME L"\\dosdevices\\ntmodeldrv"//符号链接为了...
NT式驱动程序的基本结构
World-wang
12-25 739
NT式驱动程序的基本结构： 驱动对象：每个驱动程序会有唯一的驱动对象与之对应，这个驱动对象时在驱动加载的时候，被内核中的对象管理程序所创建的，由内核中的IO管理器进行加载。 typedef struct _DRIVER_OBJECT {     CSHORT Type;     CSHORT Size;     //     // The following links
最简单的NT驱动
weixin_30674525的博客
07-30 385
一、源码 //HelloDDK.h #pragma once #ifdef __cplusplusextern "C"{#endif#include <ntddk.h>#ifdef __cplusplus}#endif #define PAGEDCODEcode_seg("PAGE")#define LOCKEDCODEcode_seg()#define INITCOD...
驱动开发入门——NTModel
Masimaro的专栏
10-07 3936
上一篇博文中主要说明了驱动开发中基本的数据类型，认识这些数据类型算是驱动开发中的入门吧，这次主要说明驱动开发中最基本的模型——NTModel。介绍这个模型首先要了解R3层是如何通过应用层API进入到内核，内核又是如何将信息返回给R3，另外会介绍R3是如何直接向R0层下命令。API调用的基本流程一般在某些平台上进行程序开发，都需要使用系统提供的统一接口，linux平台直接提供系统调用，而windows
多功能PCIE交换机之九：单NT系统中需要注意的问题
weixin_33827590的博客
11-10 347
多功能PCIE交换机之九：单NT系统中需要注意的问题 1.单NT与双NT系统差异 NTB通常用在双控或者多控的系统上，用来实现跨节点的数据传输。在由多个节点构成的系统上，通常每个节点上都有一个NTB芯片，以实现全系统地址空间划分和路由。顾名思义，单NT是指用一个PCIE非透明桥来实现节点间数据传输的方案，通常用在两个节点之间。和多NT的系统相比，这种方...
NT驱动框架及主要函数、宏
zyorz的博客
05-08 1262
主要函数DriverEntry和DriverUnload在单线程环境运行，处于System进程上下文。IRP分发函数DispatchCreate()对应IRP_MJ_CREATE DispatchRead()对应IRP_MJ_READ DispatchWrite()对应IRP_MJ_WRITE DispatchControl()对应IRP_MJ_DEVICE_CONTROLDispatchCl
驱动开发（2）第一个NT驱动和NT驱动的编译
zuishikonghuan的博客
10-02 4583
在上一篇中，我简单介绍了驱动开发的基础知识，这一篇中，将介绍编写一个NT空壳驱动（驱动基础框架） 一、驱动入口 驱动程序的入口点是DriverEntry，此函数的原型是： extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath) 参数1：系统发来的驱动对象
关于驱动隐藏那点事(不触发PG 支持win10)
热门推荐
zhuhuibeishadiao
07-21 1万+
已开源:https://github.com/ZhuHuiBeiShaDiao/NewHideDriverEx 更新:支持seh,原理自己逆下 将seh挂到其它模块上而已. 看网上用此方法隐藏用的挺嗨啊,麻烦打个出处,谢谢了. 没必要藏着,人生没有必要为这些小玩意小打小闹。 看到某些哥们这搞搞那搞搞,BSOD PATCHGUARD 无语,WRK是个好东西啊！ 还有半年来也没怎么发博客,惭...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值