夢織未來Windows驅動編程 第03課 驅動的編程規范

最近根據夢織未來論壇的驅動教程學習了一下Windows下的驅動編程，做個筆記備忘。這是第03課《驅動的編程規范》。

驅動部分包括基本的驅動卸載函數、驅動打開關閉讀取寫入操作最簡單的分發例程。代碼如下：

//CreateDevice.c
//2016.07.14

#include "ntddk.h"

//驅動卸載函數Self
VOID MyDriverUnload(PDRIVER_OBJECT pDriverObject)
{ 
    UNICODE_STRING usSymName;
    RtlInitUnicodeString(&usSymName, L"\\??\\FirstDevice");
    
    //先刪除符號鏈接，后刪除設備對象
    if (pDriverObject->DeviceObject != NULL)
    {
        IoDeleteSymbolicLink(&usSymName);                //刪除符號鏈接
        IoDeleteDevice(pDriverObject->DeviceObject);    //刪除設備對象
        KdPrint(("Delete Device Sucess."));
    }
}

//創建設備函數Self
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject)
{
    NTSTATUS Status;
    UNICODE_STRING usDevName;
    UNICODE_STRING usSymName;
    PDEVICE_OBJECT pDevObj;        //設備對象，用於指向創建的設備
    
    //DDK API    為UNICODE_STRING賦值的函數
    RtlInitUnicodeString(&usDevName, L"\\Device\\FirstDevice");
    
    //創建設備函數API    創建設備"\\Device\\FirstDevice"
    //設備創建后，會返回給pDevObj，同時給pDriverObject->DeviceObject賦值
    //The IoCreateDevice routine creates a device object for use by a driver.
    /*
        NTSTATUS IoCreateDevice(
        _In_     PDRIVER_OBJECT  DriverObject,
        _In_     ULONG           DeviceExtensionSize,
        _In_opt_ PUNICODE_STRING DeviceName,
        _In_     DEVICE_TYPE     DeviceType,
        _In_     ULONG           DeviceCharacteristics,
        _In_     BOOLEAN         Exclusive,
        _Out_    PDEVICE_OBJECT  *DeviceObject
        );
    */
    Status = IoCreateDevice(pDriverObject,         
                            0, 
                            &usDevName, 
                            FILE_DEVICE_UNKNOWN, 
                            FILE_DEVICE_SECURE_OPEN, 
                            TRUE, 
                            &pDevObj);
    if (!NT_SUCCESS(Status))    //檢查返回值
    {
        return Status;
    }
    
    //DO_BUFFERED_IO or DO_DIRECT_IO 
    //Specifies the type of buffering that is used by the I/O manager for I/O requests that are sent to the device stack. 
    //Higher-level drivers OR this member with the same value as the next-lower driver in the stack, except possibly for highest-level drivers.
    pDevObj->Flags |= DO_BUFFERED_IO;
    
    RtlInitUnicodeString(&usSymName, L"\\??\\FirstDevice");
    
    //The IoCreateSymbolicLink routine sets up a symbolic link between a device object name and a user-visible name for the device.
    /*
        NTSTATUS IoCreateSymbolicLink(
        _In_ PUNICODE_STRING SymbolicLinkName,
        _In_ PUNICODE_STRING DeviceName
        );
    */
    Status = IoCreateSymbolicLink(&usSymName, &usDevName);    //DDK API    創建符號鏈接
    if (!NT_SUCCESS(Status))
    {
        IoDeleteDevice(pDevObj);    //刪除設備對象
        return Status;
    }
    
    return STATUS_SUCCESS; 
}

//打開設備的函數
NTSTATUS CreateCompleteRoutine(PDRIVER_OBJECT pDriverObject, PIRP pIrp)
{
    NTSTATUS Status;
    
    Status = STATUS_SUCCESS;
    
    KdPrint(("Create"));
    
    //A driver sets an IRP's I/O status block to indicate the final status of an I/O request, before calling IoCompleteRequest for the IRP.
    
    //This is the completion status, either STATUS_SUCCESS if the requested operation was completed successfully or an informational, warning, or error STATUS_ XXX value.
    //For more information, see Using NTSTATUS values.
    pIrp->IoStatus.Status = Status;
    //This is the completion status, either STATUS_SUCCESS if the requested operation was completed successfully or an informational, warning, or error STATUS_ XXX value. 
    //For more information, see Using NTSTATUS values.
    pIrp->IoStatus.Information = 0;
    
    //The IoCompleteRequest routine indicates that the caller has completed all processing for a given I/O request and is returning the given IRP to the I/O manager.
    //IO_NO_INCREMENT 不再往下層傳遞
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return Status;
}

//關閉設備的函數
NTSTATUS CloseCompleteRoutine(PDRIVER_OBJECT pDriverObject, PIRP pIrp)
{
    NTSTATUS Status;

    Status = STATUS_SUCCESS;

    KdPrint(("Close"));

    pIrp->IoStatus.Status = Status;
    pIrp->IoStatus.Information = 0;

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return Status;
}

//讀取設備的函數
NTSTATUS ReadCompleteRoutine(PDRIVER_OBJECT pDriverObject, PIRP pIrp)
{
    NTSTATUS Status;

    Status = STATUS_SUCCESS;

    KdPrint(("Read"));

    pIrp->IoStatus.Status = Status;
    pIrp->IoStatus.Information = 0;

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return Status;
}

//寫入設備的函數
NTSTATUS WriteCompleteRoutine(PDRIVER_OBJECT pDriverObject, PIRP pIrp)
{
    NTSTATUS Status;

    Status = STATUS_SUCCESS;

    KdPrint(("Write"));

    pIrp->IoStatus.Status = Status;
    pIrp->IoStatus.Information = 0;

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return Status;
}

//驅動程序入口函數
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    //輸出信息
    //DbgPrint("1111");

    
    NTSTATUS Status;
    Status = CreateDevice(pDriverObject);    //創建設備對象和符號鏈接
    if (!NT_SUCCESS(Status))
    {
        KdPrint(("Create Device Failed."));
    } else {
        KdPrint(("Create Device Sucess."));
        KdPrint(("%wZ", pRegistryPath));
    }
        
    //打開關閉讀取寫入的分發例程賦值
    pDriverObject->MajorFunction[IRP_MJ_CREATE] = (PDRIVER_DISPATCH)CreateCompleteRoutine;    //打開設備
    pDriverObject->MajorFunction[IRP_MJ_CLOSE]    = (PDRIVER_DISPATCH)CloseCompleteRoutine;    //關閉設備
    pDriverObject->MajorFunction[IRP_MJ_READ]    = (PDRIVER_DISPATCH)ReadCompleteRoutine;    //讀取設備
    pDriverObject->MajorFunction[IRP_MJ_WRITE]    = (PDRIVER_DISPATCH)WriteCompleteRoutine;    //寫入設備
    
    //驅動卸載函數賦值
    pDriverObject->DriverUnload = MyDriverUnload;

    return STATUS_SUCCESS;
}

 

應用層采用了MFC創建了一個窗口，窗口有三個按鈕:Create、Read、Write。界面如下：

 

其中Create按鈕的處理函數如下：

void CCheckMyDriverDlg::OnCreateButton()
{
    // TODO: 在此添加控件通知處理程序代碼
    HANDLE hFile = CreateFileW(L"\\\\.\\FirstDevice", 
                FILE_ALL_ACCESS, 
                0, 
                NULL,
                OPEN_EXISTING,
                FILE_ATTRIBUTE_NORMAL,
                NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        AfxMessageBox (L"Open Device Failed.");
        return;
    }

    CloseHandle (hFile);
}

 

Read按鈕的處理函數如下：

void CCheckMyDriverDlg::OnReadButton()
{
    // TODO: 在此添加控件通知處理程序代碼
    HANDLE hFile = CreateFileW(L"\\\\.\\FirstDevice", 
        FILE_ALL_ACCESS, 
        0, 
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        AfxMessageBox (L"Open Device Failed.");
        return;
    }

    wchar_t Buffer[MAX_PATH] = {0};
    DWORD len = 0;
    if (!ReadFile (hFile, Buffer, MAX_PATH-1, &len, NULL))
    {
        AfxMessageBox (L"Read Device Failed.");
        return;
    }

    CloseHandle (hFile);

}

 

Write按鈕的處理函數如下：

void CCheckMyDriverDlg::OnWriteButton()
{
    // TODO: 在此添加控件通知處理程序代碼
    HANDLE hFile = CreateFileW(L"\\\\.\\FirstDevice", 
        FILE_ALL_ACCESS, 
        0, 
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        AfxMessageBox (L"Open Device Failed.");
        return;
    }

    wchar_t Buffer[MAX_PATH] = L"What The Fuck, Man ?";
    DWORD len;
    if (!WriteFile (hFile, Buffer, MAX_PATH, &len, NULL))
    {
        AfxMessageBox (L"Write Device Failed.");
        return;
    }

    CloseHandle (hFile);

}

 

 

 以下為操作部分：

將生成的FirstDevice.sys文件復制到XP虛擬機下，使用驅動加載工具InstDrv安裝並啟動驅動后，在Dbgview工具內有如下輸出信息：

並能夠找到相應注冊表，使用WinObj工具查看設備對象\\Device\\FirstDevice：

然后查看符號鏈接\\??\\FirstDevice：

 

使用InstDrv停止此驅動時輸出：

 

 期間並未出現藍屏問題

 

安裝驅動程序后，使用上面寫的MFC程序CheckMyDriver.exe，點擊Create按鈕后，輸出

 

點擊Read按鈕后，輸出：

 

點擊Write按鈕后，輸出：

 

 

 以上操作均為出現藍屏。本課結束。

 

由於本人剛開始學習驅動程序，實力有限，可能對於某些地方的理解並不正確，希望大家能提出意見建議，共同學習，共同進步。

最后謝謝大家的支持。

2016-07-14 14:58:13