当前位置:网站首页>Drive development - the first helloddk
Drive development - the first helloddk
2022-07-06 04:50:00 【ma_ de_ hao_ mei_ le】
Friend chain
Non plug and play driver
helloddk.h
// Make sure that the header file is compiled only once
// Because in real projects , A header file may be contained by another header file
// such as b.h It contains a.h
// And then in c.c Has the following code :
/*
#include<a.h>
#include<b.h>
*/
// thus ,a.h It was included twice
// and #pragma once Can guarantee a.h It is compiled only once
// So as to improve the compilation efficiency
#pragma once
// The following condition is compiled in C++ It is very common in projects
// It allows us to C++ Project use C Header file in
#ifdef __cplusplus
extern "C"
{
#endif
#include <NTDDK.h>
#ifdef __cplusplus
}
#endif
// Paging mark 、 Non paged marking and initialization of memory blocks
#define PAGEDCODE code_seg("PAGE")
#define LOCKEDCODE code_seg()
// INIT The flag indicates that the function only needs to be loaded into memory when loading
// After the driver is successfully loaded , Functions can be unloaded from memory
#define INITCODE code_seg("INIT")
#define PAGEDDATA data_seg("PAGE")
#define LOCKEDDATA data_seg()
#define INITDATA data_seg("INIT")
#define arraysize(p) (sizeof(p)/sizeof((p)[0]))
// Define body _DEVICE_EXTENSION , And name it
// Device extension structure
// This structure is widely used in drivers
// According to the needs of different procedures , It is used to supplement and define the relevant information of the equipment
typedef struct _DEVICE_EXTENSION {
PDEVICE_OBJECT pDevice;
UNICODE_STRING ustrDeviceName; // Equipment name
UNICODE_STRING ustrSymLinkName; // Symbolic link name
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;
// Function declaration
// This IN The keyword may be used to indicate that the parameter is an incoming parameter
NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp);
helloddk.cpp
#include "HelloDDK.h"
/*
Initialize the driver , Locate and apply for hardware resources , Create kernel objects
parameter list
pDriverObject: from IO The driver object passed in the manager
pRegistryPath: The path of the driver in the registry
Return value :
Return to initialization driver state
*/
// Use extern "C" Decorate the function , In this way, it will be compiled into [email protected]
// Without this modifier , The compiler will follow C++ The symbolic name of , Link time will report an error
// Indicates that the function is loaded into INIT In the memory area
#pragma INITCODE
extern "C" NTSTATUS DriverEntry(
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath)
{
NTSTATUS status;
// There are no programs running in the kernel console Of , So you can only use KdPrint Macro to output debugging information
// This macro only works in debug versions (Free)
// Do nothing in the release (Checked)
KdPrint(("Enter DriverEntry\n"));
// Register other driver call function entries
// Send the address of our own defined function to the operating system
// The operating system will call these functions when appropriate
// Through the following assignment operation
// When the driver is unloaded ,HelloDDKUnload Function will be called
// Create in the driver 、 Turn off read-write related IRP when ,HelloDDKDispatchRoutine Function will be called
pDriverObject->DriverUnload = HelloDDKUnload;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;
// Create drive device object
status = CreateDevice(pDriverObject);
KdPrint(("DriverEntry end\n"));
// return CreateDevice Result
return status;
}
// Definition CreateDevice function
#pragma INITCODE
NTSTATUS CreateDevice(
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
// Create device name
// structure Unicode The string is used to store the name of this device object
UNICODE_STRING devName;
RtlInitUnicodeString(&devName, L"\\Device\\MyDDKDevice");
// Create device
status = IoCreateDevice(pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0,
TRUE,
&pDevObj);
if(!NT_SUCCESS(status))
return status;
// Indicates that the device is BUFFERED_IO equipment
// There are two kinds of memory operations of devices , One is BUFFERED_IO, One is DO_DIRECT_IO, I'll explain later
pDevObj->Flags = pDevObj->Flags | DO_BUFFERED_IO;
// Fill in the extended structure of the equipment
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
// Create symbolic links
// The device name is only visible in kernel mode , User programs are invisible
// Therefore, a symbolic connection needs to be exposed , The symbolic link points to the real device name
UNICODE_STRING SymLinkName;
RtlInitUnicodeString(&SymLinkName, L"\\??\\HelloDDK");
pDevExt->ustrSymLinkName = SymLinkName;
// If it is created successfully, it will return , Otherwise, call IoDeleteDevice Delete device
status = IoCreateSymbolicLink(&SymLinkName, &devName);
if(!NT_SUCCESS(status))
{
IoDeleteDevice(pDevObj);
return status;
}
return STATUS_SUCCESS;
}
// Define the driver unload function
#pragma PAGEDCODE
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));
// Get the device object from the driver object
pNextObj = pDriverObject->DeviceObject;
// Traverse the device object
while(pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;
// Remove symbolic links
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
// Delete symbolic links of device objects
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice(pDevExt->pDevice);
}
}
// Define default dispatch routines
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(
IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutine\n"));
NTSTATUS status = STATUS_SUCCESS;
// complete IRP
// About IRP Introduction to , I'll introduce it later
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0;
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
KdPrint(("Leave HelloDDKDispatchRoutine\n"));
return status;
}
source
TARGETNAME=HelloDDK
TARGETTYPE=DRIVER
TARGETPATH=OBJ
INCLUDES=$(BASEDIR)\inc;\
$(BASEDIR)\inc\ddk;\
SOURCES=helloddk.cpp\
边栏推荐
- Flody的应用
- Postman断言
- [classic example] binary tree recursive structure classic topic collection @ binary tree
- IPv6 comprehensive experiment
- MIT CMS. 300 session 8 – immersion / immersion
- 集合详解之 Collection + 面试题
- 比尔·盖茨晒18岁个人简历,48年前期望年薪1.2万美元
- yolov5 tensorrt加速
- Flink kakfa data read and write to Hudi
- It is also a small summary in learning
猜你喜欢
Selection of slow motion function
Canal synchronizes MySQL data changes to Kafka (CentOS deployment)
Basic knowledge and examples of binary tree
SQL injection vulnerability (MSSQL injection)
Leetcode dynamic planning day 16
DMA use of stm32
Pagoda configuration mongodb
Delete subsequence < daily question >
[05-1, 05-02, 05-03] network protocol
[Yu Yue education] reference materials of complex variable function and integral transformation of Northwestern Polytechnic University
随机推荐
麥斯克電子IPO被終止:曾擬募資8億 河南資產是股東
ETCD数据库源码分析——etcdserver bootstrap初始化存储
最高法院,离婚案件判决标准
Vulnerability discovery - vulnerability probe type utilization and repair of web applications
Supreme Court, judgment standard of divorce cases
Upload nestjs configuration files, configure the use of middleware and pipelines
The ECU of 21 Audi q5l 45tfsi brushes is upgraded to master special adjustment, and the horsepower is safely and stably increased to 305 horsepower
It is also a small summary in learning
The underlying structure of five data types in redis
[buuctf.reverse] 159_ [watevrCTF 2019]Watshell
Request (request object) and response (response object)
The video in win10 computer system does not display thumbnails
程序员在互联网行业的地位 | 每日趣闻
The web project imported the MySQL driver jar package but failed to load it into the driver
web工程导入了mysql驱动jar包却无法加载到驱动的问题
2021robocom robot developer competition (Preliminary)
Raspberry pie 3.5-inch white screen display connection
DMA use of stm32
Yolov5 tensorrt acceleration
idea一键导包