?? driver.cpp
字號(hào):
/************************************************************************
* 文件名稱:Driver.cpp
* 作 者:張帆
* 完成日期:2007-11-1
*************************************************************************/
#include "Driver.h"
#pragma INITCODE
VOID CreateFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_WRITE,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN_IF,//即使存在該文件，也創(chuàng)建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Create file succussfully!\n"));
}else
{
KdPrint(("Create file unsuccessfully!\n"));
}
//文件操作
//.......
//關(guān)閉文件句柄
ZwClose(hfile);
}
#pragma INITCODE
VOID OpenFileTest2()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwOpenFile( &hfile,
GENERIC_ALL,
&objectAttributes,
&iostatus,
FILE_SHARE_READ|FILE_SHARE_WRITE,
FILE_SYNCHRONOUS_IO_NONALERT);
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Create file succussfully!\n"));
}else
{
KdPrint(("Create file unsuccessfully!\n"));
}
//文件操作
//.......
//關(guān)閉文件句柄
ZwClose(hfile);
}
#pragma INITCODE
VOID OpenFileTest1()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//對(duì)大小寫敏感
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_READ,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_WRITE,
FILE_OPEN,//對(duì)文件打開，如果不存在則返回錯(cuò)誤
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if ( NT_SUCCESS(ntStatus))
{
KdPrint(("Open file succussfully!\n"));
}else
{
KdPrint(("Open file unsuccessfully!\n"));
}
//文件操作
//.......
//關(guān)閉文件句柄
ZwClose(hfile);
}
#pragma INITCODE
VOID FileAttributeTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//對(duì)大小寫敏感
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_READ,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,//對(duì)文件打開，如果不存在則返回錯(cuò)誤
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if (NT_SUCCESS(ntStatus))
{
KdPrint(("open file successfully.\n"));
}
FILE_STANDARD_INFORMATION fsi;
//讀取文件長(zhǎng)度
ntStatus = ZwQueryInformationFile(hfile,
&iostatus,
&fsi,
sizeof(FILE_STANDARD_INFORMATION),
FileStandardInformation);
if (NT_SUCCESS(ntStatus))
{
KdPrint(("file length:%u\n",fsi.EndOfFile.QuadPart));
}
//修改當(dāng)前文件指針
FILE_POSITION_INFORMATION fpi;
fpi.CurrentByteOffset.QuadPart = 100i64;
ntStatus = ZwSetInformationFile(hfile,
&iostatus,
&fpi,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation);
if (NT_SUCCESS(ntStatus))
{
KdPrint(("update the file pointer successfully.\n"));
}
//關(guān)閉文件句柄
ZwClose(hfile);
}
#pragma INITCODE
VOID WriteFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//對(duì)大小寫敏感
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_WRITE,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_WRITE,
FILE_OPEN_IF,//即使存在該文件，也創(chuàng)建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
#define BUFFER_SIZE 1024
PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,BUFFER_SIZE);
//構(gòu)造要填充的數(shù)據(jù)
RtlFillMemory(pBuffer,BUFFER_SIZE,0xAA);
KdPrint(("The program will write %d bytes\n",BUFFER_SIZE));
//寫文件
ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,NULL,NULL);
KdPrint(("The program really wrote %d bytes\n",iostatus.Information));
//構(gòu)造要填充的數(shù)據(jù)
RtlFillMemory(pBuffer,BUFFER_SIZE,0xBB);
KdPrint(("The program will append %d bytes\n",BUFFER_SIZE));
//追加數(shù)據(jù)
LARGE_INTEGER number;
number.QuadPart = 1024i64;//設(shè)置文件指針
//對(duì)文件進(jìn)行附加寫
ZwWriteFile(hfile,NULL,NULL,NULL,&iostatus,pBuffer,BUFFER_SIZE,&number,NULL);
KdPrint(("The program really appended %d bytes\n",iostatus.Information));
//關(guān)閉文件句柄
ZwClose(hfile);
ExFreePool(pBuffer);
}
#pragma INITCODE
VOID ReadFileTest()
{
OBJECT_ATTRIBUTES objectAttributes;
IO_STATUS_BLOCK iostatus;
HANDLE hfile;
UNICODE_STRING logFileUnicodeString;
//初始化UNICODE_STRING字符串
RtlInitUnicodeString( &logFileUnicodeString,
L"\\??\\C:\\1.log");
//或者寫成 "\\Device\\HarddiskVolume1\\1.LOG"
//初始化objectAttributes
InitializeObjectAttributes(&objectAttributes,
&logFileUnicodeString,
OBJ_CASE_INSENSITIVE,//對(duì)大小寫敏感
NULL,
NULL );
//創(chuàng)建文件
NTSTATUS ntStatus = ZwCreateFile( &hfile,
GENERIC_READ,
&objectAttributes,
&iostatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,//即使存在該文件，也創(chuàng)建
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0 );
if (!NT_SUCCESS(ntStatus))
{
KdPrint(("The file is not exist!\n"));
return;
}
FILE_STANDARD_INFORMATION fsi;
//讀取文件長(zhǎng)度
ntStatus = ZwQueryInformationFile(hfile,
&iostatus,
&fsi,
sizeof(FILE_STANDARD_INFORMATION),
FileStandardInformation);
KdPrint(("The program want to read %d bytes\n",fsi.EndOfFile.QuadPart));
//為讀取的文件分配緩沖區(qū)
PUCHAR pBuffer = (PUCHAR)ExAllocatePool(PagedPool,
(LONG)fsi.EndOfFile.QuadPart);
//讀取文件
ZwReadFile(hfile,NULL,
NULL,NULL,
&iostatus,
pBuffer,
(LONG)fsi.EndOfFile.QuadPart,
NULL,NULL);
KdPrint(("The program really read %d bytes\n",iostatus.Information));
//關(guān)閉文件句柄
ZwClose(hfile);
//釋放緩沖區(qū)
ExFreePool(pBuffer);
}
#pragma INITCODE
VOID FileTest()
{
//創(chuàng)建文件實(shí)驗(yàn)
// CreateFileTest();
//打開文件實(shí)驗(yàn)
// OpenFileTest1();
OpenFileTest2();
// FileAttributeTest();
//寫文件、追加文件實(shí)驗(yàn)
// WriteFileTest();
// ReadFileTest();
}
/************************************************************************
* 函數(shù)名稱:DriverEntry
* 功能描述:初始化驅(qū)動(dòng)程序，定位和申請(qǐng)硬件資源，創(chuàng)建內(nèi)核對(duì)象
* 參數(shù)列表:
pDriverObject:從I/O管理器中傳進(jìn)來的驅(qū)動(dòng)對(duì)象
pRegistryPath:驅(qū)動(dòng)程序在注冊(cè)表的中的路徑
* 返回 值:返回初始化驅(qū)動(dòng)狀態(tài)
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath )
{
NTSTATUS status;
KdPrint(("Enter DriverEntry\n"));
//注冊(cè)其他驅(qū)動(dòng)調(diào)用函數(shù)入口
pDriverObject->DriverUnload = HelloDDKUnload;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;
//創(chuàng)建驅(qū)動(dòng)設(shè)備對(duì)象
status = CreateDevice(pDriverObject);
FileTest();
KdPrint(("DriverEntry end\n"));
return status;
}
/************************************************************************
* 函數(shù)名稱:CreateDevice
* 功能描述:初始化設(shè)備對(duì)象
* 參數(shù)列表:
pDriverObject:從I/O管理器中傳進(jìn)來的驅(qū)動(dòng)對(duì)象
* 返回 值:返回初始化狀態(tài)
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
//創(chuàng)建設(shè)備名稱
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");
//創(chuàng)建設(shè)備
status = IoCreateDevice( pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0, TRUE,
&pDevObj );
if (!NT_SUCCESS(status))
return status;
pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
//創(chuàng)建符號(hào)鏈接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
}
/************************************************************************
* 函數(shù)名稱:HelloDDKUnload
* 功能描述:負(fù)責(zé)驅(qū)動(dòng)程序的卸載操作
* 參數(shù)列表:
pDriverObject:驅(qū)動(dòng)對(duì)象
* 返回 值:返回狀態(tài)
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension;
//刪除符號(hào)鏈接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
}
/************************************************************************
* 函數(shù)名稱:HelloDDKDispatchRoutine
* 功能描述:對(duì)讀IRP進(jìn)行處理
* 參數(shù)列表:
pDevObj:功能設(shè)備對(duì)象
pIrp:從IO請(qǐng)求包
* 返回 值:返回狀態(tài)
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutine\n"));
NTSTATUS status = STATUS_SUCCESS;
// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDispatchRoutine\n"));
return status;
}?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號(hào)
Ctrl + =
減小字號(hào)
Ctrl + -