最简单的NT驱动

一、源码

//HelloDDK.h

#pragma once

#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#ifdef __cplusplus
}
#endif

#define PAGEDCODE  code_seg("PAGE")
#define LOCKEDCODE  code_seg()
#define INITCODE  code_seg("INIT")

#define PAGEDDATA  data_seg("PAGE")
#define LOCKEDDATA  data_seg()
#define INITDATA  codeseg("INIT")

#define arraysize(p)  (sizeof(p)/sizeof((p)[0]))

typedef struct _DEVICE_EXTENSION
{
 PDEVICE_OBJECT pDevice;
 UNICODE_STRING ustrDeviceName;
 UNICODE_STRING ustrSymbolicLinkName;
}DEVICE_EXTENSION, *PDEVICE_EXTENSION;

typedef struct _MYDATANOTE
{
 ULONG uNum;
 LIST_ENTRY ListEntry;
}MYDATANOTE, *PMYDATANOTE;

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath);
NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject);
NTSTATUS CreateDevice2(IN PDRIVER_OBJECT pDriverObject);
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject);
NTSTATUS HelloDDKDefaultDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp);

VOID Dump1(PDRIVER_OBJECT pDriverObject);
VOID TestListEntry();
VOID TestRtl();

 //HelloDDK.cpp

#include "HelloDDK.h"

#pragma INITCODE
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
 NTSTATUS status;
 KdPrint(("DriverEntry:Enter\n"));
 KdPrint(("driver object:0X%08X\n", pDriverObject));
 KdPrint(("regiter path:%wZ\n", pRegistryPath));

 pDriverObject->DriverUnload = HelloDDKUnload;
 pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDefaultDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDefaultDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDefaultDispatchRoutine;
 pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDefaultDispatchRoutine;

 status = CreateDevice(pDriverObject);
 status = CreateDevice2(pDriverObject);

 Dump1(pDriverObject);
 TestListEntry();
 TestRtl();

 KdPrint(("DriverEntry:Leave\n"));

 return status;
}

#pragma INITCODE
VOID TestRtl()
{
 KdPrint(("-----------TestRtl------------\n"));
 PCHAR pDest;
 PCHAR pSrc;

 pDest = (PCHAR)ExAllocatePool(PagedPool, 5);
 RtlZeroMemory(pDest, 5);
 pSrc = "123456789";
 RtlCopyMemory(pDest, pSrc, 4);
 KdPrint(("pdest=[%s]\n", pDest));
 ExFreePool(pDest);

 KdPrint(("TestRtl:leave\n"));
}

#pragma INITCODE
VOID Dump1(PDRIVER_OBJECT pDriverObject)
{
 ULONG i;
 PDEVICE_OBJECT pdo = pDriverObject->DeviceObject;
 KdPrint(("---------------the device dump----------------\n"));
 i = 0;
 while(pdo)
 {
  i++;
  KdPrint(("the %d device\n", i));
  KdPrint(("device object:0X%08X\n", pdo));
  KdPrint(("device's driver:0X%08X\n", pdo->DriverObject));
  KdPrint(("attach device:0X%08X\n", pdo->AttachedDevice));
  KdPrint(("stacksieze:%d\n", pdo->SectorSize));
  
  pdo = pdo->NextDevice;
 }
}

#pragma INITCODE
VOID TestListEntry()
{
 ULONG i;
 LIST_ENTRY ListHead;
 PMYDATANOTE pData;
 PLIST_ENTRY pEntry;

 KdPrint(("---------------list_entry----------------\n"));
 InitializeListHead(&ListHead);
 //插入
 for(i = 0; i < 3; i++)
 {
  pData = (PMYDATANOTE)ExAllocatePool(PagedPool, sizeof(MYDATANOTE));
  pData->uNum = i;
  InsertTailList(&ListHead, &pData->ListEntry);
 }
 //遍历
 for(pEntry = ListHead.Flink; pEntry->Flink != ListHead.Flink; pEntry = pEntry->Flink)
 {
  pData = CONTAINING_RECORD(pEntry, MYDATANOTE, ListEntry);
  KdPrint(("%d\n", pData->uNum));
 }
 //删除
 pEntry = ListHead.Flink;
 while(!IsListEmpty(&ListHead))
 {
  pEntry = RemoveTailList(&ListHead);
  pData = CONTAINING_RECORD(pEntry, MYDATANOTE, ListEntry);
  KdPrint(("the %d note removed\n", pData->uNum));
  ExFreePool(pData);
 }
}

#pragma INITCODE
NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObject)
{
 NTSTATUS status;
 PDEVICE_OBJECT pdev;
 UNICODE_STRING devname;
 UNICODE_STRING linkname;

 RtlInitUnicodeString(&devname, L"\\Device\\MyHelloDDK");
 status = IoCreateDevice(pDriverObject,
  sizeof(DEVICE_EXTENSION),
  &devname,
  FILE_DEVICE_UNKNOWN,
  0,
  false,
  &pdev);
 if(!NT_SUCCESS(status))
 {
  return status;
 }
 pdev->Flags |= DO_BUFFERED_IO;
 PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pdev->DeviceExtension;
 pdx->pDevice = pdev;
 pdx->ustrDeviceName = devname;
 RtlInitUnicodeString(&linkname, L"\\??\\HelloDDK");
 pdx->ustrSymbolicLinkName = linkname;
 status = IoCreateSymbolicLink(&linkname, &devname);
 if(!NT_SUCCESS(status))
 {
  IoDeleteDevice(pdev);
  return status;
 }

 return status;
}

#pragma INITCODE
NTSTATUS CreateDevice2(IN PDRIVER_OBJECT pDriverObject)
{
 NTSTATUS status;
 PDEVICE_OBJECT pdev;
 UNICODE_STRING devname;
 UNICODE_STRING linkname;
 
 RtlInitUnicodeString(&devname, L"\\Device\\MyHelloDDK2");
 status = IoCreateDevice(pDriverObject,
  sizeof(DEVICE_EXTENSION),
  &devname,
  FILE_DEVICE_UNKNOWN,
  0,
  false,
  &pdev);
 if(!NT_SUCCESS(status))
 {
  return status;
 }
 pdev->Flags |= DO_BUFFERED_IO;
 PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pdev->DeviceExtension;
 pdx->pDevice = pdev;
 pdx->ustrDeviceName = devname;
 RtlInitUnicodeString(&linkname, L"\\??\\HelloDDK2");
 pdx->ustrSymbolicLinkName = linkname;
 status = IoCreateSymbolicLink(&linkname, &devname);
 if(!NT_SUCCESS(status))
 {
  IoDeleteDevice(pdev);
  return status;
 }
 
 return status;
}

#pragma PAGEDCODE
VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{
 KdPrint(("HelloDDKUnload:enter\n"));
 PDEVICE_OBJECT pNext = pDriverObject->DeviceObject;
 while(pNext)
 {
  PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pNext->DeviceExtension;
  pNext = pNext->NextDevice;
  IoDeleteSymbolicLink(&pdx->ustrSymbolicLinkName);
  IoDeleteDevice(pdx->pDevice);
 }
 KdPrint(("HelloDDKUnload:leave\n"));
}

#pragma PAGEDCODE
NTSTATUS HelloDDKDefaultDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
{
 KdPrint(("HelloDDKDefaultDispatchRoutine:enter\n"));

 pIrp->IoStatus.Status = STATUS_SUCCESS;
 pIrp->IoStatus.Information = 0;
 IoCompleteRequest(pIrp, IO_NO_INCREMENT);

 KdPrint(("HelloDDKDefaultDispatchRoutine:leave\n"));

 return STATUS_SUCCESS;
}