驱动之HelloWorld

许多程序都是以HelloWorld开始的，本文也不例外。

程序以C语言为基础。代码如下：

/*

Name: NTDriver.h

Version: 0.10

Author: dir

Date: 22-09-09 23:42

Description:

*/

#ifndef __NTDRIVER__H__

#define __NTDRIVER__H__

#include <ntddk.h>

// 设备扩展

typedef struct _DEVICE_EXTENSION

{

PDEVICE_OBJECT pDevice;

UNICODE_STRING ustrDeviceName;

UNICODE_STRING ustrSymLinkName;

} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

#define DEVNAME L"//Device//MyDevice"

#define SYMLINKNAME L"//??//HelloWorld"

// 字符缓冲区大小

#define BUFFER_SIZE 256

// 函数声明

NTSTATUS

CreateDevice(IN PDRIVER_OBJECT pDriverObjcet);

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject);

NTSTATUS

HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,

IN PIRP pIrp);

NTSTATUS

DriverEntry(IN PDRIVER_OBJECT pDriverObjcet,

IN PUNICODE_STRING pRegistryPath);

#endif

/*

Name: NTDriver.c

Version: 0.10

Author: dir

Date: 22-09-09 23:42

Description:

*/

#include "NTDriver.h"

// 声明函数在内存中的形式

#ifdef ALLOC_PRAGMA

#pragma alloc_text(ININ, CreateDevice)

#pragma alloc_text(ININ, DriverEntry)

#pragma alloc_text(PAGE, HelloDDKDispatchRoutine)

#pragma alloc_text(PAGE, HelloDDKUnload)

#endif

//

// 函数部分

//

// 创建设备

NTSTATUS

CreateDevice(IN PDRIVER_OBJECT pDriverObjcet)

{

NTSTATUS status;

PDEVICE_OBJECT pDevObj;

PDEVICE_EXTENSION pDevExt;

UNICODE_STRING uDevName;

UNICODE_STRING uSymLinkName;

// 创建设备名

RtlInitUnicodeString(&uDevName, DEVNAME);

// 创建设备

status = IoCreateDevice(pDriverObjcet,sizeof(DEVICE_EXTENSION),

&uDevName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDevObj);

if (!NT_SUCCESS(status))

{

return status;

}

// 初始化内存读写方式

pDevObj->Flags |= DO_BUFFERED_IO;

// 将驱动信息记录在扩展设备中

pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;

pDevExt->pDevice = pDevObj;

// 将设备名写入扩展设备

pDevExt->ustrDeviceName.MaximumLength = BUFFER_SIZE;

pDevExt->ustrDeviceName.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);

RtlCopyUnicodeString(&pDevExt->ustrDeviceName, &uDevName);

// 创建符号链接

RtlInitUnicodeString(&uSymLinkName, SYMLINKNAME);

IoCreateSymbolicLink(&uSymLinkName, &uDevName);

if (!NT_SUCCESS(status))

{

// 删除设备

IoDeleteDevice(pDevObj);

return status;

}

// 将符号链接写入扩展设备

pDevExt->ustrSymLinkName.MaximumLength = BUFFER_SIZE;

pDevExt->ustrSymLinkName.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE);

RtlCopyUnicodeString(&pDevExt->ustrSymLinkName, &uSymLinkName);

return STATUS_SUCCESS;

}

// 卸载设备

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)

{

PDEVICE_OBJECT pDevObj;

PDEVICE_EXTENSION pDevExt;

KdPrint(("[HelloDDK] Enter HelloDDKUnload/n"));

pDevObj = pDriverObject->DeviceObject;

pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;

// 删除符号链接

IoDeleteSymbolicLink(&pDevExt->ustrSymLinkName);

// 删除设备

IoDeleteDevice(pDevExt->pDevice);

// 释放字符串空间

RtlFreeUnicodeString(&pDevExt->ustrSymLinkName);

RtlFreeUnicodeString(&pDevExt->ustrDeviceName);

KdPrint(("[HelloDDK] Leave HelloDDKUnload/n"));

}

// 消息派遣

NTSTATUS

HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,

IN PIRP pIrp)

{

NTSTATUS status = STATUS_SUCCESS;

KdPrint(("[HelloDDK] Enter HelloDDKDispatchRoutine/n"));

// 完成IRP

pIrp->IoStatus.Status = status;

pIrp->IoStatus.Information = 0;

IoCompleteRequest(pIrp, IO_NO_INCREMENT);

KdPrint(("[HelloDDK] Leave HelloDDKDispatchRoutine/n"));

return status;

}

// 驱动入口

NTSTATUS

DriverEntry(IN PDRIVER_OBJECT pDriverObjcet,

IN PUNICODE_STRING pRegistryPath)

{

NTSTATUS status;

KdPrint(("[HelloDDK] Enter DriverEntry/n"));

// 创建驱动设备对象

status = CreateDevice(pDriverObjcet);

if (!NT_SUCCESS(status))

{

return status;

}

// 注册其它驱动函数入口

pDriverObjcet->DriverUnload = HelloDDKUnload;

pDriverObjcet->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;

pDriverObjcet->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine;

pDriverObjcet->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;

pDriverObjcet->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;

KdPrint(("[HelloDDK] Leave DriverEntry/n"));

return status;

}

驱动不像普通的程序一样直接双击就可以运行。而程序的错误可能引起蓝屏（BSOD），所以驱动一般先在虚拟机里调试运行。

通过KMD加载、运行驱动。通过DebugView来查看输出信息。驱动加载后可以用WinObj来查看设备和符号链接。

运行效果图：