驅動之HelloWorld

許多程序都是以HelloWorld開始的，本文也不例外。

程序以C語言爲基礎。代碼如下：

/* Name: NTDriver.h Version: 0.10 Author: dir Date: 22-09-09 23:42 Description: */ #ifndef __NTDRIVER__H__ #define __NTDRIVER__H__ #include <ntddk.h> // 設備擴展 typedef struct _DEVICE_EXTENSION { PDEVICE_OBJECT pDevice; UNICODE_STRING ustrDeviceName; UNICODE_STRING ustrSymLinkName; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; #define DEVNAME L"//Device//MyDevice" #define SYMLINKNAME L"//??//HelloWorld" // 字符緩衝區大小 #define BUFFER_SIZE 256 // 函數聲明 NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObjcet); VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject); NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp); NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObjcet, IN PUNICODE_STRING pRegistryPath); #endif

/* Name: NTDriver.c Version: 0.10 Author: dir Date: 22-09-09 23:42 Description: */ #include "NTDriver.h" // 聲明函數在內存中的形式 #ifdef ALLOC_PRAGMA #pragma alloc_text(ININ, CreateDevice) #pragma alloc_text(ININ, DriverEntry) #pragma alloc_text(PAGE, HelloDDKDispatchRoutine) #pragma alloc_text(PAGE, HelloDDKUnload) #endif ////////////////////////////////////////////////////////////////////////// // 函數部分 ////////////////////////////////////////////////////////////////////////// // 創建設備 NTSTATUS CreateDevice(IN PDRIVER_OBJECT pDriverObjcet) { NTSTATUS status; PDEVICE_OBJECT pDevObj; PDEVICE_EXTENSION pDevExt; UNICODE_STRING uDevName; UNICODE_STRING uSymLinkName; // 創建設備名 RtlInitUnicodeString(&uDevName, DEVNAME); // 創建設備 status = IoCreateDevice(pDriverObjcet,sizeof(DEVICE_EXTENSION), &uDevName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDevObj); if (!NT_SUCCESS(status)) { return status; } // 初始化內存讀寫方式 pDevObj->Flags |= DO_BUFFERED_IO; // 將驅動信息記錄在擴展設備中 pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension; pDevExt->pDevice = pDevObj; // 將設備名寫入擴展設備 pDevExt->ustrDeviceName.MaximumLength = BUFFER_SIZE; pDevExt->ustrDeviceName.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE); RtlCopyUnicodeString(&pDevExt->ustrDeviceName, &uDevName); // 創建符號鏈接 RtlInitUnicodeString(&uSymLinkName, SYMLINKNAME); IoCreateSymbolicLink(&uSymLinkName, &uDevName); if (!NT_SUCCESS(status)) { // 刪除設備 IoDeleteDevice(pDevObj); return status; } // 將符號鏈接寫入擴展設備 pDevExt->ustrSymLinkName.MaximumLength = BUFFER_SIZE; pDevExt->ustrSymLinkName.Buffer = (PWSTR)ExAllocatePool(PagedPool, BUFFER_SIZE); RtlCopyUnicodeString(&pDevExt->ustrSymLinkName, &uSymLinkName); return STATUS_SUCCESS; } // 卸載設備 VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject) { PDEVICE_OBJECT pDevObj; PDEVICE_EXTENSION pDevExt; KdPrint(("[HelloDDK] Enter HelloDDKUnload/n")); pDevObj = pDriverObject->DeviceObject; pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension; // 刪除符號鏈接 IoDeleteSymbolicLink(&pDevExt->ustrSymLinkName); // 刪除設備 IoDeleteDevice(pDevExt->pDevice); // 釋放字符串空間 RtlFreeUnicodeString(&pDevExt->ustrSymLinkName); RtlFreeUnicodeString(&pDevExt->ustrDeviceName); KdPrint(("[HelloDDK] Leave HelloDDKUnload/n")); } // 消息派遣 NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp) { NTSTATUS status = STATUS_SUCCESS; KdPrint(("[HelloDDK] Enter HelloDDKDispatchRoutine/n")); // 完成IRP pIrp->IoStatus.Status = status; pIrp->IoStatus.Information = 0; IoCompleteRequest(pIrp, IO_NO_INCREMENT); KdPrint(("[HelloDDK] Leave HelloDDKDispatchRoutine/n")); return status; } // 驅動入口 NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObjcet, IN PUNICODE_STRING pRegistryPath) { NTSTATUS status; KdPrint(("[HelloDDK] Enter DriverEntry/n")); // 創建驅動設備對象 status = CreateDevice(pDriverObjcet); if (!NT_SUCCESS(status)) { return status; } // 註冊其它驅動函數入口 pDriverObjcet->DriverUnload = HelloDDKUnload; pDriverObjcet->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine; pDriverObjcet->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutine; pDriverObjcet->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine; pDriverObjcet->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine; KdPrint(("[HelloDDK] Leave DriverEntry/n")); return status; }

驅動不像普通的程序一樣直接雙擊就可以運行。而程序的錯誤可能引起藍屏（BSOD），所以驅動一般先在虛擬機裏調試運行。

通過KMD加載、運行驅動。通過DebugView來查看輸出信息。驅動加載後可以用WinObj來查看設備和符號鏈接。

 

運行效果圖：