應用層加載NT驅動代碼

//
// load NT driver
//
BOOL LoadNTDriver(LPTSTR lpszDriverName, LPTSTR lpszDriverPath)
{
 TCHAR  szDriverImagePath[256] = {0};
 
 //
 // get complete driver path
 //
 GetFullPathName(lpszDriverPath, 256, szDriverImagePath, NULL);

 BOOL bRet = FALSE;

 SC_HANDLE hServiceMgr = NULL;  // SCM handle(SCM-->Service Control Manager)
 SC_HANDLE hServiceDDK = NULL;  // NT driver service handle
 
 CComMonitorApp *ptheApp = (CComMonitorApp *)AfxGetApp();

 //
 // open SCM
 //
 hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );

 if( hServiceMgr == NULL ) 
 {
  // OpenSCManager fail
  DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "OpenSCManager() failed");
  bRet = FALSE;
  goto BeforeLeave;
 }
// else
// {
//  // OpenSCManager successfully
//  printf( "OpenSCManager() ok! /n" ); 
// }
 
 //
 // create service for the driver
 //
 hServiceDDK = CreateService( hServiceMgr,
  lpszDriverName, // 驅動程序的在註冊表中的名字 
  lpszDriverName, // 註冊表驅動程序的DisplayName 值 
  SERVICE_ALL_ACCESS, // 加載驅動程序的訪問權限 
  SERVICE_KERNEL_DRIVER,// 表示加載的服務是驅動程序 
  SERVICE_DEMAND_START, // 註冊表驅動程序的 Start 值 
  SERVICE_ERROR_IGNORE, // 註冊表驅動程序的 ErrorControl 值 
  szDriverImagePath, // 註冊表驅動程序的 ImagePath 值 
  NULL, 
  NULL, 
  NULL, 
  NULL, 
  NULL); 
 
 DWORD dwRtn;

 //
 // judge whether service is created.
 //
 if( hServiceDDK == NULL ) 
 { 
  dwRtn = GetLastError();
  if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS ) 
  { 
   //
   // an error occurs
   //
   DisplayError( ptheApp->m_pMainWnd->GetSafeHwnd(), "CreateService() failed");
   bRet = FALSE;
   goto BeforeLeave;
  }
  
  //
  // just open the service as the service is already set up.
  //
  hServiceDDK = OpenService( hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS ); 
  if( hServiceDDK == NULL ) 
  {
   //
   // if open the service failed, an error occured.
   //
   DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "OpenService() failed");
   bRet = FALSE;
   goto BeforeLeave;
  } 
 } 
 
 // AdjustServicePrevelidge(hServiceDDK);  // 提權

 //
 // start the service
 //
 bRet = StartService( hServiceDDK, NULL, NULL ); 
 if( !bRet ) 
 { 
  DWORD dwRtn = GetLastError(); 
  if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_ALREADY_RUNNING ) 
  { 
   DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "StartService() failed");
   bRet = FALSE;
   goto BeforeLeave;
  } 
  else 
  { 
   if( dwRtn == ERROR_IO_PENDING ) 
   {
    //
    // device is pending
    //
    bRet = FALSE;
    goto BeforeLeave;
   } 
   else 
   { 
    //
    // service is already running
    //
    bRet = TRUE;
    goto BeforeLeave;
   } 
  } 
 }
 bRet = TRUE;

//
// close all handles before return.
//
BeforeLeave:
 if (hServiceDDK)
 {
  CloseServiceHandle(hServiceDDK);
 }
 if (hServiceMgr)
 {
  CloseServiceHandle(hServiceMgr);
 }

 return bRet;
}

//
// unload a driver
//
BOOL UnloadNTDriver(LPTSTR szSvrName) 
{
 BOOL bRet = TRUE;
 SC_HANDLE hServiceMgr = NULL;  // SCM handle
 SC_HANDLE hServiceDDK = NULL;  // NT driver's service handle
 SERVICE_STATUS SvrSta;
 
 CComMonitorApp *ptheApp = (CComMonitorApp *)AfxGetApp();

 //
 // open SCM---service control manager.
 //
 hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS ); 
 if( hServiceMgr == NULL ) 
 {
  DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "OpenSCManager() failed");
  bRet = FALSE;
  goto BeforeLeave;
 }

 //
 // open the service for the driver.
 //
 hServiceDDK = OpenService( hServiceMgr, szSvrName, SERVICE_ALL_ACCESS ); 

 if( hServiceDDK == NULL ) 
 {
  // open service failed.
  DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "OpenService() failed");

  bRet = FALSE;
  goto BeforeLeave;
 } 
 
 //
 // stop the driver, if failed, restart the system and reload it.
 //
 if( !ControlService(hServiceDDK, SERVICE_CONTROL_STOP, &SvrSta) ) 
 { 
  DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "ControlService() failed");
  bRet = FALSE;
 } 

 // delete the service of the driver, here don't delete the , just stop the service.
// if( !DeleteService(hServiceDDK) ) 
// {
//  DisplayError(ptheApp->m_pMainWnd->GetSafeHwnd(), "DeleteService() failed");
//  bRet = FALSE;
// }

BeforeLeave:
//離開前關閉打開的句柄
 if (hServiceDDK)
 {
  CloseServiceHandle(hServiceDDK);
 }
 if (hServiceMgr)
 {
  CloseServiceHandle(hServiceMgr);
 }
 
 return bRet; 
}

 

 

應該叫“手動加載”驅動程序。驅動程序也屬於服務，應用程序可以用CreateService來安裝，用StartService來加載；驅動程序可以用ZwLoadDriver來加載另一個驅動程序。

另注：驅動程序安裝後，其註冊表鍵中有一個Start鍵值，該值含義爲：
0——系統啓動時加載；
1——內核初始化完成後加載；
2——系統啓動後加載；
3——手動加載；
4——不加載。