|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 |
/* 分发IRP函数 by exchen 2009-10-07 */ #include <ntddk.h> VOID DriverUnload(IN PDRIVER_OBJECT DriverObject) { UNICODE_STRING usSymLinkName; PDEVICE_OBJECT pDeviceObject = NULL; RtlInitUnicodeString(&usSymLinkName,L"\\DosDevices\\MySymLink"); IoDeleteSymbolicLink(&usSymLinkName); //删除符号链接 pDeviceObject = DriverObject->DeviceObject; IoDeleteDevice(pDeviceObject); //删除设备 DbgPrint("驱动已经被停止了\n"); } //自定义IRP派遣的函数 NTSTATUS MyDispatch(IN PDEVICE_OBJECT device,IN PIRP irp) { PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(irp); irp->IoStatus.Status = STATUS_SUCCESS; irp->IoStatus.Information = 0; if (stack->MajorFunction==IRP_MJ_CREATE) { DbgPrint("IRP_MJ_CREATE\n"); } if (stack->MajorFunction==IRP_MJ_CLOSE) { DbgPrint("IRP_MJ_CLOSE\n"); } IoCompleteRequest(irp, IO_NO_INCREMENT); return STATUS_SUCCESS; } //自定义创建设备和符号链接的函数 NTSTATUS MyCreateDevice (IN PDRIVER_OBJECT pDriverObject) { NTSTATUS status; PDEVICE_OBJECT device; UNICODE_STRING usDevName; UNICODE_STRING usSymLinkName; RtlInitUnicodeString(&usDevName,L"\\Device\\MyDevice"); RtlInitUnicodeString(&usSymLinkName,L"\\DosDevices\\MySymLink"); //创建设备 status = IoCreateDevice(pDriverObject, 0, &usDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &device); if(!NT_SUCCESS(status)) { DbgPrint("创建设备失败\n"); return status; } //创建符号链接 status = IoCreateSymbolicLink(&usSymLinkName,&usDevName); if(!NT_SUCCESS(status)) { IoDeleteDevice(device); DbgPrint("创建符号链接失败\n"); return status; } //设备创建之后，打开初始化完成标记 device->Flags &= ~DO_DEVICE_INITIALIZING; return STATUS_SUCCESS; } NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { MyCreateDevice(DriverObject); DriverObject->MajorFunction[IRP_MJ_CREATE] = MyDispatch; DriverObject->MajorFunction[IRP_MJ_CLOSE] = MyDispatch; DriverObject->DriverUnload = DriverUnload; return STATUS_SUCCESS; } |
转载请注明：exchen's blog » 分发 IRP 函数