typedef struct _DRIVER_OBJECT

本文详细介绍了DRIVER_OBJECT结构,这是Windows驱动程序中关键的数据结构之一。它包含了驱动程序的各种属性和函数指针,如初始化、卸载函数、设备对象列表等。通过对该结构的理解,开发者可以更好地掌握驱动程序的工作原理。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

typedef struct _DRIVER_OBJECT {
    CSHORT Type;
    CSHORT Size;

    //
    // The following links all of the devices created by a single driver
    // together on a list, and the Flags word provides an extensible flag
    // location for driver objects.
    //

    PDEVICE_OBJECT DeviceObject;
    ULONG Flags;

    //
    // The following section describes where the driver is loaded.  The count
    // field is used to count the number of times the driver has had its
    // registered reinitialization routine invoked.
    //

    PVOID DriverStart;
    ULONG DriverSize;
    PVOID DriverSection;
    PDRIVER_EXTENSION DriverExtension;

    //
    // The driver name field is used by the error log thread
    // determine the name of the driver that an I/O request is/was bound.
    //

    UNICODE_STRING DriverName;

    //
    // The following section is for registry support.  Thise is a pointer
    // to the path to the hardware information in the registry
    //

    PUNICODE_STRING HardwareDatabase;

    //
    // The following section contains the optional pointer to an array of
    // alternate entry points to a driver for "fast I/O" support.  Fast I/O
    // is performed by invoking the driver routine directly with separate
    // parameters, rather than using the standard IRP call mechanism.  Note
    // that these functions may only be used for synchronous I/O, and when
    // the file is cached.
    //

    PFAST_IO_DISPATCH FastIoDispatch;

    //
    // The following section describes the entry points to this particular
    // driver.  Note that the major function dispatch table must be the last
    // field in the object so that it remains extensible.
    //

    PDRIVER_INITIALIZE DriverInit;
    PDRIVER_STARTIO DriverStartIo;
    PDRIVER_UNLOAD DriverUnload;
    PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];

} DRIVER_OBJECT;
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; 

#include <ntddk.h> #include <wdm.h> #include <ntddndis.h> // 调试级别定义(必须放在所有include之后) #define DPFLTR_IHVDRIVER_ID 0x63 // 自定义驱动标识(0-63) #define MYDRIVER_TRACE_LEVEL_INFO DPFLTR_INFO_LEVEL // 0x0 #define MYDRIVER_TRACE_LEVEL_WARNING DPFLTR_WARNING_LEVEL // 0x1 #define MYDRIVER_TRACE_LEVEL_ERROR DPFLTR_ERROR_LEVEL // 0x2 #define MYDRIVER_TRACE_LEVEL_VERBOSE 0x3 // 自定义详细级别 #define IOCTL_PROTOCOL_CONTROL CTL_CODE(FILE_DEVICE_NETWORK, 0x800, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) typedef struct _PROTOCOL_DRIVER { PDEVICE_OBJECT DeviceObject; PFILE_OBJECT FileObject; KEVENT CompletionEvent; IO_STATUS_BLOCK IoStatus; } PROTOCOL_DRIVER; // 协议特征结构 typedef struct _PROTOCOL_CHARACTERISTICS { ULONG Magic; USHORT HeaderSize; UCHAR Checksum; } PROTOCOL_CHARACTERISTICS; // 全局变量 PROTOCOL_DRIVER g_ProtocolDriver; PROTOCOL_CHARACTERISTICS g_ProtocolChars = { 0x4E455449, sizeof(PROTOCOL_CHARACTERISTICS), 0xAA }; // IRP完成回调 NTSTATUS ProtocolIoCompletion( _In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp, _In_ PVOID Context) { UNREFERENCED_PARAMETER(DeviceObject); PKEVENT event = (PKEVENT)Context; KeSetEvent(event, IO_NO_INCREMENT, FALSE); return STATUS_MORE_PROCESSING_REQUIRED; } // 绑定到协议驱动 NTSTATUS AttachToProtocolDriver() { UNICODE_STRING protoName; RtlInitUnicodeString(&protoName, L"\\Device\\Tcp"); NTSTATUS status = IoGetDeviceObjectPointer( &protoName, FILE_ALL_ACCESS, &g_ProtocolDriver.FileObject, &g_ProtocolDriver.DeviceObject); if (!NT_SUCCESS(status)) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_LEVEL_ERROR, "[%s] Failed to attach to protocol driver: 0x%X\n", __FUNCTION__, status); return status; } DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_LEVEL_INFO, "[%s] Successfully attached to protocol driver at 0x%p\n", __FUNCTION__, g_ProtocolDriver.DeviceObject); return STATUS_SUCCESS; }
03-31
/* File Kmd.h By WzrterFX */ #pragma once #ifndef KMD_H #define KMD_H #include <cstdint> #include <ntifs.h> namespace Kmd { namespace _NtifsApi { extern “C” __declspec(dllimport) NTSTATUS __stdcall IoCreateDriver( IN PUNICODE_STRING DriverName, IN PDRIVER_INITIALIZE InitializationFunction ); extern "C" __declspec(dllimport) NTSTATUS __stdcall PsLookupProcessByProcessId( IN HANDLE ProcessId, OUT PEPROCESS* Process ); extern "C" __declspec(dllimport) NTSTATUS __stdcall MmCopyVirtualMemory( IN PEPROCESS FromProcess, IN PVOID FromAddress, IN PEPROCESS ToProcess, IN PVOID ToAddress, IN SIZE_T BufferSize, IN KPROCESSOR_MODE PreviousMode, OUT PSIZE_T NumberOfBytesCopied ); } namespace _IoCtls { constexpr std::uint32_t attach = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x01, METHOD_BUFFERED, FILE_SPECIAL_ACCESS ); constexpr std::uint32_t read = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x02, METHOD_BUFFERED, FILE_SPECIAL_ACCESS ); constexpr std::uint32_t write = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x03, METHOD_BUFFERED, FILE_SPECIAL_ACCESS ); } class Kmd { private: PDEVICE_OBJECT _deviceObject; typedef struct __AttachRequest { HANDLE process; } AttachRequest, * PAttachRequest; typedef struct __CopyMemoryRequest { PVOID from; PVOID to; SIZE_T requested; } CopyMemoryRequest, * PCopyMemoryRequest; typedef struct _KmdRequest { AttachRequest attachRequest; CopyMemoryRequest copyMemoryRequest; } KmdRequest, * PKmdRequest; static NTSTATUS KmdControl(PDEVICE_OBJECT deviceObject, PIRP io); public: NTSTATUS Create(PDRIVER_OBJECT driverObject); }; } #endif /* !KMD_H */这个可以单独加载使用吗
03-24
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值