Windows内核空间映射到用户空间实现用户进程间通信

DriverEntry.c

#include <ntddk.h>

#define DEVICE_NAME		L"\\Device\\MyDDKDevice1"
#define SYMBOLIC_LINK_NAME	L"\\??\\MyDDKDevice1"
//#define DEVICE_EX_SIZE		200

//读设备
#define READ_CTL_CODE CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_READ_ACCESS)

//写设备
#define WRITE_CTL_CODE CTL_CODE(FILE_DEVICE_UNKNOWN,0x831,METHOD_BUFFERED,FILE_WRITE_ACCESS)

//获取内核分配的非分页内存在用户空间中的虚拟地址
#define GET_PTR_CTL_CODE CTL_CODE(FILE_DEVICE_UNKNOWN,0x832,METHOD_BUFFERED,FILE_READ_ACCESS)

//取消内核分配的非分页内存映射到用户空间
#define UNMAP_CTL_CODE CTL_CODE(FILE_DEVICE_UNKNOWN,0x833,METHOD_BUFFERED,FILE_READ_ACCESS)

typedef struct 
{
	PVOID kva;
	PMDL pMdl;
}DeviceExtension;

VOID KeSleep(LONG msec)
{
	LARGE_INTEGER interval;
	interval.QuadPart = -10000; // 100ns units, -10000 means 10ms
	interval.QuadPart *= msec;
	KeDelayExecutionThread(KernelMode, FALSE, &interval);
}

VOID DriverUnload(__in struct _DRIVER_OBJECT* DriverObject)
{
	DeviceExtension* pdx;
	UNICODE_STRING symbolLinkName;
	DbgPrint("DriverUnload\n");

	pdx = DriverObject->DeviceObject->DeviceExtension;
	if (pdx->kva != NULL && pdx->pMdl != NULL)
	{
		IoFreeMdl(pdx->pMdl);
		ExFreePool(pdx->kva);
	}

	if (DriverObject->DeviceObject)
		IoDeleteDevice(DriverObject->DeviceObject);
	RtlInitUnicodeString(&symbolLinkName, SYMBOLIC_LINK_NAME);
	IoDeleteSymbolicLink(&symbolLinkName);
}

NTSTATUS OnCreateDevice(__in struct _DEVICE_OBJECT* DeviceObject, __inout struct _IRP* Irp)
{
	NTSTATUS status = STATUS_SUCCESS;
	DbgPrint("OnCreateDevice\n");
	Irp->IoStatus.Status = status;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);
	return status;
}

NTSTATUS OnReadDevice(__in struct _DEVICE_OBJECT* DeviceObject, __inout struct _IRP* Irp)
{
	NTSTATUS status = STATUS_SUCCESS;
	PIO_STACK_LOCATION stack;
	ULONG wantRead;
	char* pData = "This data is from kernel.";
	int len = strlen(pData) + 1;

	DbgPrint("OnReadDevice\n");

	stack = IoGetCurrentIrpStackLocation(Irp);
	wantRead = stack->Parameters.Read.Length;//用户想要读取的字节数
	DbgPrint("App wants to read %d bytes\n", wantRead);

	// 完成IRP
	//设置IRP完成状态
	Irp->IoStatus.Status = status;

	//设置IRP操作了多少字节
	Irp->IoStatus.Information = len;

	DbgPrint("readBuf address:%p\n", Irp->AssociatedIrp.SystemBuffer);
	memcpy(Irp->AssociatedIrp.SystemBuffer,