/*
File Kmd.cpp
By WzrterFX
*/
#include "Kmd.h"
namespace Kmd {
NTSTATUS Kmd::Create(PDRIVER_OBJECT driverObject) {
NTSTATUS status = STATUS_UNSUCCESSFUL;
UNICODE_STRING
deviceName { };
RtlInitUnicodeString(&
deviceName, L"\\
Device\\Kmd");
status =
IoCreate
Device(
driverObject, NULL, &
deviceName,
FILE_
DEVICE_UNKNOWN, FILE_
DEVICE_SECURE_OPEN, FALSE, &_
deviceObject
);
if (!NT_SUCCESS(status)) {
DbgPrintEx(0, 0,
"Fatal, failed to create driver
device.\n"
);
return status;
}
UNICODE_STRING symbolicLink { };
RtlInitUnicodeString(&symbolicLink, L"\\Dos
Devices\\Kmd");
status =
IoCreateSymbolicLink(&symbolicLink, &
deviceName);
if (!NT_SUCCESS(status)) {
DbgPrintEx(0, 0,
"Fatal, failed to establish driver link.\n"
);
IoDelete
Device(_
deviceObject);
return status;
}
SetFlag(_
deviceObject
->Flags, DO_BUFFERED_
IO);
driverObject
->MajorFunct
ion[IRP_MJ_CREATE] = [](P
DEVICE_OBJECT, PIRP
io)
-> NTSTATUS {
IoCompleteRequest(
io,
IO_NO_INCREMENT);
return
io->
IoStatus.Status;
};
driverObject
->MajorFunct
ion[IRP_MJ_CLOSE] = [](P
DEVICE_OBJECT, PIRP
io)
-> NTSTATUS {
IoCompleteRequest(
io,
IO_NO_INCREMENT);
return
io->
IoStatus.Status;
};
driverObject
->MajorFunct
ion[IRP_MJ_
DEVICE_CONTROL] = &this
->KmdControl;
ClearFlag(_
deviceObject
->Flags, DO_
DEVICE_INITIALIZING);
return STATUS_SUCCESS;
}
NTSTATUS Kmd::KmdControl(P
DEVICE_OBJECT, PIRP
io) {
NTSTATUS status = STATUS_UNSUCCESSFUL;
P
IO_
STACK_
LOCATION stack =
IoGetCurrentIrp
StackLocation(
io);
if (!
stack) {
IoCompleteRequest(
io,
IO_NO_INCREMENT);
DbgPrintEx(0, 0,
"Fatal, missing driver
stack location.\n"
);
return status;
}
PKmdRequest request = reinterpret_cast<PKmdRequest>(
io->AssociatedIrp.SystemBuffer);
if (!request) {
IoCompleteRequest(
io,
IO_NO_INCREMENT);
DbgPrintEx(0, 0,
"Fatal, missing driver associated request.\n"
);
return status;
}
static PEPROCESS process { };
static SIZE_T reserved { };
switch (
stack->Parameters.
DeviceIoControl.
IoControlCode) {
case ::Kmd::_
IoCtls::attach: {
status = ::Kmd::_NtifsApi::PsLookupProcessByProcessId(
request
->attachRequest.process, &process
);
break;
}
case ::Kmd::_
IoCtls::read: {
if (process) {
status = ::Kmd::_NtifsApi::MmCopyVirtualMemory(
process, request
->copyMemoryRequest.from, PsGetCurrentProcess(), request
->copyMemoryRequest.to,
request
->copyMemoryRequest.requested,
MODE::KernelMode, &reserved
);
}
break;
}
case ::Kmd::_
IoCtls::write: {
if (process) {
status = ::Kmd::_NtifsApi::MmCopyVirtualMemory(
PsGetCurrentProcess(), request
->copyMemoryRequest.to, process, request
->copyMemoryRequest.from,
request
->copyMemoryRequest.requested,
MODE::KernelMode, &reserved
);
}
break;
}
default: {
status = STATUS_INVALID_
DEVICE_REQUEST;
break;
}
}
io->
IoStatus.Status = status;
io->
IoStatus.Informat
ion = sizeof(KmdRequest);
IoCompleteRequest(
io,
IO_NO_INCREMENT);
return status;
}
}帮我全部加上注释
本文介绍了作者在学习文件系统过滤驱动时对设备栈、IO栈和IO_STACK_LOCATION的理解。文章指出，文件系统驱动创建设备对象并处理IRP，而过滤驱动用于拦截和处理IRP。设备栈是由设备对象形成的链，IRP通过设备栈传递，IO_STACK_LOCATION在IRP中记录每个设备的请求参数。文章详细解释了IRP的传递、设备之间的关系以及IRP处理过程中的IO_STACK_LOCATION如何保持一致。
订阅专栏 解锁全文
扫一扫
2313
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
