windows 驱动 设备过滤步骤以及相关函数学习

步骤如下：

1、获取获取设备对象

2、生成过滤设备

3、设备绑定 

4、把过滤设备绑定到设备对象上

5、进行过滤处理

6、解除设备绑定

7、删除生成的过滤设备

 

涉及函数如下：

1、通过设备名获取设备指针

IoGetDeviceObjectPointer

The IoGetDeviceObjectPointer routine returns a pointer to the top object in the named device object's stack and a pointer to the corresponding file object, if the requested access to the objects can be granted.

NTSTATUS 
  IoGetDeviceObjectPointer(
    IN PUNICODE_STRING  ObjectName,
    IN ACCESS_MASK  DesiredAccess,
    OUT PFILE_OBJECT  *FileObject,
    OUT PDEVICE_OBJECT  *DeviceObject
    );

 

2、生成设备对象

Creating the Filter Device Object

Call IoCreateDevice to create a filter device object to attach to a volume or file system stack. In the FileSpy sample, this is done as follows:

status = IoCreateDevice(
        gFileSpyDriverObject,                 // DriverObject
        sizeof(FILESPY_DEVICE_EXTENSION),     // DeviceExtensionSize
        NULL,                                 // DeviceName
        DeviceObject->DeviceType,             // DeviceType
        0,                                    // DeviceCharacteristics
        FALSE,                                // Exclusive
        &newDeviceObject);                    // DeviceObject

 

3、绑定一个设备到另一个设备上IoAttachDeviceToDeviceStack

The IoAttachDeviceToDeviceStack routine attaches the caller's device object to the highest device object in the chain and returns a pointer to the previously highest device object.

PDEVICE_OBJECT 
  IoAttachDeviceToDeviceStack(
    IN PDEVICE_OBJECT  SourceDevice,
    IN PDEVICE_OBJECT  TargetDevice
    );

Parameters

SourceDevice

Pointer to the caller-created device object.

TargetDevice

Pointer to another driver's device object, such as a pointer returned by a preceding call to IoGetDeviceObjectPointer.

 

4、负责将绑定的设备解除绑

IoDetachDevice

The IoDetachDevice routine releases an attachment between the caller's device object and a lower driver's device object.

VOID 
  IoDetachDevice(
    IN OUT PDEVICE_OBJECT  TargetDevice
    );

Parameters

TargetDevice

Pointer to the lower driver's device object. The caller previously called IoAttachDevice or IoAttachDeviceToDeviceStack successfully to get this pointer.

Return Value

None

 

5、删除这个设备对象

IoDeleteDevice

The IoDeleteDevice routine removes a device object from the system, for example, when the underlying device is removed from the system.

VOID 
  IoDeleteDevice(
    IN PDEVICE_OBJECT  DeviceObject
    );

Parameters

DeviceObject

Pointer to the device object to be deleted.

Return Value

None

其他函数：

1、获得IRP的当前栈空间指针

IoGetCurrentIrpStackLocation

The IoGetCurrentIrpStackLocation routine returns a pointer to the caller's stack location in the given IRP.

PIO_STACK_LOCATION 
  IoGetCurrentIrpStackLocation(
    IN PIRP  Irp
    );

Parameters

Irp

Pointer to the IRP.

Return Value

The routine returns a pointer to the I/O stack location for the driver.

 

2、所有电源操作，全部直接放过代码

                // 直接发送，然后返回说已经被处理了。
                PoStartNextPowerIrp(irp);//vista已经不需要
                IoSkipCurrentIrpStackLocation(irp);
                return PoCallDriver(s_nextobj[i],irp);

 3、其它非电源请求，直接下发执行即可。不禁止或者改变它代码
            IoSkipCurrentIrpStackLocation(irp);
            return IoCallDriver(s_nextobj[i],irp);