青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.¢%

像打了激速一樣,以四倍的速度運轉,開心的工作
簡單、開放、平等的公司文化;尊重個性、自由與個人價值;
posts - 1098, comments - 335, trackbacks - 0, articles - 1
  C++博客 :: 首頁 :: 新隨筆 :: 聯系 :: 聚合  :: 管理

Writing a device driver for Windows

Posted on 2009-10-30 11:04 S.l.e!ep.¢% 閱讀(594) 評論(1)  編輯 收藏 引用 所屬分類: RootKit

Writing a device driver for Windows

In order to write a device driver for windows, one needs the device driver development kit (ddk) and a c compiler.
According to this article, a device driver's maximum size is 960MB on Windows XP (100MB on NT4, 220MB on Win2K).

Setting up the environment

A proper environment must be setup. Use setenv (which ships with the ddk) to set the environment variables (and what not) to build a driver:
C:\>programme\ntddk\bin\setenv \programme\ntddk.
The argument that is given to setenv must point to the directory under which the ddk is installed.

makefile

The directory that contains the sources for the device driver must have a file called makefile and another file called sources. For a simple device driver, it is sufficient to have one single line in the makefile:
!INCLUDE $(NTMAKEENV)\makefile.def

sources

This file actually contains the names of the files to be compiled:
TARGETNAME=kamel
TARGETPATH=obj
TARGETTYPE=DRIVER

SOURCES=kamel.c writeEvent.c kamelMsg.rc

C_DEFINES=-DUNICODE -DSTRICT
kamel.c is the code for the driver itself, writeEvent.c contains a function that can be called to write messages to the system event log (see below) and kamelMsg.rc contains the strings that are written

Writing the driver

I call the driver we're going to write Kamel. In german, this will then be called Kameltreiber which is a pun german speaking people will understand. So, we're creating (according to the sources file) a file called kamel.c. The first lines contain the includes we need:
#include "ntddk.h"
#include "writeEvent.h"
#include "kamelMsg.h"
ntddk.h must always be included, writeEvent.h contains the declaration of WriteEvent (which is a function to write events, of course) and kamelMsg.h (being created by the message compiler) contains the identifiers of the strings we want to write using WriteEvent.
Each driver needs a DriverEntry function which is called when the driver is loaded:
Now, we use write the forward declarations together with the pragmas alloc_text. They indicate wheather or not the function is pageable.
#define BUFFERSIZE 1024
#define BUFFERTAG  'kmlb'

typedef struct _KAMEL_DRIVER_EXTENSION {
  char buffer[BUFFERSIZE];
} KAMEL_DRIVER_EXTENSION, *PKAMEL_DRIVER_EXTENSION;

KAMEL_DRIVER_EXTENSION* driverExtension=0;


NTSTATUS DriverEntry  (IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
NTSTATUS CreateCamel  (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS ReadCamel    (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS WriteCamel   (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS ShutdownCamel(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS CleanupCamel (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS IoCtlCamel   (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID     CmlUnload    (IN PDRIVER_OBJECT  DriverObject);


#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(PAGE, CreateCamel) 
#pragma alloc_text(PAGE, ReadCamel) 
#pragma alloc_text(PAGE, WriteCamel) 
#pragma alloc_text(PAGE, ShutdownCamel)
#pragma alloc_text(PAGE, IoCtlCamel)
#pragma alloc_text(PAGE, CmlUnload)
#endif
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) {

  UNICODE_STRING nameString, linkString;
  PDEVICE_OBJECT deviceObject;
  NTSTATUS status;

  WriteEvent(MSG_DRIVER_ENTRY,DriverObject,NULL);

  RtlInitUnicodeString(&nameString, L"\\Device\\Kamel");

  status = IoCreateDevice(
    DriverObject, 
    sizeof(65533),
    &nameString, 
    0, //FILE_DEVICE_UNKNOWN,
    0, 
    FALSE, 
    &deviceObject);

  if (!NT_SUCCESS(status))
    return status;


  deviceObject->Flags |= DO_DIRECT_IO;
  deviceObject->Flags &= ~DO_DEVICE_INITIALIZING;


  RtlInitUnicodeString(&linkString, L"\\DosDevices\\Kamel");
  status = IoCreateSymbolicLink (&linkString, &nameString);

  if (!NT_SUCCESS(status)) {
    IoDeleteDevice (DriverObject->DeviceObject);
    return status;
  }


  DriverObject->MajorFunction[IRP_MJ_CREATE]         = CreateCamel;
  DriverObject->MajorFunction[IRP_MJ_READ]           = ReadCamel;
  DriverObject->MajorFunction[IRP_MJ_WRITE]          = WriteCamel;
  DriverObject->MajorFunction[IRP_MJ_SHUTDOWN]       = ShutdownCamel;
  DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IoCtlCamel;
  
  DriverObject->DriverUnload=CmlUnload;

  // ExAllocatePool is obsolete and ExAllocatePoolWithTag should be used.
  driverExtension = ExAllocatePool(NonPagedPool, sizeof (KAMEL_DRIVER_EXTENSION));

  if(!driverExtension) {
    WriteEvent(MSG_NO_IOALLOCATEDRIVEROBJECTEXTENSION, DriverObject, NULL);
    return STATUS_INSUFFICIENT_RESOURCES;
  }

  RtlZeroMemory(driverExtension->buffer, BUFFERSIZE);

  RtlCopyBytes (driverExtension->buffer, "123456789012345", 16);

  return STATUS_SUCCESS;
}
DriverEntry first writes an Event (using WriteEvent, explained later) so it can be verified that DriverEntry indeed was called. Then, the actual device is created using IoCreateDevice and initialized.

Setting Up Major Functions

An Application communicates with a driver with the driver's Major Functions. These are set in the drivers array of function pointers MajorFunction.

User Visible Name for the driver

In order to create a user-visible name for the device just created, IoCreateSymbolicLink is called.

Allocating Pool Memory

The driver allocates some Pool Memory with ExAllocatePool.
By the way, Paged and Non-Paged Pool Memory sized can be adjusted with the registry keys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\(Non)PagedPoolSize. The Value specified is the size in bytes.

Programming the Major Functions

In DriverEntry, the Major Functions IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_SHUTDOWN, IRP_MJ_DEVICE_CONTROL were set. Here are the actual functions they point to:

IRP_MJ_CREATE

This function is called when a file using this deivce is created. In Win32Api, Devices are opened using CreateFile which then routes in the function associated with IRP_MJ_CREATE.
NTSTATUS CreateCamel (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) {
  WriteEvent(MSG_CREATE,(PVOID)DeviceObject,NULL);

  IoCompleteRequest(Irp,IO_NO_INCREMENT);
  return  STATUS_SUCCESS;
}

IRP_MJ_READ

NTSTATUS ReadCamel(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) {
  PUCHAR                      currentAddress;
  PIO_STACK_LOCATION          irpStack;

  WriteEvent(MSG_READ,DeviceObject,NULL);

  if (!driverExtension) {
    WriteEvent(MSG_DRIVEREXTISNULLINREAD,DeviceObject,NULL);
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_INSUFFICIENT_RESOURCES;
  }
  irpStack = IoGetCurrentIrpStackLocation(Irp);

  if (irpStack->MajorFunction == IRP_MJ_READ) {
    currentAddress = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);

    if (!currentAddress) {
      WriteEvent(MSG_MMGETSYSTEMADDRESS,DeviceObject,NULL);
      IoCompleteRequest(Irp, IO_NO_INCREMENT);
      return STATUS_SUCCESS;
    }
    RtlMoveMemory(currentAddress, 
    driverExtension->buffer+irpStack->Parameters.Read.ByteOffset.LowPart,
    irpStack->Parameters.Read.Length);
  }
  else {
    WriteEvent(MSG_MAJORFUNC_NOT_READ,DeviceObject,NULL);
  }

  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}
A driver should call IoGetCurrentIrpStackLocation in its IRP function to receive a pointer to a IO_STACK_LOCATION structure.
MmGetSystemAddressForMdlSafe is a macro. It returns a virtual address to non system-space for the buffer described by the MDL.

IRP_MJ_WRITE

NTSTATUS WriteCamel(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) {
  PUCHAR                      currentAddress;
  PIO_STACK_LOCATION          irpStack;

  if (!driverExtension) {
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_INSUFFICIENT_RESOURCES;
  }

  irpStack = IoGetCurrentIrpStackLocation(Irp);

  if (irpStack->MajorFunction == IRP_MJ_WRITE) {
    currentAddress = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);

    if (!currentAddress) {
      IoCompleteRequest(Irp, IO_NO_INCREMENT);
      return STATUS_SUCCESS;
    }

    RtlMoveMemory(driverExtension->buffer+irpStack->Parameters.Write.ByteOffset.LowPart,
        currentAddress, irpStack->Parameters.Write.Length);
  }
  else {
    WriteEvent(MSG_MAJORFUNC_NOT_READ,DeviceObject,NULL);
  }

  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

IRP_MJ_SHUTDOWN

NTSTATUS ShutdownCamel(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) {
  WriteEvent(MSG_SHUTDOWN,DeviceObject,NULL);
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

IRP_MJ_DEVICE_CONTROL

NTSTATUS IoCtlCamel(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) {
  WriteEvent(MSG_IOCTL,DeviceObject,NULL);
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

The unload function

VOID CmlUnload (IN PDRIVER_OBJECT  DriverObject) {
  UNICODE_STRING linkString;

  WriteEvent(MSG_DRIVERUNLOAD, DriverObject, NULL);
  ExFreePool(driverExtension);
  RtlInitUnicodeString (&linkString, L"\\DosDevices\\Kamel");
  IoDeleteSymbolicLink (&linkString);
  IoDeleteDevice(DriverObject->DeviceObject);
}

Writing Events from a Device Driver

It is possible to write strings from the driver into the system event box (which then can be viewed with the event viewer (eventvwr.exe). It is not straight forward however and the following steps must each be done.

The Message File

First, a message file must be created, having the suffix .mc, that contains each possible string you want to output and also assignes a unique id to these strings. A sample is given here:
MessageID    = 1
Severity     = Informational
SymbolicName = MSG_DRIVER_ENTRY
Language     = English
Driver Entry
.
MessageID    = 2
Severity     = Informational
SymbolicName = MSG_CREATE
Language     = English
Create
.
Each Entry must be followed by a single dot on its own line. In this sample, the unique Id is associated with the symbolic name MSG_DRIVER_ENTRY and the String "Driver Entry". If you take a look at DriverEntry above, you'll see that I call WriteEvent with the symbolic name MSG_DRIVER_ENTRY.
The Message File then is to be compiled with the message compiler mc: mc KamelMsg.mc on the command line. This produces a file called MessageFile.rc. KamelMsg.rc must be included in the sources file. It also creates the file KamelMsg.h which must be included to have the constants.
This is still not sufficient. Also a string entry must be created in the Registry under HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\<driverName>\EventMessageFile. The string must point to the .dll or .sys into which the messages were compiled, in our case: %SystemRoot%\System32\Drivers\Kamel.sys

WriteEvent

BOOLEAN WriteEvent(IN NTSTATUS ErrorCode , IN PVOID IoObject,IN PIRP Irp) {
  PIO_ERROR_LOG_PACKET Packet;
  PIO_STACK_LOCATION IrpStack;
  PWCHAR pInsertionString;
  STRING AnsiInsertString;
  UNICODE_STRING UniInsertString;

  UCHAR PacketSize;

  PacketSize = sizeof(IO_ERROR_LOG_PACKET);

  Packet = IoAllocateErrorLogEntry(IoObject,PacketSize);
  if (Packet == NULL) return FALSE;

  Packet->ErrorCode         = ErrorCode;
  Packet->UniqueErrorValue  = 0,
  Packet->RetryCount        = 0;
  Packet->SequenceNumber    = 0;
  Packet->IoControlCode     = 0;
  Packet->DumpDataSize      = 0;
  
  if (Irp!=NULL) {
     IrpStack=IoGetCurrentIrpStackLocation(Irp);
     Packet->MajorFunctionCode = IrpStack->MajorFunction;
     Packet->FinalStatus = Irp->IoStatus.Status;
  } 
  else {
     Packet->MajorFunctionCode = 0;
     Packet->FinalStatus       = 0;
  }

  IoWriteErrorLogEntry(Packet);
  return TRUE;
}

WriteEvent.h

BOOLEAN WriteEvent(IN NTSTATUS ErrorCode , IN PVOID IoObject,IN PIRP Irp); 
#pragma alloc_text(PAGE, WriteEvent)

Entries in the registry

The driver must be registred with the registry: Create a this key HKLM\System\CurrentControlSet\Services\<driverName> and add the following keys: ErrorControl, Group, Start, Tag and Type.

Feedback

# re: Writing a device driver for Windows  回復  更多評論   

2009-10-30 15:20 by 溪流
mark. thx.
青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品
  • <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>
    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>
            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            日韩一级大片在线| 欧美午夜精品一区二区三区| 激情综合色综合久久综合| 欧美有码在线观看视频| 亚洲午夜伦理| 国产亚洲福利| 欧美成人精品h版在线观看| 亚洲第一精品在线| 鲁大师影院一区二区三区| 久久久久久久久伊人| 91久久在线| 一二三四社区欧美黄| 国产精品日韩电影| 毛片av中文字幕一区二区| 欧美成人四级电影| 亚洲欧美日韩天堂一区二区| 欧美一区二区三区免费观看视频 | 亚洲精品一区二区三| 欧美日韩日日夜夜| 久久久999精品| 欧美极品在线观看| 久久国产精品一区二区| 欧美二区不卡| 久久久久久久久久看片| 欧美国产日本高清在线| 欧美在线视频一区二区| 蜜臀91精品一区二区三区| 亚洲欧美日韩中文视频| 麻豆国产精品777777在线| 午夜一区在线| 欧美日本中文字幕| 久久久亚洲欧洲日产国码αv| 欧美连裤袜在线视频| 久久婷婷久久| 国产精品天天看| 亚洲毛片在线观看| 亚洲国产精品成人| 性欧美8khd高清极品| 日韩亚洲综合在线| 久久综合给合| 久久成人资源| 国产精品久久久久久久电影 | 欧美成人精品三级在线观看| 国产精品视频午夜| 亚洲美女中文字幕| 亚洲三级国产| 狼狼综合久久久久综合网 | 一区二区三区四区蜜桃| 久久亚洲午夜电影| 久久久蜜桃一区二区人| 国产精品永久| 亚洲一区亚洲| 小黄鸭精品aⅴ导航网站入口| 欧美日韩综合精品| 日韩视频一区二区三区在线播放| 亚洲第一在线| 欧美jizzhd精品欧美巨大免费| 噜噜噜91成人网| 国语自产在线不卡| 久久精品国产一区二区电影 | 久久激情视频免费观看| 国产精品久久久久久久久久免费| 99re66热这里只有精品4| 亚洲精品综合久久中文字幕| 欧美xxx成人| 亚洲精品在线观看免费| 日韩香蕉视频| 国产精品www.| 亚洲欧美在线aaa| 久久久精品一区| 黄色精品一二区| 美女国产一区| 亚洲精品偷拍| 亚洲欧美视频在线| 国产午夜一区二区三区| 久久精品综合网| 亚洲高清av在线| 91久久精品国产91久久性色tv| 欧美国产日韩视频| 亚洲最新在线视频| 久久se精品一区二区| 国产一区二区欧美日韩| 可以免费看不卡的av网站| 欧美国产日产韩国视频| 一区二区三区国产盗摄| 国产精品久久久久国产a级| 午夜伦欧美伦电影理论片| 久久免费视频这里只有精品| 亚洲激情电影在线| 国产精品a久久久久| 欧美在线免费观看| 亚洲高清不卡| 久久国产毛片| 日韩一级黄色av| 国产视频在线观看一区| 噜噜噜在线观看免费视频日韩| 一本一本久久| 免费亚洲一区二区| 一二三区精品福利视频| 国产欧美亚洲精品| 牛牛影视久久网| 亚洲欧美电影在线观看| 欧美高清视频在线观看| 午夜国产一区| 亚洲久久一区| 国外精品视频| 国产精品高精视频免费| 久久免费偷拍视频| 午夜电影亚洲| 99视频有精品| 亚洲第一精品夜夜躁人人爽| 欧美一区2区视频在线观看 | 国产亚洲欧美一区二区| 欧美精品成人| 久久综合伊人77777麻豆| 亚洲一区欧美一区| 亚洲欧洲精品一区二区| 久久综合狠狠综合久久综合88| 亚洲天堂av高清| 亚洲人成网站在线播| 国产亚洲电影| 国产精品久久久免费| 欧美va亚洲va日韩∨a综合色| 欧美一级免费视频| 一区二区三区高清不卡| 亚洲国产成人精品视频| 免费影视亚洲| 久久蜜臀精品av| 欧美一级视频精品观看| 亚洲一区二区三区在线看| 亚洲美女少妇无套啪啪呻吟| 黑人极品videos精品欧美裸| 国产欧美日韩激情| 国产精品海角社区在线观看| 欧美日韩精品在线播放| 欧美经典一区二区三区| 免费观看成人www动漫视频| 久久久国产一区二区| 久久国产日韩欧美| 久久不射网站| 久久人人超碰| 免费在线国产精品| 欧美bbbxxxxx| 欧美日本在线一区| 欧美深夜福利| 国产精品视频一区二区高潮| 国产精品你懂的在线欣赏| 国产精品黄视频| 国产乱理伦片在线观看夜一区| 国产精品国产三级国产专区53| 欧美日韩精品一区二区| 欧美日韩国产在线一区| 国产精品观看| 国产日产欧美精品| 黑丝一区二区三区| 亚洲国产精品精华液网站| 亚洲精品视频在线播放| 夜夜嗨av一区二区三区| 中文精品在线| 久久久精品五月天| 亚洲第一二三四五区| 亚洲欧洲一区二区在线观看 | 亚洲丰满在线| 亚洲视频每日更新| 久久精品国产第一区二区三区| 久久久之久亚州精品露出| 美女精品国产| 欧美亚洲成人精品| 狠狠综合久久av一区二区老牛| 亚洲国产精品视频| 国产精品99久久99久久久二8| 欧美一区二粉嫩精品国产一线天| 久久久久久久久久久久久9999| 欧美/亚洲一区| av成人免费在线观看| 欧美专区在线观看| 欧美日本不卡高清| 红桃视频国产精品| 亚洲午夜精品网| 麻豆久久精品| 亚洲一区在线观看视频 | 在线一区观看| 久久人91精品久久久久久不卡| 欧美精品一区二区视频| 国户精品久久久久久久久久久不卡| 亚洲人在线视频| 久久久亚洲人| 亚洲一区免费看| 欧美国产精品久久| 国模精品一区二区三区| 一区二区欧美日韩视频| 另类酷文…触手系列精品集v1小说| 日韩网站在线观看| 久久中文在线| 国产一区二区在线观看免费| 亚洲一区二区黄| 亚洲黄页视频免费观看| 久久九九精品99国产精品| 国产精品国产福利国产秒拍 | 国内外成人免费视频 |