驱动对象,设备对象,IRP之间的关系?
- 类似于程序,窗口,消息三者之间的关系;
- 每个驱动程序只有一个驱动对象(程序实例句柄),一个驱动对象对应若干个(大于等于1个)设备对象(窗口),每个设备对象可以处理不同的IRP(I/O请求包,I/O Request Package)
IRP栈：
IRP其实本质上是由IRP头部和IRP栈组成,一般所说的IRP只是"I/O请求包"IRP的头部,在IRP数据结构的后面还有一个IO_STACK_LOCATION结构体数组
typedef struct _IO_STACK_LOCATION {
UCHAR MajorFunction;
UCHAR MinorFunction;
UCHAR Flags;
UCHAR Control;
//
// The following user parameters are based on the service that is being
// invoked. Drivers and file systems can determine which set to use based
// on the above major and minor function codes.
//
union {
//
// System service parameters for: NtCreateFile
//
struct {
PIO_SECURITY_CONTEXT SecurityContext;
ULONG Options;
USHORT POINTER_ALIGNMENT FileAttributes;
USHORT ShareAccess;
ULONG POINTER_ALIGNMENT EaLength;
} Create;
//
// System service parameters for: NtReadFile
//
struct {
ULONG Length;
ULONG POINTER_ALIGNMENT Key;
LARGE_INTEGER ByteOffset;
} Read;
//
// System service parameters for: NtWriteFile
//
struct {
ULONG Length;
ULONG POINTER_ALIGNMENT Key;
LARGE_INTEGER ByteOffset;
} Write;
//
// System service parameters for: NtQueryInformationFile
//
struct {
ULONG Length;
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
} QueryFile;
//
// System service parameters for: NtSetInformationFile
//
struct {
ULONG Length;
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
PFILE_OBJECT FileObject;
union {
struct {
BOOLEAN ReplaceIfExists;
BOOLEAN AdvanceOnly;
};
ULONG ClusterCount;
HANDLE DeleteHandle;
};
} SetFile;
//
// System service parameters for: NtQueryVolumeInformationFile
//
struct {
ULONG Length;
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
} QueryVolume;
//
// System service parameters for: NtFlushBuffersFile
//
// No extra user-supplied parameters.
//
//
// System service parameters for: NtDeviceIoControlFile
//
// Note that the user's output buffer is stored in the UserBuffer field
// and the user's input buffer is stored in the SystemBuffer field.
//
struct {
ULONG OutputBufferLength;
ULONG POINTER_ALIGNMENT InputBufferLength;
ULONG POINTER_ALIGNMENT IoControlCode;
PVOID Type3InputBuffer;
} DeviceIoControl;
// end_wdm
//
// System service parameters for: NtQuerySecurityObject
//
struct {
SECURITY_INFORMATION SecurityInformation;
ULONG POINTER_ALIGNMENT Length;
} QuerySecurity;
//
// System service parameters for: NtSetSecurityObject
//
struct {
SECURITY_INFORMATION SecurityInformation;
PSECURITY_DESCRIPTOR SecurityDescriptor;
} SetSecurity;
// begin_wdm
//
// Non-system service parameters.
//
// Parameters for MountVolume
//
struct {
PVPB Vpb;
PDEVICE_OBJECT DeviceObject;
} MountVolume;
//
// Parameters for VerifyVolume
//
struct {
PVPB Vpb;
PDEVICE_OBJECT DeviceObject;
} VerifyVolume;
//
// Parameters for Scsi with internal device contorl.
//
struct {
struct _SCSI_REQUEST_BLOCK *Srb;
} Scsi;
//
// Parameters for IRP_MN_QUERY_DEVICE_RELATIONS
//
struct {
DEVICE_RELATION_TYPE Type;
} QueryDeviceRelations;
//
// Parameters for IRP_MN_QUERY_INTERFACE
//
struct {
CONST GUID *InterfaceType;
USHORT Size;
USHORT Version;
PINTERFACE Interface;
PVOID InterfaceSpecificData;
} QueryInterface;
// end_ntifs
//
// Parameters for IRP_MN_QUERY_CAPABILITIES
//
struct {
PDEVICE_CAPABILITIES Capabilities;
} DeviceCapabilities;
//
// Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS
//
struct {
PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
} FilterResourceRequirements;
//
// Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG
//
struct {
ULONG WhichSpace;
PVOID Buffer;
ULONG Offset;
ULONG POINTER_ALIGNMENT Length;
} ReadWriteConfig;
//
// Parameters for IRP_MN_SET_LOCK
//
struct {
BOOLEAN Lock;
} SetLock;
//
// Parameters for IRP_MN_QUERY_ID
//
struct {
BUS_QUERY_ID_TYPE IdType;
} QueryId;
//
// Parameters for IRP_MN_QUERY_DEVICE_TEXT
//
struct {
DEVICE_TEXT_TYPE DeviceTextType;
LCID POINTER_ALIGNMENT LocaleId;
} QueryDeviceText;
//
// Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION
//
struct {
BOOLEAN InPath;
BOOLEAN Reserved[3];
DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
} UsageNotification;
//
// Parameters for IRP_MN_WAIT_WAKE
//
struct {
SYSTEM_POWER_STATE PowerState;
} WaitWake;
//
// Parameter for IRP_MN_POWER_SEQUENCE
//
struct {
PPOWER_SEQUENCE PowerSequence;
} PowerSequence;
//
// Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER
//
struct {
ULONG SystemContext;
POWER_STATE_TYPE POINTER_ALIGNMENT Type;
POWER_STATE POINTER_ALIGNMENT State;
POWER_ACTION POINTER_ALIGNMENT ShutdownType;
} Power;
//
// Parameters for StartDevice
//
struct {
PCM_RESOURCE_LIST AllocatedResources;
PCM_RESOURCE_LIST AllocatedResourcesTranslated;
} StartDevice;
// begin_ntifs
//
// Parameters for Cleanup
//
// No extra parameters supplied
//
//
// WMI Irps
//
struct {
ULONG_PTR ProviderId;
PVOID DataPath;
ULONG BufferSize;
PVOID Buffer;
} WMI;
//
// Others - driver-specific
//
struct {
PVOID Argument1;
PVOID Argument2;
PVOID Argument3;
PVOID Argument4;
} Others;
} Parameters;
//
// Save a pointer to this device driver's device object for this request
// so it can be passed to the completion routine if needed.
//
PDEVICE_OBJECT DeviceObject;
//
// The following location contains a pointer to the file object for this
//
PFILE_OBJECT FileObject;
//
// The following routine is invoked depending on the flags in the above
// flags field.
//
PIO_COMPLETION_ROUTINE CompletionRoutine;
//
// The following is used to store the address of the context parameter
// that should be passed to the CompletionRoutine.
//
PVOID Context;
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;
IRP会一层一层的传递,每一层都对应着一个IO_STACK_LOCATION
- 上面那个结构体,最为重要的是一个大联合体,其中对应着不同类型IRP所携带的参数
请简述IRP与IRP栈之间的关系
- 任何内核模式程序在创建一个IRP时,同时还创建了一个与之相关联的IO_STACK_LOCATION结构数组;
- 数组中的每个堆栈单元都对应一个将处理该IRP的驱动程序,堆栈单元中包含该IRP类型代码(1)和参数信息(2)以及完成函数的地址(3)
上面一句话的总结:每个堆栈单元都对应一个驱动程序;堆栈单元中IRP包含类型、参数信息、完成函数地址.
- IO_STACK_LOCATION内有两个重要成员,他们分别是MajorFunction和MinorFunction,分别记录了IRP的主类型与子类型，通过MajorFunction可以知道是什么IRP,通过MinorFunction可以知道一些子消息.
还有一个重要的联合体,根据不同的IRP,它会传递不同的消息.
IRP的处理:
- 驱动中的请求处理都是通过I/O请求包(IRP)与派遣函数完成的
- 当我们在用户层调用CreateFile,ReadFile,CloseHandle等系统API的时候,操作系统则会产生与之对应的IRP_MJ_CREATE,IRP_MJ_READ,IRP_MJ_CLOSE,并发送到相应的设备
-
Windows中的设备有：
image.png
MDL(内存描述表)
- 内存描述符表(Memory Descriptor List)是Windows未公开的一个结构,可以通过Windows提供的函数使用此结构将内存重新映射,并指定我们自己的内存属性.
小结:MDL功能->将内存重新映射,并指定我们自己的内存属性.
- 当需要对其他模块的内存空间进行操作时,微软可以确保MDL的读写操作不会引发其他问题
设备通讯有三种方式,哪三种,有什么区别?
- 缓冲区设备读写方式:将用户态缓冲区拷贝至内核态,在内核态使用完毕之后会再拷贝至用户态
- 直接读取方式(MDL):对用户态内存地址进程重新映射,映射到内核空间
- 其他方式:取决于创建完设备对象之后,映射到内核空间
常见的IRP结构体中的字段有哪些,以及他们的作用?
PMDL MdlAddress:MDLAddress域指向一个内存描述符(MDL),描述了一个与该IO请求相关联的用户模式缓冲区;AssociateIrp:我们WDM驱动会用到AssociatedIrp.SystemBuffer,这是一个指向系统空间的缓冲区.当使用直接IO的时候,,这个缓冲区的用途由与IRP相关的Majorfunction决定;IRP_MJ_DEVICE_CONTROL或者IRP_MJ_INTERNAL_DEVICE_CONTROL这两类IRP,该缓冲区被作为DeviceConTrol函数的输入缓冲区;该缓冲区的长度由IO_STACK_LOCATION结构中的Paramters.DeviceIoControl.InputBufferLehgth成员确定.IOStatus(IO_STATUS_BLOCK):是一个仅包含两个域的结构,驱动程序在最终完成请求的时候设置这个结构(这里没有写全。。。。。。)
目前学习了IO_STACK_LOCATION中的哪些字段,有什么作用?
MajorFunction:I/O操作的类型
MinorFunction：MajorFunction的附属码
Paramters:不同MajorFunction携带的附加信息.