IoAllocateDriverObjectExtension及伪码

NTSTATUS
  IoAllocateDriverObjectExtension(
    IN PDRIVER_OBJECT  DriverObject,
    IN PVOID  ClientIdentificationAddress,
    IN ULONG  DriverObjectExtensionSize,
    OUT PVOID  *DriverObjectExtension
    );

nt!IoAllocateDriverObjectExtension:
8083756d 8bff            mov     edi,edi
8083756f 55              push    ebp
80837570 8bec            mov     ebp,esp
80837572 51              push    ecx
80837573 8b4514          mov     eax,dword ptr [ebp+14h]
80837576 832000          and     dword ptr [eax],0
80837579 56              push    esi
8083757a 57              push    edi
8083757b 8b7d10          mov     edi,dword ptr [ebp+10h]
8083757e 6844726976      push    76697244h
80837583 83c708          add     edi,8
80837586 57              push    edi
80837587 6a00            push    0
80837589 c645ff00        mov     byte ptr [ebp-1],0
8083758d e8b2c50300      call    nt!ExAllocatePoolWithTag (80873b44)
80837592 8bf0            mov     esi,eax
80837594 85f6            test    esi,esi  //分配的内存的地址.
80837596 0f845fd60000    je      nt!IoAllocateDriverObjectExtension+0x2b (80844bfb)
8083759c 8bcf            mov     ecx,edi
8083759e 8bd1            mov     edx,ecx
808375a0 c1e902          shr     ecx,2
808375a3 33c0            xor     eax,eax
808375a5 8bfe            mov     edi,esi
808375a7 f3ab            rep stos dword ptr es:[edi]
808375a9 8bca            mov     ecx,edx
808375ab 53              push    ebx
808375ac 8b5d0c          mov     ebx,dword ptr [ebp+0Ch]
808375af 83e103          and     ecx,3
808375b2 f3aa            rep stos byte ptr es:[edi]


808375b4 895e04          mov     dword ptr [esi+4],ebx  //p->ClientIdentificationAddress = ClientIdentificationAddress;
808375b7 ff1594068080    call    dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (80800694)]

808375bd 8b7d08          mov     edi,dword ptr [ebp+8]
808375c0 8b4f18          mov     ecx,dword ptr [edi+18h]
808375c3 8b5114          mov     edx,dword ptr [ecx+14h]
808375c6 85d2            test    edx,edx 

808375c8 0f85ac110000    jne     nt!IoAllocateDriverObjectExtension+0x60 (8083877a)

808375ce 8b4f18          mov     ecx,dword ptr [edi+18h]
808375d1 8b4914          mov     ecx,dword ptr [ecx+14h]
808375d4 890e            mov     dword ptr [esi],ecx
808375d6 8b4f18          mov     ecx,dword ptr [edi+18h]
808375d9 897114          mov     dword ptr [ecx+14h],esi
808375dc c645ff01        mov     byte ptr [ebp-1],1

808375e0 8ac8            mov     cl,al
808375e2 ff159c068080    call    dword ptr [nt!_imp_KfLowerIrql (8080069c)]
808375e8 807dff00        cmp     byte ptr [ebp-1],0
808375ec 5b              pop     ebx
808375ed 0f8412d60000    je      nt!IoAllocateDriverObjectExtension+0x90 (80844c05)
808375f3 8b4514          mov     eax,dword ptr [ebp+14h]
808375f6 83c608          add     esi,8
808375f9 8930            mov     dword ptr [eax],esi
808375fb 33c0            xor     eax,eax

808375fd 5f              pop     edi
808375fe 5e              pop     esi
808375ff c9              leave
80837600 c21000          ret     10h

80844c05 6a00            push    0
80844c07 56              push    esi
80844c08 e8faed0200      call    nt!ExFreePoolWithTag (80873a07)
80844c0d b8350000c0      mov     eax,0C0000035h
80844c12 e9e629ffff      jmp     nt!IoAllocateDriverObjectExtension+0xa9 (808375fd)

8083877a 395a04          cmp     dword ptr [edx+4],ebx   //
8083877d 7406            je      nt!IoAllocateDriverObjectExtension+0x6b (80838785)//相等时
8083877f 8b12            mov     edx,dword ptr [edx]
80838781 85d2            test    edx,edx
80838783 75f5            jne     nt!IoAllocateDriverObjectExtension+0x60 (8083877a)


80838785 85d2            test    edx,edx 
80838787 0f8553eeffff    jne     nt!IoAllocateDriverObjectExtension+0x81 (808375e0)  //ID相等时,表示已经存在了.

8083878d e93ceeffff      jmp     nt!IoAllocateDriverObjectExtension+0x6f (808375ce)//最后一个了.


typedef struct _IO_CLIENT_EXTENSION{
struct _IO_CLIENT_EXTENSION * NextExtension;
PVOID ClientIdentificationAddress;
}IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;

NTSTATUS
MyIoAllocateDriverObjectExtension(
IN PDRIVER_OBJECT  DriverObject,
IN PVOID  ClientIdentificationAddress,
IN ULONG  DriverObjectExtensionSize,
OUT PVOID  *DriverObjectExtension
)
{
PIO_CLIENT_EXTENSION pIoClientExtension, pBuff;
BOOLEAN Flag;
KIRQL irql;

*DriverObjectExtension = NULL;

pBuff = ExAllocatePoolWithTag(0, DriverObjectExtensionSize + sizeof(IO_CLIENT_EXTENSION), 0X76697244);

if (pBuff == NULL)
return STATUS_INSUFFICIENT_RESOURCES;

Flag = FALSE;
RtlZeroMemory(pBuff, DriverObjectExtensionSize + sizeof(IO_CLIENT_EXTENSION));

pBuff->ClientIdentificationAddress = ClientIdentificationAddress;

irql = KeRaiseIrqlToDpcLevel();

pIoClientExtension = *(PIO_CLIENT_EXTENSION *)(DriverObject->DriverExtension + 1);

while ( pIoClientExtension)
{
if (pIoClientExtension->ClientIdentificationAddress == ClientIdentificationAddress)
break;
else
pIoClientExtension = pIoClientExtension->NextExtension;
}

if (pIoClientExtension == NULL)
{
pBuff->NextExtension = *(PIO_CLIENT_EXTENSION *)(DriverObject->DriverExtension + 1);
*(PIO_CLIENT_EXTENSION *)(DriverObject->DriverExtension + 1) = pBuff;
Flag = TRUE;
}

KfLowerIrql(irql);

if (Flag)
{

DriverObjectExtension = (PVOID)(pBuff + 1);
return STATUS_SUCCESS;
}
else
{
ExFreePoolWithTag(pBuff, 0);
return STATUS_OBJECT_NAME_COLLISION; 
}
}