//说明,编译是需要相对路径中有inc目录,而且有ntifs.inc;且扩展了函数。
//#include "ntifs.h"
//#include "stdio.h"
//常量定义;
#define DEVICE_TYPE_SYSMON 0x8266 //DDK指出0-7fffh是被系统保留了
#define NT_DEVICE_NAME L"//Device//MINSYS" //内核设备名
#define DOS_DEVICE_NAME L"//DosDevices//MINSYS" //符号连接设备名
//全局变量定义;
PDRIVER_OBJECT gOwenDriverObject; //本驱动程序对象
PDEVICE_OBJECT gCtrlDeviceObject; //用控制设备对象域
#pragma code_seg("PAGE")
VOID//UnLoad例程;
Unload(PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING Win32DeviceName;
RtlInitUnicodeString(&Win32DeviceName,DOS_DEVICE_NAME);
IoDeleteSymbolicLink(&Win32DeviceName);
IoDeleteDevice(gCtrlDeviceObject);
#if (DBG)
{
DbgPrint (("-------------------Unload OK/n"));
}
#endif
return;
}
NTSTATUS
DeviceIrpCreate( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
NTSTATUS
DeviceIrpClose( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
NTSTATUS
DeviceIrpControl( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return STATUS_SUCCESS;
}
#pragma code_seg("INIT")
NTSTATUS//驱动程序入口;
DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{
NTSTATUS Status;
UNICODE_STRING NtDeviceName;
UNICODE_STRING Win32DeviceName;
//保存自己的驱动程序对象,备用
gOwenDriverObject=DriverObject;
//初始化Unicode字符串, 创建设备对象;
RtlInitUnicodeString(&NtDeviceName,NT_DEVICE_NAME);
Status=IoCreateDevice( DriverObject,0,&NtDeviceName,
DEVICE_TYPE_SYSMON,0,FALSE,&gCtrlDeviceObject);
if (!NT_SUCCESS(Status)) return Status;
//初始化Unicode字符串, 创建Win32符号连接,以便Win32程序能够访问;
RtlInitUnicodeString(&Win32DeviceName,DOS_DEVICE_NAME);
Status=IoCreateSymbolicLink(&Win32DeviceName,&NtDeviceName);
if (!NT_SUCCESS(Status))
{
IoDeleteDevice( gCtrlDeviceObject );
return Status;
}
//填写驱动程序Dispatch例程
DriverObject->MajorFunction[IRP_MJ_CREATE] =DeviceIrpCreate;
DriverObject->MajorFunction[IRP_MJ_CLOSE] =DeviceIrpClose;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] =DeviceIrpControl;
//填写处理Unload例程
DriverObject->DriverUnload =Unload;
#if (DBG)
{
DbgPrint("DriverObject=%x RegistryPath=%x/n",DriverObject,RegistryPath);
}
#endif
return Status;
}