驱动函数分类

ExXxx()//暂定
IoXxx()//IO管理器
KeXxx()//目前理解过与同步相关
MmXxx()//内存相关
ObXxx()//驱动对象
PsXxx()//进程相关
RtlXxx()//与字符串相关
ZwXxx()//与文件 注册 进程相关
FltXxx()//文件过滤相关

NdisXxx()//Ndis过滤相关


ExAllocatePoolWithTag()
ExAcquireFastMutex 
ExGetPreviousMode
 
IoCreateDevice
IoCreateSymbolicLink
IoGetCurrentIrpStackLocation
IoAttachDeviceToDeviceStack
IoAllocateIrp
IoSetCompletionRoutine
 
KeWaitForSingleObject
KeSetEvent
KeInitializeEvent
 
ObReferenceObjectByHandle
ObQueryNameString
 
PsGetCurrentProcess
PsGetCurrentProcessId
PsCreateSystemThread
PsLookupProcessByProcessId
 
RtlZeroMemory
RtlInitUnicodeString
 
ZwOpenKey
ZwCreateFile
ZwOpenProcess
ZwQuerySystemInformation
 
MmGetSystemRoutineAddress
MmIsAddressValid


你可能感兴趣的:(驱动函数分类)