{"id":319,"date":"2022-07-04T17:35:06","date_gmt":"2022-07-04T09:35:06","guid":{"rendered":"http:\/\/blog.kijk.top\/?p=319"},"modified":"2022-07-04T17:35:06","modified_gmt":"2022-07-04T09:35:06","slug":"%e7%90%86%e8%a7%a3windows%e5%86%85%e6%a0%b8-%e9%a9%b1%e5%8a%a8%e5%bc%80%e5%8f%91","status":"publish","type":"post","link":"http:\/\/blog.kijk.top\/?p=319","title":{"rendered":"\u7406\u89e3windows\u5185\u6838\u2014\u2014\u9a71\u52a8\u5f00\u53d1"},"content":{"rendered":"\n

\u8f6c\u8f7d\u4e8e\uff1ahttps:\/\/www.anquanke.com\/post\/id\/262435<\/p>\n\n\n\n

\u524d\u8a00<\/h2>\n\n\n\n

\u5b66\u4e60windows\u5185\u6838\uff0c\u5c31\u79bb\u4e0d\u5f00\u9a71\u52a8\u7684\u5f00\u53d1\u3002<\/p>\n\n\n\n

\u73af\u5883\u642d\u5efa<\/h2>\n\n\n\n

vs2019 + SDK + WDK\uff0cSDK\u7684\u7248\u672c\u8981\u548cWDK\u7684\u7248\u672c\u76f8\u540c\u3002<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\u5728xp\u4e0a\u8dd1\u9a71\u52a8\u7684\u8bdd\u5c31\u8bbe\u7f6etarget os\u4e3awin7\u5c31\u884c\u4e86\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u7136\u540e\u5c31\u662f\u6539\u6539\u201c\u8b66\u544a\u8bbe\u4e3a\u9519\u8bef\u201d\u7b49\u7b49\uff0c\u4e0d\u8981\u6539\u8b66\u544a\u7b49\u7ea7\u3002<\/p>\n\n\n\n

#include <ntddk.h>\n\n\/\/ \u63d0\u4f9b\u4e00\u4e2aUnload\u51fd\u6570\u53ea\u662f\u4e3a\u4e86\u8ba9\u7a0b\u5e8f\u80fd\u591f\u52a8\u6001\u5378\u8f7d,\u65b9\u4fbf\u8c03\u8bd5\nVOID DriverUnload(PDRIVER_OBJECT driver)\n{\n    \/\/ \u4f46\u662f\u5b9e\u9645\u4e0a\u6211\u4eec\u4ec0\u4e48\u90fd\u4e0d\u505a\uff0c\u53ea\u6253\u5370\u4e00\u53e5\u8bdd:\n    DbgPrint(\"first: Our driver is unloading\u2026\\r\\n\");\n}\n\n\/\/ DriverEntry\uff0c\u5165\u53e3\u51fd\u6570\u3002\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u9a71\u52a8\u5bf9\u8c61\uff08\u4e00\u4e2a\u5185\u6838\u6a21\u5757\u7ed3\u6784\u4f53\uff09\uff0c\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f\u5728\u6ce8\u518c\u8868\u7684\u8def\u5f84\u3002\nNTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)\n{\n    \/\/ \u8fd9\u662f\u6211\u4eec\u7684\u5185\u6838\u6a21\u5757\u7684\u5165\u53e3\uff0c\u53ef\u4ee5\u5728\u8fd9\u91cc\u5199\u5165\u6211\u4eec\u60f3\u5199\u7684\u4e1c\u897f\u3002\n    DbgPrint(\"\u6ce8\u518c\u8868\u8def\u5f84\uff1a%wZ \u5730\u5740\uff1a%x Hello world!\", reg_path,driver);\n\n    \/\/ \u8bbe\u7f6e\u4e00\u4e2a\u5378\u8f7d\u51fd\u6570\u4fbf\u4e8e\u8fd9\u4e2a\u51fd\u6570\u80fd\u9000\u51fa\u3002\n    driver->DriverUnload = DriverUnload;\n\n    return STATUS_SUCCESS;\n}<\/code><\/pre>\n\n\n\n
\u5f53\u542f\u52a8\u548c\u505c\u6b62\u540e\uff0c\u901a\u8fc7DebugView\u53d1\u73b0\u5df2\u7ecf\u6253\u5370\u4e86\u6ce8\u518c\u8868\u8def\u5f84\u548c\u9a71\u52a8\u5730\u5740\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u5728\u5bf9\u5e94\u6ce8\u518c\u8868\u8def\u5f84\u4e0b\u53ef\u4ee5\u627e\u5230\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n\n\n\n
<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u9a71\u52a8\u8c03\u8bd5<\/h2>\n\n\n\n
\u5728\u5e94\u7528\u5c42\uff0c\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u5728vs2019\u4e0aF9\u4e0b\u4e00\u4e2a\u65ad\u70b9\uff0c\u975e\u5e38\u7b80\u5355\uff0c\u800c\u57280\u73af\uff0c\u4e00\u4e2a\u9a71\u52a8\u7a0b\u5e8f\u7684\u65ad\u70b9\u4ee3\u8868\u7740\u6574\u4e2a\u64cd\u4f5c\u7cfb\u7edf\u90fd\u5c06\u88ab\u65ad\u4e0b\u6765\u3002<\/p>\n\n\n\n
\u540c\u6837\u4f7f\u7528windbg\uff0c\u5728symbol\u8def\u52b2\u4e2d\u6dfb\u52a0\u4e00\u6761\u81ea\u5df1\u9a71\u52a8\u7684\u8def\u5f84\uff08\u5c31\u662f\u4f60\u8981\u52a0\u8f7d\u4ec0\u4e48\u9a71\u52a8\uff0c\u5c31\u628a\u4ed6\u7684pdb\u6587\u4ef6\u8def\u5f84\u5199\u5728symbol\u8def\u5f84\u4e2d\uff09\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4ee3\u7801\u4e3a\uff1a<\/p>\n\n\n\n
#include <ntddk.h>\n\n\/\/ \u63d0\u4f9b\u4e00\u4e2aUnload\u51fd\u6570\u53ea\u662f\u4e3a\u4e86\u8ba9\u7a0b\u5e8f\u80fd\u591f\u52a8\u6001\u5378\u8f7d,\u65b9\u4fbf\u8c03\u8bd5\nVOID DriverUnload(PDRIVER_OBJECT driver)\n{\n    \/\/ \u4f46\u662f\u5b9e\u9645\u4e0a\u6211\u4eec\u4ec0\u4e48\u90fd\u4e0d\u505a\uff0c\u53ea\u6253\u5370\u4e00\u53e5\u8bdd:\n    DbgPrint(\"first: Our driver is unloading\u2026\\r\\n\");\n}\n\n\/\/ DriverEntry\uff0c\u5165\u53e3\u51fd\u6570\u3002\u76f8\u5f53\u4e8emain\u3002\nNTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)\n{\n\n    _asm\n    {\n        int 3\n        mov eax, eax\n        mov eax ,eax \n        mov eax, eax\n    }\n\n    \/\/ \u8fd9\u662f\u6211\u4eec\u7684\u5185\u6838\u6a21\u5757\u7684\u5165\u53e3\uff0c\u53ef\u4ee5\u5728\u8fd9\u91cc\u5199\u5165\u6211\u4eec\u60f3\u5199\u7684\u4e1c\u897f\u3002\n    DbgPrint(\"\u6ce8\u518c\u8868\u8def\u5f84\uff1a%wZ \u5730\u5740\uff1a%x Hello world!\", reg_path,driver);\n\n    \/\/ \u8bbe\u7f6e\u4e00\u4e2a\u5378\u8f7d\u51fd\u6570\u4fbf\u4e8e\u8fd9\u4e2a\u51fd\u6570\u80fd\u9000\u51fa\u3002\n    driver->DriverUnload = DriverUnload;\n\n    return STATUS_SUCCESS;\n}<\/code><\/pre>\n\n\n\n
int 3\u5c06\u4f1a\u65ad\u70b9\u52300\u73af\u3002<\/p>\n\n\n\n
\u81ea\u52a8\u5c31\u4f1a\u6709\u5bf9\u5e94\u7684\u4ee3\u7801\uff0c\u56e0\u4e3a\u6211\u4eec\u7ed9\u4e86pdb\u6587\u4ef6\uff0c\u53ef\u89c1pdb\u5bf9\u4e8e\u8c03\u8bd5\u662f\u975e\u5e38\u91cd\u8981\u7684\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5185\u6838\u7a7a\u95f4\u4e0e\u5185\u6838\u6a21\u5757<\/h2>\n\n\n\n
<\/p>\n\n\n\n
\u5185\u6838\u7a7a\u95f4<\/p><\/blockquote>\n\n\n\n
\u6bcf\u4e2a\u8fdb\u7a0b4GB\u72ec\u7acb\u7684\u5185\u5b58\u7a7a\u95f4\uff0c\u5728\u4f4e2G\u662f\u4e0d\u540c\u7684\uff0c\u4f46\u662f\u9ad82G\u5185\u5b58\u7a7a\u95f4\u5bf9\u4e8e\u6240\u6709\u7684\u8fdb\u7a0b\u6765\u8bf4\u90fd\u662f\u76f8\u540c\u7684\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6709\u5982\u4e0b\u4e00\u6bb5\u4ee3\u7801\uff1a<\/p>\n\n\n\n
#include <ntddk.h>\n\nULONG x = 0x12345678;\n\/\/ \u63d0\u4f9b\u4e00\u4e2aUnload\u51fd\u6570\u53ea\u662f\u4e3a\u4e86\u8ba9\u7a0b\u5e8f\u80fd\u591f\u52a8\u6001\u5378\u8f7d,\u65b9\u4fbf\u8c03\u8bd5\nVOID DriverUnload(PDRIVER_OBJECT driver)\n{\n    \/\/ \u4f46\u662f\u5b9e\u9645\u4e0a\u6211\u4eec\u4ec0\u4e48\u90fd\u4e0d\u505a\uff0c\u53ea\u6253\u5370\u4e00\u53e5\u8bdd:\n    DbgPrint(\"first: Our driver is unloading\u2026\\r\\n\");\n}\n\n\n\/\/ DriverEntry\uff0c\u5165\u53e3\u51fd\u6570\u3002\u76f8\u5f53\u4e8emain\u3002\nNTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)\n{\n\n    DbgPrint(\"%x\", &x);\n    \/\/ \u8fd9\u662f\u6211\u4eec\u7684\u5185\u6838\u6a21\u5757\u7684\u5165\u53e3\uff0c\u53ef\u4ee5\u5728\u8fd9\u91cc\u5199\u5165\u6211\u4eec\u60f3\u5199\u7684\u4e1c\u897f\u3002\n    DbgPrint(\"\u6ce8\u518c\u8868\u8def\u5f84\uff1a%wZ \u5730\u5740\uff1a%x Hello world!\", reg_path, driver);\n\n    \/\/ \u8bbe\u7f6e\u4e00\u4e2a\u5378\u8f7d\u51fd\u6570\u4fbf\u4e8e\u8fd9\u4e2a\u51fd\u6570\u80fd\u9000\u51fa\u3002\n    driver->DriverUnload = DriverUnload;\n\n    return STATUS_SUCCESS;\n}<\/code><\/pre>\n\n\n\n
\u5b9a\u4e49\u4e00\u4e2a\u5168\u5c40\u53d8\u91cf\uff0c\u5f53\u7136\u7531\u4e8e\u662f\u9a71\u52a8\u7a0b\u5e8f\uff0c\u5730\u5740\u5728\u9ad82G\uff0c\u52a0\u8f7d\u540e\u901a\u8fc7debugview\u53ef\u4ee5\u770b\u5230\u5730\u5740\u3002<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7136\u540e\u6211\u4eec\u968f\u4fbf\u8fdb\u5165\u4e00\u4e2a\u8fdb\u7a0b\u3002<\/p>\n\n\n\n
kd> .process 81ffc928\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u67e5\u770bx\u7684\u5730\u5740\uff0c\u53d1\u73b0\u6b63\u5b58\u50a8\u77400x12345678\u3002<\/p>\n\n\n\n
<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u518d\u6362\u4e2a\u8fdb\u7a0b\u770b\u770b\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6240\u4ee5\u5373\u53ef\u8bc1\u660e\uff0c\u8fdb\u7a0b\u5728\u9ad82G\u7528\u7684\u5185\u5b58\u7a7a\u95f4\u662f\u540c\u4e00\u5757\u3002<\/p>\n\n\n\n
\u5185\u6838\u6a21\u5757<\/p><\/blockquote>\n\n\n\n
\u9a71\u52a8\u4e3b\u8981\u662f\u4e3a\u4e86\u7ed9\u786c\u4ef6\u4f7f\u7528\u7684\u3002\u4f46\u786c\u4ef6\u79cd\u7c7b\u7e41\u591a\uff0c\u4e0d\u53ef\u80fd\u505a\u4e00\u4e2a\u517c\u5bb9\u6240\u6709\u786c\u4ef6\u7684\u5185\u6838\uff0c\u6240\u4ee5\uff0c\u5fae\u8f6f\u63d0\u4f9b\u89c4\u5b9a\u7684\u63a5\u53e3\u683c\u5f0f\uff0c\u8ba9\u786c\u4ef6\u9a71\u52a8\u4eba\u5458\u5b89\u88c5\u89c4\u5b9a\u7684\u683c\u5f0f\u7f16\u5199\u201c\u9a71\u52a8\u7a0b\u5e8f\u201d \u3002<\/p>\n\n\n\n
\u8fd9\u4e9b\u9a71\u52a8\u7a0b\u5e8f\u6bcf\u4e00\u4e2a\u90fd\u662f\u4e00\u4e2a\u6a21\u5757\uff0c\u79f0\u4e3a\u201c\u5185\u6838\u6a21\u5757\u201d\uff0c\u90fd\u53ef\u4ee5\u52a0\u8f7d\u5230\u5185\u6838\u4e2d\uff0c\u90fd\u9075\u5b88PE\u7ed3\u6784\u3002\u4f46\u672c\u8d28\u4e0a\u8bb2\uff0c\u4efb\u610f\u4e00\u4e2a.sys\u6587\u4ef6\u4e0e\u5185\u6838\u6587\u4ef6\u6ca1\u6709\u533a\u522b\u3002<\/p>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5185\u6838\u5e76\u4e0d\u662f\u4e00\u4e2a\u5b64\u7acb\u7684\u6574\u4f53\uff0c\u800c\u662f\u7531\u591a\u4e2a\u6a21\u5757\u4e00\u8d77\u7ec4\u6210\u7684\u3002\u6bd4\u5982\u6211\u4eec\u9006\u5411\u7684ntoskrnl.exe\u6587\u4ef6\uff0c\u5176\u5b9e\u4e5f\u53ea\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u6a21\u5757\uff0c\u6211\u4eec\u81ea\u5df1\u7f16\u8bd1\u7684sys\u6587\u4ef6\u4e5f\u662f\uff0c\u4f46\u662f\u5e76\u4e0d\u662f\u6bcf\u4e00\u4e2a\u6a21\u5757\u90fd\u5bf9\u5e94\u7740\u4e00\u5757\u9a71\u52a8\uff0c\u6bd4\u5982\u5b89\u5168\u4eba\u5458\u5199\u7684\u9a71\u52a8\u53ea\u662f\u7f16\u5199\u4e86\u4e00\u5757\u9a71\u52a8\uff0c\u5f88\u591a\u65f6\u5019\u5e76\u6ca1\u6709\u5bf9\u5e94\u7684\u786c\u4ef6\u3002<\/code><\/pre>\n\n\n\n
DRIVER_OBJECT<\/h2>\n\n\n\n
\u6bcf\u4e2a\u5185\u6838\u6a21\u5757\u90fd\u6709\u4e00\u4e2a\u5bf9\u5e94\u7684\u7ed3\u6784\u4f53\uff0c\u6765\u63cf\u8ff0\u8fd9\u4e2a\u6a21\u5757\u5728\u5185\u6838\u4e2d\u7684\uff1a\u4f4d\u7f6e\u3001\u5927\u5c0f\u3001\u540d\u79f0\u7b49\u7b49\u3002DriverEntry<\/code>\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u5c31\u662f\u8fd9\u4e2a\u7ed3\u6784\u4f53\u3002<\/p>\n\n\n\n
kd> dt _DRIVER_OBJECT\nnt!_DRIVER_OBJECT\n   +0x000 Type             : Int2B\n   +0x002 Size             : Int2B\n   +0x004 DeviceObject     : Ptr32 _DEVICE_OBJECT\n   +0x008 Flags            : Uint4B\n   +0x00c DriverStart      : Ptr32 Void\n   +0x010 DriverSize       : Uint4B\n   +0x014 DriverSection    : Ptr32 Void\n   +0x018 DriverExtension  : Ptr32 _DRIVER_EXTENSION\n   +0x01c DriverName       : _UNICODE_STRING\n   +0x024 HardwareDatabase : Ptr32 _UNICODE_STRING\n   +0x028 FastIoDispatch   : Ptr32 _FAST_IO_DISPATCH\n   +0x02c DriverInit       : Ptr32     long \n   +0x030 DriverStartIo    : Ptr32     void \n   +0x034 DriverUnload     : Ptr32     void \n   +0x038 MajorFunction    : [28] Ptr32     long<\/code><\/pre>\n\n\n\n
\u6253\u5370\u51fa\u5730\u5740\u540e\u53ef\u4ee5\u770b\u5230\u8be5\u7ed3\u6784\u4f53\u5177\u4f53\u7684\u503c\u3002<\/p>\n\n\n\n
kd> dt _DRIVER_OBJECT 824ec030\nnt!_DRIVER_OBJECT\n   +0x000 Type             : 0n4\n   +0x002 Size             : 0n168\n   +0x004 DeviceObject     : (null) \n   +0x008 Flags            : 0x12\n   +0x00c DriverStart      : 0xf8a42000 Void\n   +0x010 DriverSize       : 0x6000\n   +0x014 DriverSection    : 0x822d2a98 Void\n   +0x018 DriverExtension  : 0x824ec0d8 _DRIVER_EXTENSION\n   +0x01c DriverName       : _UNICODE_STRING \"\\Driver\\dbgDriver\"\n   +0x024 HardwareDatabase : 0x80671ae0 _UNICODE_STRING \"\\REGISTRY\\MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\"\n   +0x028 FastIoDispatch   : (null) \n   +0x02c DriverInit       : 0xf8a46000     long  dbgDriver!GsDriverEntry+0\n   +0x030 DriverStartIo    : (null) \n   +0x034 DriverUnload     : 0xf8a43030     void  dbgDriver!DriverUnload+0\n   +0x038 MajorFunction    : [28] 0x804f454a     long  nt!IopInvalidDeviceRequest+0<\/code><\/pre>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u6709\u9a71\u52a8\u540d\uff0c\u6709\u591a\u5927\uff0c\u4ece\u4ec0\u4e48\u5730\u65b9\u5f00\u59cb\u7b49\u4fe1\u606f\u3002<\/p>\n\n\n\n
\u904d\u5386\u5185\u6838\u6a21\u5757<\/h3>\n\n\n\n
\u6211\u4eec\u901a\u8fc7_DRIVER_OBJECT<\/code>\u7ed3\u6784\u53ef\u4ee5\u83b7\u53d6\u5f53\u524d\u81ea\u5df1\u9a71\u52a8\u7684\u4e00\u4e9b\u4fe1\u606f\uff0c\u90a3\u4e48\u6709\u6ca1\u6709\u65b9\u5f0f\u53ef\u4ee5\u83b7\u53d6\u5176\u4ed6\u5185\u6838\u6a21\u5757\u7684\u4fe1\u606f\u5462\u3002<\/p>\n\n\n\n
\u901a\u8fc7_DRIVER_OBJECT<\/code>\u7ed3\u6784\u4f53\u4e2dDriverSection<\/code>\u5219\u53ef\u4ee5\u5b9e\u73b0\u3002<\/p>\n\n\n\n
DriverSection<\/code>\u662f\u4e00\u4e2a\u6307\u9488\uff0c\u5b9e\u9645\u4e0a\u662f\u5bf9\u5e94\u7740\u4e00\u4e2a\u7ed3\u6784\u4f53\uff1a_LDR_DATA_TABLE_ENTRY<\/p>\n\n\n\n
kd> dt _LDR_DATA_TABLE_ENTRY<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+0x000 InLoadOrderLinks : _LIST_ENTRY<\/p>\n\n\n\n
\u662f\u4e00\u4e2a\u94fe\u8868\uff0c\u5c31\u662f\u5c06\u5404\u4e2a\u5185\u6838\u6a21\u5757\u4e00\u8d77\u4e32\u8d77\u6765\u3002<\/p>\n\n\n\n
+0x018 DllBase : Ptr32 Void<\/p>\n\n\n\n
\u662f\u5f53\u524d\u6a21\u5757\u7684\u9996\u5730\u5740\u3002<\/p>\n\n\n\n
+0x020 SizeOfImage : Uint4B<\/p>\n\n\n\n
\u6709\u591a\u5927\u3002<\/p>\n\n\n\n
+0x024 FullDllName : _UNICODE_STRING<\/p>\n\n\n\n
\u8fd9\u4e2a\u9a71\u52a8\u6587\u4ef6\u7684\u5b8c\u6574\u8def\u5f84\u3002<\/p>\n\n\n\n
\u6bd4\u5982\u6211\u4eec\u8fd9\u91cc\u7684\u5f53\u524d\u5185\u6838\u6a21\u5757\u4fe1\u606f\u5982\u4e0b\uff1a<\/p>\n\n\n\n
kd> dt _LDR_DATA_TABLE_ENTRY 0x822d2a98<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u901a\u8fc7InLoadOrderLinks\u53ef\u4ee5\u67e5\u8be2\u5230\u5176\u4ed6\u5185\u6838\u6a21\u5757\u7684\u4fe1\u606f\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4f9d\u6b21\u5185\u63a8\uff0c\u53ef\u4ee5\u83b7\u53d6\u5230\u5176\u4ed6\u6240\u6709\u7684\u5185\u6838\u6a21\u5757\u3002<\/p>\n\n\n\n
IRQL<\/h2>\n\n\n\n
\u8bd5\u60f3\uff1a\u5f53cpu\u5728\u6267\u884c\u4ee3\u7801\u65f6\uff0c\u4ec0\u4e48\u80fd\u591f\u6253\u65ad\u5b83\uff1f<\/p>
\u7b54\u6848\u5c31\u662f\u4e2d\u65ad\uff0c\u4f46\u5f53\u4e00\u4e2a\u4e2d\u65ad\u8fd8\u6ca1\u6709\u6267\u884c\u7ed3\u675f\uff0c\u53c8\u4ea7\u751f\u4e86\u65b0\u7684\u4e2d\u65ad\uff0c\u8fd9\u65f6\u5019cpu\u5e94\u8be5\u7ee7\u7eed\u6267\u884c\u4e4b\u524d\u7684\u4e2d\u65ad\u5462\uff0c\u8fd8\u662f\u6267\u884c\u65b0\u7684\u4e2d\u65ad\u5462\uff1f<\/p>
\u7b54\u6848\u5c31\u662fIRQL\u3002\u7b49\u7ea7\u9ad8\u7684\u4e2d\u65ad\u53ef\u4ee5\u6253\u65ad\u7b49\u7ea7\u4f4e\u7684\u4e2d\u65ad\u3002<\/p><\/blockquote>\n\n\n\n
<\/p>\n\n\n\n
IRQL\u5168\u79f0Interrupt Request Level\u3002\u4e00\u4e2a\u7531windows\u865a\u62df\u51fa\u6765\u7684\u6982\u5ff5\uff0c\u5212\u5206\u5728windows\u4e0b\u4e2d\u65ad\u7684\u4f18\u5148\u7ea7\uff0c\u8fd9\u91cc\u4e2d\u65ad\u5305\u62ec\u4e86\u786c\u4e2d\u65ad\u548c\u8f6f\u4e2d\u65ad\uff0c\u786c\u4e2d\u65ad\u662f\u7531\u786c\u4ef6\u4ea7\u751f\uff0c\u800c\u8f6f\u4e2d\u65ad\u5219\u662f\u5b8c\u5168\u865a\u62df\u51fa\u6765\u7684\u3002<\/p>\n\n\n\n
<\/p>\n\n\n\n
#define PASSIVE_LEVEL 0\n#define APC_LEVEL 1\n#define DISPATCH_LEVEL 2\n#define PROFILE_LEVEL 27\n#define CLOCK1_LEVEL 28\n#define CLOCK2_LEVEL 28\n#define IPI_LEVEL 29\n#define POWER_LEVEL 30\n#define HIGH_LEVEL 31<\/code><\/pre>\n\n\n\n
\u5047\u8bbe\u73b0\u5728\u6709\u4e00\u4e2a\u4e2d\u65ad\u7b49\u7ea7\u4e3aPASSIVE_LEVEL \uff0c\u6b63\u5728\u88ab\u6267\u884c\uff0c\u6b64\u65f6\u4ea7\u751f\u4e86\u4e00\u4e2a\u4e2d\u65adDISPATCH_LEVEL\uff0c\u90a3\u4e48\u4e2d\u65ad\u7b49\u7ea7\u4e3aDISPATCH_LEVEL\u7684\u7a0b\u5e8f\u5f02\u5e38\u5904\u7406\u5c06\u4f1a\u88ab\u6267\u884c\u3002\u53cd\u4e4b\u5219\u4e0d\u7136\uff0c\u8fd9\u4e5f\u662f\u4e3a\u4ec0\u4e48\u4f17\u591a\u5185\u6838api\u8981\u6c42\u4e2d\u65ad\u7b49\u7ea7\u7684\u539f\u56e0\uff0c\u4e00\u4e2a\u4e0d\u6ce8\u610f\u5c06\u4f1a\u5bfc\u81f4\u84dd\u5c4f\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6bd4\u5982\u5f53\u4f60\u60f3\u8981hook\u4e00\u4e2a\u51fd\u6570\u7684\u7b49\u7ea7\u662fDISPATCH_LEVEL\uff0c\u90a3\u4e48\u4f60\u5728hook\u7684\u4ee3\u7801\u4e2d\u5c31\u4e0d\u80fd\u4f7f\u7528\u5206\u9875\u5185\u5b58<\/strong>\u3002<\/p>\n\n\n\n
\u56e0\u4e3a\u4e00\u65e6\u4f60\u7684\u5185\u5b58\u4e3a\u5206\u9875\u5185\u5b58\uff0c\u90a3\u4e48\u5bf9\u5e94\u7684\u7269\u7406\u9875\u5f88\u6709\u53ef\u80fd\u5df2\u7ecf\u88ab\u5199\u5230\u4e86\u786c\u76d8\u4e0a\uff0c\u6b63\u5e38\u60c5\u51b5\u4e0b\uff0c\u4f1a\u4ea7\u751f\u9875\u5f02\u5e38\uff08\u4e2d\u65ad\uff09\u53bb\u5bfb\u627e\u5230\u786c\u76d8\u4e2d\u5b58\u50a8\u7684\u5185\u5b58\uff0c\u800c\u8be5\u4e2d\u65ad\u7b49\u7ea7\u4e3aDISPATCH_LEVEL\uff0c\u90a3\u4e48\u5f53hook\u7684\u4ee3\u7801\u6267\u884c\u7684\u65f6\u5019\uff0c\u5c31\u6839\u672c\u4e0d\u4f1a\u7406\u4f1a\u8fd9\u4e2a\u9875\u5f02\u5e38\u7684\u4e2d\u65ad\uff0c\u56e0\u4e3a\u6b64\u65f6\u4ed6\u4e24\u7684\u4e2d\u65ad\u7b49\u7ea7\u76f8\u540c\uff0c\u6240\u4ee5\u4f1a\u5bfc\u81f4\u5185\u5b58\u8bbf\u95ee\u9519\u8bef\uff0c\u8fd9\u6837\u5c31\u76f4\u63a5\u84dd\u5c4f\u4e86\u3002<\/p>\n\n\n\n
\u4e00\u822c\u60c5\u51b5\u4e0b\u6211\u4eec\u81ea\u5df1\u5199\u7684\u4ee3\u7801\u90fd\u5728PASSIVE_LEVEL \u7b49\u7ea7\u4e0b\uff0c\u5982\u679c\u8dd1\u7740\u8dd1\u7740\u7b49\u7ea7\u5c31\u4e0a\u53bb\u4e86\uff0c\u90a3\u4e48\u5927\u6982\u7387\u662f\u4f60\u5728hook\u522b\u4eba\u7684\u51fd\u6570\uff0c\u522b\u4eba\u7684\u51fd\u6570\u7b49\u7ea7\u662fDISPATCH_LEVEL\u3002<\/p><\/blockquote>\n\n\n\n
<\/p>\n\n\n\n
0\u73af\u4e0e3\u73af\u901a\u4fe1\uff08\u5e38\u89c4\uff09<\/h2>\n\n\n\n
\u901a\u4fd7\u7684\u8bf4\u5c31\u662f0\u73af\u600e\u4e48\u628a\u6d88\u606f\u4f20\u7ed93\u73af\uff0c3\u73af\u600e\u4e48\u628a\u6d88\u606f\u4f20\u7ed90\u73af\u3002<\/p>\n\n\n\n
<\/a>\u8bbe\u5907\u5bf9\u8c61<\/p><\/blockquote>\n\n\n\n
\u8fd9\u91cc\u5c31\u53ef\u4ee5\u548c\u4e09\u73af\u7684\u7a97\u53e3\u5bf9\u8c61\u505a\u5bf9\u6bd4\u3002<\/p>\n\n\n\n
\u6211\u4eec\u5728\u5f00\u53d1\u7a97\u53e3\u7a0b\u5e8f\u7684\u65f6\u5019\uff0c\u6d88\u606f\u88ab\u5c01\u88c5\u6210\u4e00\u4e2a\u7ed3\u6784\u4f53\uff1aMSG\uff0c\u5728\u5185\u6838\u5f00\u53d1\u65f6\uff0c\u6d88\u606f\u88ab\u5c01\u88c5\u6210\u53e6\u5916\u4e00\u4e2a\u7ed3\u6784\u4f53\uff1aIRP(I\/O Request Package)\u3002<\/p>\n\n\n\n
\u5728\u7a97\u53e3\u7a0b\u5e8f\u4e2d\uff0c\u80fd\u591f\u63a5\u6536\u6d88\u606f\u7684\u53ea\u80fd\u662f\u7a97\u53e3\u5bf9\u8c61\u3002\u5728\u5185\u6838\u4e2d\uff0c\u80fd\u591f\u63a5\u6536IRP\u6d88\u606f\u7684\u53ea\u80fd\u662f\u8bbe\u5907\u5bf9\u8c61\uff0c\u800c\u4e0d\u80fd\u662f\u9a71\u52a8\u5bf9\u8c61\u3002<\/p>\n\n\n\n
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u521b\u5efa\u8bbe\u5907\u5bf9\u8c61\uff1a<\/p><\/blockquote>\n\n\n\n
\/\/\u521b\u5efa\u8bbe\u5907\u540d\u79f0\nUNICODE_STRING Devicename;\nRtlInitUnicodeString(&Devicename,L\"\\\\Device\\\\MyDevice\");   \/\/\u201cDevice\u201d\u4e0d\u8981\u968f\u4fbf\u6539\uff0c\u6700\u540e\u7684\u540d\u5b57\u53ef\u4ee5\u6539\n\n\/\/\u521b\u5efa\u8bbe\u5907\nIoCreateDevice(\npDriver,                \/\/\u5f53\u524d\u8bbe\u5907\u6240\u5c5e\u7684\u9a71\u52a8\u5bf9\u8c61\n0,\n&Devicename,            \/\/\u8bbe\u5907\u5bf9\u8c61\u7684\u540d\u79f0\nFILE_DEVICE_UNKNOWN,\nFILE_DEVICE_SECURE_OPEN,\nFALSE,\n&pDeviceObj            \/\/\u8bbe\u5907\u5bf9\u8c61\u6307\u9488\n);<\/code><\/pre>\n\n\n\n
\u4ea4\u4e92\u6570\u636e\u7684\u4e09\u79cd\u65b9\u5f0f<\/p>\n\n\n\n
pDeviceObj->Flags = DO_BUFFERED_IO;<\/code><\/pre>\n\n\n\n
DO_BUFFERED_IO<\/strong><\/p>\n\n\n\n
\u8be5\u65b9\u5f0f\u4e3a\uff1a\u7f13\u51b2\u533a\u65b9\u5f0f\u8bfb\u5199\u3002<\/p>\n\n\n\n
\u5f53\u6211\u4eec\u4e0e\u4e09\u73af\u7a0b\u5e8f\u901a\u4fe1\u7684\u65f6\u5019\uff0c\u6709\u53ef\u80fd\u56e0\u4e3a\u8fdb\u7a0b\u7684\u5207\u6362\uff0c\u5bfc\u81f40\u73af\u5728\u54113\u73af\u8bfb\u6570\u636e\u7684\u65f6\u5019\u8bfb\u53d6\u5230\u9519\u8bef\u7684\u5730\u5740\uff0c\u8fd9\u79cd\u65b9\u5f0f\u5c06\u4f1a\u628a3\u73af\u7a0b\u5e8f\u5730\u5740\u5bf9\u5e94\u7684\u6570\u636e\u590d\u5236\u4e00\u4efd\u52300\u73af\u5730\u5740\u4e2d\uff0c\u8fd9\u6837\u80fd\u4fdd\u8bc1\u8bfb\u53d6\u5230\u6b63\u786e\u7684\u5730\u5740\uff0c\u7f3a\u70b9\u5c31\u662f\u6709\u70b9\u9ebb\u70e6\uff08\u901f\u5ea6\u6162\uff09\uff0c\u9700\u8981\u590d\u5236\u4e00\u4efd\u3002<\/p>\n\n\n\n
<\/a>DO_DIRECT_IO<\/strong><\/p>\n\n\n\n
\u8be5\u65b9\u5f0f\u4e3a\uff1a\u76f4\u63a5\u65b9\u5f0f\u8bfb\u5199\u3002<\/p>\n\n\n\n
\u64cd\u4f5c\u7cfb\u7edf\u4f1a\u5c06\u7528\u6237\u6a21\u5f0f\u4e0b\u7684\u7f13\u51b2\u533a\u9501\u4f4f\u3002\u7136\u540e\u64cd\u4f5c\u7cfb\u7edf\u5c06\u8fd9\u6bb5\u7f13\u51b2\u533a\u5728\u5185\u6838\u6a21\u5f0f\u5730\u5740\u518d\u6b21\u6620\u5c04\u4e00\u904d\uff08\u6302\u4e0a\u7269\u7406\u9875\uff09\u3002\u8fd9\u6837\uff0c\u7528\u6237\u6a21\u5f0f\u7684\u7f13\u51b2\u533a\u548c\u5185\u6838\u6a21\u5f0f\u7684\u7f13\u51b2\u533a\u6307\u5411\u7684\u662f\u540c\u4e00\u533a\u57df\u7684\u7269\u7406\u5185\u5b58\u3002\u7f3a\u70b9\u5c31\u662f\u8981\u5355\u72ec\u5360\u7528\u7269\u7406\u9875\u9762\uff0c\u65e0\u6cd5\u5c06\u7269\u7406\u9875\u5b58\u5230\u786c\u76d8\u4e0a\u53bb\uff0c\u4f46\u662f\u5728\u9700\u8981\u6709\u5927\u91cf\u6570\u636e\u4ea4\u4e92\u7684\u65f6\u5019\u6b64\u65b9\u6cd5\u662f\u6bd4\u8f83\u597d\u7684\u3002<\/p>\n\n\n\n
<\/a>\u5176\u4ed6\u65b9\u5f0f\u8bfb\u5199<\/strong><\/p>\n\n\n\n
\u5373\u4e0d\u6307\u5b9aDO_BUFFERED_IO\u4e5f\u4e0d\u6307\u5b9aDO_DIRECT_IO\u3002<\/p>\n\n\n\n
\u8fd9\u79cd\u65b9\u5f0f\u662f\u4e0d\u5efa\u8bae\u7684\uff0c\u5e76\u4e14\u975e\u5e38\u5371\u9669<\/strong><\/p>\n\n\n\n
\u5728\u4f7f\u7528\u5176\u4ed6\u65b9\u5f0f\u8bfb\u5199\u8bbe\u5907\u65f6\uff0c\u6d3e\u9063\u51fd\u6570\u76f4\u63a5\u8bfb\u5199\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u7684\u7f13\u51b2\u533a\u5730\u5740\u3002\u5728\u9a71\u52a8\u7a0b\u5e8f\u4e2d\uff0c\u76f4\u63a5\u64cd\u4f5c\u5e94\u7528\u7a0b\u5e8f\u7684\u7f13\u51b2\u533a\u5730\u5740\u662f\u5f88\u5371\u9669\u7684\uff0c\u56e0\u4e3a\u4e09\u73af\u8fdb\u7a0b\u4f1a\u4e0d\u65ad\u7684\u5207\u6362\uff0c\u65e0\u6cd5\u4fdd\u8bc1\u8bfb\u53d6\u5230\u7684\u5730\u5740\u662f\u4e00\u4e2a\u6b63\u786e\u7684\u5730\u5740\u3002\u53ea\u6709\u9a71\u52a8\u7a0b\u5e8f\u4e0e\u5e94\u7528\u7a0b\u5e8f\u8fd0\u884c\u5728\u76f8\u540c\u7ebf\u7a0b\u4e0a\u4e0b\u6587\u7684\u60c5\u51b5\u4e0b\uff0c\u624d\u80fd\u4f7f\u7528\u8fd9\u79cd\u65b9\u5f0f\u3002<\/p>\n\n\n\n
\u521b\u5efa\u7b26\u53f7\u94fe\u63a5<\/p><\/blockquote>\n\n\n\n
\u6211\u4eec\u521b\u5efa\u7684\u8bbe\u5907\u5bf9\u8c61\u7684Devicename<\/code>\u662f\u7ed9\u5185\u6838\u770b\u7684\uff0c\u800c\u4e09\u73af\u8981\u60f3\u77e5\u9053\u8fd9\u4e2a\u8bbe\u5907\u5bf9\u8c61\uff0c\u6211\u4eec\u5c31\u9700\u8981\u7ed9\u8be5\u8bbe\u5907\u5bf9\u8c61\u8d77\u4e00\u4e2a\u522b\u540d\uff0c\u5373\u4e3a\u7b26\u53f7\u94fe\u63a5\u3002<\/p>\n\n\n\n
\/\/\u521b\u5efa\u7b26\u53f7\u94fe\u63a5\u540d\u79f0\nRtlInitUnicodeString(&SymbolicLinkName,L\"\\\\??\\\\MyTestDriver\");\n\/\/\u521b\u5efa\u7b26\u53f7\u94fe\u63a5\nIoCreateSymbolicLink(&SymbolicLinkName,&Devicename);<\/code><\/pre>\n\n\n\n
\u7279\u522b\u8bf4\u660e\uff1a<\/p>\n\n\n\n
1\u3001\u8bbe\u5907\u540d\u79f0\u7684\u4f5c\u7528\u662f\u7ed9\u5185\u6838\u5bf9\u8c61\u7528\u7684\uff0c\u5982\u679c\u8981\u5728Ring3\u8bbf\u95ee\uff0c\u5fc5\u987b\u8981\u6709\u7b26\u53f7\u94fe\u63a5\uff0c\u5176\u5b9e\u5c31\u662f\u4e00\u4e2a\u522b\u540d\uff0c\u6ca1\u6709\u8fd9\u4e2a\u522b\u540d\uff0c\u5728Ring3\u4e0d\u53ef\u89c1\u3002<\/p>\n\n\n\n
2\u3001\u5185\u6838\u6a21\u5f0f\u4e0b\uff0c\u7b26\u53f7\u94fe\u63a5\u662f\u4ee5\u201c\\??\\\u201d\u5f00\u5934\u7684\uff0c\u5982C \u76d8\u5c31\u662f\u201c\\??\\C:\u201d<\/p>\n\n\n\n
3\u3001\u800c\u5728\u7528\u6237\u6a21\u5f0f\u4e0b\uff0c\u5219\u662f\u4ee5\u201c\\\\.\\\u201d\u5f00\u5934\u7684\uff0c\u5982C \u76d8\u5c31\u662f\u201c\\\\.\\C\u201d:<\/p>\n\n\n\n
<\/p>\n\n\n\n
IRP\u4e0e\u6d3e\u9063\u51fd\u6570<\/p><\/blockquote>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e00\u4e2a\u5355\u673a\u9f20\u6807\u7684\u64cd\u4f5c\u88ab\u5c01\u88c5\u6210MSG\u7ed3\u6784\u4f20\u7ed9\u7a97\u53e3\u5bf9\u8c61\uff0c\u7a97\u53e3\u5bf9\u8c61\u627e\u5230\u5355\u51fb\u9f20\u6807\u5bf9\u5e94\u7684\u56de\u8c03\u51fd\u6570\u8fdb\u884c\u5904\u7406\u3002<\/p>\n\n\n\n
CreateFile\u51fd\u6570\u5c01\u88c5\u6210IRP\u4f20\u7ed9\u8bbe\u5907\u5bf9\u8c61\uff0c\u8bbe\u5907\u5bf9\u8c61\u627e\u5230CreateFile\u7684\u6d3e\u9063\u51fd\u6570\u8fdb\u884c\u5904\u7406\uff0c\u6240\u4ee5\u8fd9\u91cc\u6d3e\u9063\u51fd\u6570\u53ef\u4ee5\u7406\u89e3\u4e3a\u56de\u8c03\u51fd\u6570\uff0c\u662f\u7ed9\u8bbe\u5907\u5bf9\u8c61\u7528\u7684\uff0c\u8bbe\u5907\u5bf9\u8c61\u6536\u5230\u4ec0\u4e48\u6837\u7684IRP\u5c31\u7528\u5bf9\u5e94\u7684\u6d3e\u9063\u51fd\u6570\u5904\u7406\u3002<\/p>\n\n\n\n
IRP\u7684\u7c7b\u578b<\/strong><\/p>\n\n\n\n
\u5f53\u5e94\u7528\u5c42\u901a\u8fc7CreateFile\uff0cReadFile\uff0cWriteFile\uff0cCloseHandle\u7b49\u51fd\u6570\u6253\u5f00\u3001\u4ece\u8bbe\u5907\u8bfb\u53d6\u6570\u636e\u3001\u5411\u8bbe\u5907\u5199\u5165\u6570\u636e\u3001\u5173\u95ed\u8bbe\u5907\u7684\u65f6\u5019\uff0c\u4f1a\u4f7f\u64cd\u4f5c\u7cfb\u7edf\u4ea7\u751f\u51faIRP_MJ_CREATE<\/code>\uff0cIRP_MJ_READ<\/code>\uff0cIRP_MJ_WRITE<\/code>\uff0cIRP_MJ_CLOSE<\/code>\u7b49\u4e0d\u540c\u7684IRP\u3002<\/p>\n\n\n\n
\u4f46\u5982ReadFile\u548cWriteFile\u8fd9\u4e9b\u51fd\u6570\u529f\u80fd\u592a\u8fc7\u4e8e\u5355\u4e00\uff0c\u53ea\u80fd\u8bfb\u6216\u8005\u53ea\u80fd\u5199\uff0c\u6709\u65f6\u5019\u6211\u4eec\u9700\u8981\u53c8\u8bfb\u53c8\u5199\u548c\u5e72\u522b\u7684\u4e8b\u60c5\u3002\u66f4\u4e3a\u5e38\u7528\u7684\u662fDeviceIoControl<\/code>\u51fd\u6570\u548c\u4ed6\u5bf9\u5e94\u7684IRP\u7c7b\u578bIRP_MJ_DEVICE_CONTROL<\/code>\u3002<\/p>\n\n\n\n
\u6ce8\u518c\u6d3e\u9063\u51fd\u6570<\/strong><\/p>\n\n\n\n
<\/a>\u6d3e\u9063\u51fd\u6570\u5728\u54ea\u91cc\u6ce8\u518c<\/strong><\/p>\n\n\n\n
kd> dt _DRIVER_OBJECT\nnt!_DRIVER_OBJECT\n   +0x000 Type             : Int2B\n   +0x002 Size             : Int2B\n   +0x004 DeviceObject     : Ptr32 _DEVICE_OBJECT\n   +0x008 Flags            : Uint4B\n   +0x00c DriverStart      : Ptr32 Void\n   +0x010 DriverSize       : Uint4B\n   +0x014 DriverSection    : Ptr32 Void\n   +0x018 DriverExtension  : Ptr32 _DRIVER_EXTENSION\n   +0x01c DriverName       : _UNICODE_STRING\n   +0x024 HardwareDatabase : Ptr32 _UNICODE_STRING\n   +0x028 FastIoDispatch   : Ptr32 _FAST_IO_DISPATCH\n   +0x02c DriverInit       : Ptr32     long \n   +0x030 DriverStartIo    : Ptr32     void \n   +0x034 DriverUnload     : Ptr32     void \n   +0x038 MajorFunction    : [28] Ptr32     long<\/code><\/pre>\n\n\n\n
_DRIVER_OBJECT\u7ed3\u6784\u4f53\u4e2dDriverUnload\u5373\u4e3a\u5378\u8f7d\u51fd\u6570\uff0c<\/p>\n\n\n\n
MajorFunction\u4e3a\u6d3e\u9063\u51fd\u6570\uff0c\u53ef\u4ee5\u770b\u5230\u6d3e\u9063\u51fd\u6570\u662f\u4e00\u4e2a\u6570\u7ec4\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6bd4\u5982\u662fCreatFile\u7684IRP\uff0c\u90a3\u4e48IRP_MJ_CREATE\u7684\u6d3e\u9063\u51fd\u6570\u5c31\u5728MajorFunction\u7d22\u5f15\u4e3a0\u7684\u4f4d\u7f6e\uff0c\u540c\u6837\u7684\u5982\u679c\u662fIRP_MJ_READ\u7684\u6d3e\u9063\u51fd\u6570\u5c31\u5728\u7d22\u5f15\u4e3a3\u7684\u4f4d\u7f6e\u3002<\/p>\n\n\n\n
\u6d3e\u9063\u51fd\u6570\u7684\u683c\u5f0f<\/strong><\/p>\n\n\n\n
\u6211\u4eec\u77e5\u9053\u7ebf\u7a0b\u51fd\u6570\u4e5f\u6709\u5bf9\u5e94\u7684\u683c\u5f0f\uff0c\u5e76\u4e0d\u662f\u4e71\u5199\u7684\u3002\u6d3e\u9063\u51fd\u6570\u4e5f\u662f\u6709\u8fd9\u81ea\u5df1\u5bf9\u5e94\u683c\u5f0f\uff0c\u8fd4\u56de\u503c\u548c\u53c2\u6570\u7c7b\u578b\u7684\u56fa\u5b9a\u7684\u3002<\/p>\n\n\n\n
NTSTATUS MyDispatchFunction(PDEVICE_OBJECT pDevObj, PIRP pIrp)\n{\n    \/\/\u5904\u7406\u81ea\u5df1\u7684\u4e1a\u52a1...\n\n    \/\/\u8bbe\u7f6e\u8fd4\u56de\u72b6\u6001\n    pIrp->IoStatus.Status = STATUS_SUCCESS;    \/\/  getlasterror()\u5f97\u5230\u7684\u5c31\u662f\u8fd9\u4e2a\u503c\n    pIrp->IoStatus.Information = 0;        \/\/  \u8fd4\u56de\u7ed93\u73af\u591a\u5c11\u6570\u636e \u6ca1\u6709\u586b0\n    IoCompleteRequest(pIrp, IO_NO_INCREMENT);\n    return STATUS_SUCCESS;\n}<\/code><\/pre>\n\n\n\n
\u901a\u8fc7IRP_MJ_DEVICE_CONTROL\u4ea4\u4e92\u6570\u636e<\/strong><\/p>\n\n\n\n
\u8fd9\u79cd\u65b9\u5f0f\u662f\u6700\u5e38\u7528\u7684\uff0c\u80fd\u5b9e\u73b0\u7684\u529f\u80fd\u591a\u79cd\u591a\u6837\uff0c\u4f46\u662f\u7a0d\u5fae\u590d\u6742\u4e00\u70b9\uff0c\u9700\u8981\u5728\u4e09\u73af\u8c03\u7528DeviceIoControl<\/code>\u51fd\u6570\uff0c\u53c2\u6570\u7b49\u53c2\u8003msdn<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5176\u4e2d\u7b2c\u4e8c\u4e2a\u53c2\u6570code\u64cd\u4f5c\u7801\u4e5f\u4e0d\u662f\u4e71\u586b\u7684\uff0c\u5177\u4f53\u5c31\u770b\u4e0b\u9762\u5b9e\u73b0\u4ee3\u7801\uff0c\u8fd9\u91cc\u53ea\u662f\u7a0d\u5fae\u63d0\u4e00\u4e0b\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5b9e\u9a8c<\/h3>\n\n\n\n
0\u73af\u4ee3\u7801\uff1a<\/p>\n\n\n\n
#include <ntddk.h>\n\n#define DEVICE_NAME L\"\\\\Device\\\\MYDEVICE\"\n#define SYMBOL_NAME_LINK L\"\\\\??\\\\devicesd\"\n\n\/\/\u81ea\u5b9a\u4e49\u6d88\u606f\n#define CODE_READ CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)\n#define CODE_WRITE CTL_CODE(FILE_DEVICE_UNKNOWN,0x900,METHOD_BUFFERED,FILE_ANY_ACCESS)\n\nVOID DriverUpload(PDRIVER_OBJECT pDriver)\n{\n    UNICODE_STRING symbolLink;\n    RtlInitUnicodeString(&symbolLink, SYMBOL_NAME_LINK);\n    IoDeleteSymbolicLink(&symbolLink);\n    IoDeleteDevice(pDriver->DeviceObject);\n    KdPrint((\"\u5378\u8f7d\u4e86\\n\"));\n    return;\n}\nNTSTATUS CreatCallBack(_In_ struct _DEVICE_OBJECT* DeviceObject, _Inout_ struct _IRP* Irp)\n{\n    KdPrint((\"\u521b\u5efa\u6211\u4e86\\n\"));\n    Irp->IoStatus.Status = STATUS_SUCCESS;   \/\/3\u73af\u8c03\u7528getlasterror\u53ef\u4ee5\u83b7\u53d6\n    Irp->IoStatus.Information = STATUS_SUCCESS;\n    IofCompleteRequest(Irp, IO_NO_INCREMENT);\n    return STATUS_SUCCESS;\n}\n\nNTSTATUS CloseCallBack(_In_ struct _DEVICE_OBJECT* DeviceObject, _Inout_ struct _IRP* Irp)\n{\n    KdPrint((\"\u5173\u95ed\u6211\u4e86\\n\"));\n    Irp->IoStatus.Status = STATUS_SUCCESS;   \/\/3\u73af\u8c03\u7528getlasterror\u53ef\u4ee5\u83b7\u53d6\n    Irp->IoStatus.Information = STATUS_SUCCESS;\n    IofCompleteRequest(Irp, IO_NO_INCREMENT);\n    return STATUS_SUCCESS;\n}\n\n\nNTSTATUS DispathCallBack(_In_ struct _DEVICE_OBJECT* DeviceObject, _Inout_ struct _IRP* Irp)\n{\n    PIO_STACK_LOCATION ps1 = IoGetCurrentIrpStackLocation(Irp);\n    ULONG code = ps1->Parameters.DeviceIoControl.IoControlCode;\n    PVOID systembuf = Irp->AssociatedIrp.SystemBuffer;\n    ULONG inLen = ps1->Parameters.DeviceIoControl.InputBufferLength;\n    ULONG outLen = ps1->Parameters.DeviceIoControl.OutputBufferLength;\n\n    switch (code)\n    {\n    case CODE_READ:\n        KdPrint((\"CODE_READ\uff1a %x\\n\",CODE_READ));\n        if (outLen > 20)\n        {\n            memcpy(systembuf, \"12345678\", sizeof(\"12345678\"));\n            Irp->IoStatus.Information = sizeof(\"12345678\");\n        }\n        else\n        {\n            memcpy(systembuf,\"1\",sizeof(\"1\"));\n            Irp->IoStatus.Information = 1;\n        }\n\n        break;\n    case CODE_WRITE:\n        KdPrint((\"CODE_READ\uff1a %x\\n\", CODE_WRITE));\n        KdPrint((\"write\uff1a %s\\n\", systembuf));\n        Irp->IoStatus.Information = 0;\n        break;\n    }\n\n    Irp->IoStatus.Status = STATUS_SUCCESS;\n    IofCompleteRequest(Irp, IO_NO_INCREMENT);\n\n    return STATUS_SUCCESS;\n}\nNTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)\n{\n    UNICODE_STRING deviceName;\n    UNICODE_STRING symbolNameLink;\n    PDEVICE_OBJECT pDeviceObj;\n    NTSTATUS status;\n\n    pDriver->DriverUnload = DriverUpload;\n\n    RtlInitUnicodeString(&deviceName, DEVICE_NAME);\n    RtlInitUnicodeString(&symbolNameLink, SYMBOL_NAME_LINK);\n    status = IoCreateDevice(pDriver,0, &deviceName,FILE_DEVICE_UNKNOWN,FILE_DEVICE_SECURE_OPEN,TRUE,&pDeviceObj);\n\n    if (!NT_SUCCESS(status))\n    {\n        KdPrint((\"\u521b\u5efa\u8bbe\u5907\u5931\u8d25\\n\"));\n        return status;\n    }\n    status = IoCreateSymbolicLink(&symbolNameLink,&deviceName);\n\n    if (!NT_SUCCESS(status))\n    {\n        IoDeleteDevice(pDeviceObj);\n        KdPrint((\"\u521b\u5efa\u7b26\u53f7\u94fe\u63a5\u5931\u8d25\\n\"));\n        return status;\n    }\n\n    \/\/\u8bbe\u7f6e\u6570\u636e\u4ea4\u4e92\u7684\u65b9\u5f0f\n    pDeviceObj->Flags = DO_BUFFERED_IO;\n    pDriver->MajorFunction[IRP_MJ_CREATE] = CreatCallBack;\n    pDriver->MajorFunction[IRP_MJ_CLOSE] = CloseCallBack;\n    pDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispathCallBack;\n    return STATUS_SUCCESS;\n}<\/code><\/pre>\n\n\n\n
3\u73af\u4ee3\u7801<\/p>\n\n\n\n
#include <windows.h>\n#include <winioctl.h>\n#include <stdlib.h>\n#include <stdio.h>\n\n#define CODE_READ CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)\n#define CODE_WRITE CTL_CODE(FILE_DEVICE_UNKNOWN,0x900,METHOD_BUFFERED,FILE_ANY_ACCESS)\n\n#define SYMBOL_NAME_LINK L\"\\\\\\\\.\\\\devicesd\"\n\nBOOLEAN openDevice(HANDLE* handle)\n{\n    HANDLE _hHandle = CreateFile(SYMBOL_NAME_LINK, GENERIC_READ | GENERIC_WRITE,0,\n        NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);\n    *handle = _hHandle;\n    return (int)_hHandle > 0;\n\n}\n\nVOID CloseDevice(HANDLE handle)\n{\n    CloseHandle(handle);\n}\n\nVOID SendCode(HANDLE handle, DWORD code, PVOID inData,\n    ULONG Inlen, PVOID outData, ULONG outLen, LPDWORD resultLen)\n{\n    \/\/\u9a71\u52a8\u53e5\u67c4\uff0c\u64cd\u4f5c\u7801\uff0c\u8981\u54110\u73af\u4f20\u5165\u591a\u5c11\u6570\u636e\u548c\u957f\u5ea6\uff0c\u8981\u54110\u73af\u53d6\u591a\u5c11\u6570\u636e\u548c\u957f\u5ea6\uff0c\u5b9e\u9645\u957f\u5ea6\uff0c OVERLAPPED\u6307\u9488\uff08\u6b64\u5904\u4e3a0\uff09\n    DeviceIoControl(handle, code, inData, Inlen, outData, outLen, resultLen,NULL);\n\n}\nint main(int argc, char* argv[])\n{\n    HANDLE handle;\n    if (!openDevice(&handle))\n    {\n        printf(\"\u6253\u5f00\u8bbe\u5907\u5931\u8d25\\n\");\n        return 0;\n    }\n\n    char buf[30] = { 0 };\n    DWORD len = 0;\n\n    SendCode(handle,CODE_READ,buf,30,buf,30,&len);\n    CloseDevice(handle);\n    printf(\"buf = %s\\n\",buf);\n    system(\"pause\");\n    return 0;\n}<\/code><\/pre>\n\n\n\n
\u4e09\u73af\u80fd\u591f\u4ece0\u73af\u8bfb\u53d6\u5230\u6570\u636e\uff0c\u8fdb\u884c\u901a\u4fe1\u3002<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u540e\u8bb0<\/h2>\n\n\n\n
\u5bf9\u4e8e\u5b89\u5168\u4eba\u5458\u6765\u8bf4\uff0c\u5b66\u4e60\u9a71\u52a8\u5e76\u4e0d\u662f\u4e86\u89e3\u51e0\u4e2aapi\u8fd9\u4e48\u7b80\u5355\uff0c\u800c\u662f\u8981\u77e5\u9053\u64cd\u4f5c\u7cfb\u7edf\u662f\u5982\u4f55\u5b9e\u73b0\u7684\u53ca\u5176\u539f\u7406\uff0c\u5185\u6838\u77e5\u8bc6\u56f0\u96be\u5e76\u96be\u4ee5\u7406\u89e3\uff0c\u6587\u4e2d\u6709\u9519\u8bef\u7684\u5730\u65b9\u4e5f\u8bf7\u6307\u6559\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8f6c\u8f7d\u4e8e\uff1ahttps:\/\/www.anquanke.com\/post\/id\/262435 \u524d\u8a00 \u5b66\u4e60window […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/posts\/319"}],"collection":[{"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=319"}],"version-history":[{"count":5,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":349,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=\/wp\/v2\/posts\/319\/revisions\/349"}],"wp:attachment":[{"href":"http:\/\/blog.kijk.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.kijk.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}