WDK例子之键盘过滤驱动简单总结

Module Name:

kbfiltr.c

Abstract:

Environment:

Kernel mode only.

Notes:

–*/

#include “kbfiltr.h”

NTSTATUS DriverEntry (PDRIVER_OBJECT, PUNICODE_STRING);

#ifdef ALLOC_PRAGMA#pragma alloc_text (INIT, DriverEntry)#pragma alloc_text (PAGE, KbFilter_AddDevice)#pragma alloc_text (PAGE, KbFilter_CreateClose)#pragma alloc_text (PAGE, KbFilter_InternIoCtl)#pragma alloc_text (PAGE, KbFilter_Unload)#pragma alloc_text (PAGE, KbFilter_DispatchPassThrough)#pragma alloc_text (PAGE, KbFilter_PnP)#pragma alloc_text (PAGE, KbFilter_Power)#endif

NTSTATUSDriverEntry ( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )/*++Routine Description:

Initialize the entry points of the driver.

–*/{ ULONG i;

UNREFERENCED_PARAMETER (RegistryPath);

// // Fill in all the dispatch entry points with the pass through function // and the explicitly fill in the functions we are going to intercept // for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++) {DriverObject->MajorFunction[i] = KbFilter_DispatchPassThrough; }

DriverObject->MajorFunction [IRP_MJ_CREATE] = DriverObject->MajorFunction [IRP_MJ_CLOSE] =KbFilter_CreateClose; DriverObject->MajorFunction [IRP_MJ_PNP] =KbFilter_PnP;//PNP管理器发送的IRP DriverObject->MajorFunction [IRP_MJ_POWER] =KbFilter_Power;//POWER管理器发送的IRP DriverObject->MajorFunction [IRP_MJ_INTERNAL_DEVICE_CONTROL] =KbFilter_InternIoCtl; // // If you are planning on using this function, you must create another // device object to send the requests to. Please see the considerations // comments for KbFilter_DispatchPassThrough for implementation details. // // DriverObject->MajorFunction [IRP_MJ_DEVICE_CONTROL];

DriverObject->DriverUnload = KbFilter_Unload; DriverObject->DriverExtension->AddDevice = KbFilter_AddDevice;

return STATUS_SUCCESS;}

NTSTATUSKbFilter_AddDevice( __in PDRIVER_OBJECT Driver, __in PDEVICE_OBJECT PDO ){ PDEVICE_EXTENSIONdevExt; IO_ERROR_LOG_PACKETerrorLogEntry; PDEVICE_OBJECTdevice; NTSTATUSstatus = STATUS_SUCCESS;

PAGED_CODE();

//创建设备对象 status = IoCreateDevice(Driver,sizeof(DEVICE_EXTENSION), NULL,FILE_DEVICE_KEYBOARD, //设备对象的类型0,FALSE,//FALSE表示非内核模式设备对象&device);

if (!NT_SUCCESS(status)) {return (status); }

RtlZeroMemory(device->DeviceExtension, sizeof(DEVICE_EXTENSION));//初始化设备对象扩展

devExt = (PDEVICE_EXTENSION) device->DeviceExtension; devExt->TopOfStack = IoAttachDeviceToDeviceStack(device, PDO);//挂载过滤驱动，香港虚拟主机，PDO这个底层驱动对象是PNP管理器自动传送的参数

if (devExt->TopOfStack == NULL) {IoDeleteDevice(device);return STATUS_DEVICE_NOT_CONNECTED; }

ASSERT(devExt->TopOfStack);//利用ASSERT这个宏进行对象有效性的判断

devExt->Self =device; devExt->PDO =PDO; devExt->DeviceState = PowerDeviceD0;

devExt->SurpriseRemoved = FALSE; devExt->Removed =FALSE; devExt->Started =FALSE;

device->Flags |= (DO_BUFFERED_IO | DO_POWER_PAGABLE); device->Flags &= ~DO_DEVICE_INITIALIZING;

return status;}

NTSTATUSKbFilter_Complete( __in PDEVICE_OBJECT DeviceObject, __in PIRPIrp, __in_opt PVOIDContext )/*++Routine Description:

Generic completion routine that allows the driver to send the irp down the stack, catch it on the way up, and do more processing at the original IRQL. –*/{ PKEVENT event;

event = (PKEVENT) Context;

UNREFERENCED_PARAMETER(DeviceObject); UNREFERENCED_PARAMETER(Irp);

// // We could switch on the major and minor functions of the IRP to perform // different functions, but we know that Context is an event that needs // to be set. // KeSetEvent(event, 0, FALSE);

// // Allows the caller to use the IRP after it is completed // return STATUS_MORE_PROCESSING_REQUIRED;}

NTSTATUSKbFilter_CreateClose ( __in PDEVICE_OBJECT DeviceObject, __in PIRPIrp )/*++Routine Description:

Maintain a simple count of the creates and closes sent against this device –*/{ PIO_STACK_LOCATION irpStack; NTSTATUSstatus; PDEVICE_EXTENSION devExt;

PAGED_CODE();

irpStack = IoGetCurrentIrpStackLocation(Irp); devExt = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;

status = Irp->IoStatus.Status;

一个有信念者所开发出的力量，大于99个只有兴趣者。

相关文章：

你感兴趣的文章：

标签云：