ITPub博客

首页 > Linux操作系统 > Linux操作系统 > Win2K 下驱动程序的动态加载 (转)

Win2K 下驱动程序的动态加载 (转)

原创 Linux操作系统 作者:worldblog 时间:2007-12-09 08:45:45 0 删除 编辑
Win2K 下驱动程序的动态加载 (转)[@more@]

加载一个驱动程序,主要就是,在
SYSTEMCurrentControlSetServices 建一个键。
如:
SYSTEMCurrentControlSetServicesTwdm1
Type(1)
ErrorControl(0)
Start(3)

多数驱动程序都是通过设置 Start 的值为 0, 1, 2 。
系统启动的过程中加载驱动程序。

Win2k 下驱动程序的加载处理上述方式外,
还可以在应用程序里用 Service api 实现,驱动程序的动态加载。
这时候的 Start 为 3 。

所用到的 Api 为:
OpenSCManager, CreateService, OpenService, StartService
ControlService, DeleteService, CloseServiceHandle

其中需要说明的是:
CreateService :他通过参数在注册表里自动创建驱动程序需要的键值。
DeleteService :他自动删除驱动程序在注册表里创的键值。

下面是一个,简单的例子:

应用程序:

#include "stdafx.h"
#include <windows.H>
#include
#include

void DelSvr( char * szSvrName ); //自动卸载驱动程序。

int main(int argc, char* argv[])
{
HANDLE hWdm;
printf("Hello World!n");

SC_HANDLE hServiceMgr, hServiceTwdm;
BOOL bRtn;
Dword dwRtn, dwSize = 256;
char szDir[256];

if( argc > 1 ) //加任一个参数表示卸载驱动程序。
{
DelSvr( "Twdm1" );
return 0;
}

GetCurrentDirectory( dwSize, szDir );//取当前目录
strcat( szDir, "Twdm.sys" ); //取驱动程序的全路径

LPCTSTR lpszBinaryPathName = TEXT(szDir);
hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS ); //打开服务控制管理器

if( hServiceMgr == NULL )
{
printf( "OpenSCManager() Faild %d ! n", GetLastError() );
return 0;
}
else
{
printf( "OpenSCManager() ok ! n" );
}

hServiceTwdm = CreateService( hServiceMgr,
TEXT("Twdm1"), //SYSTEMCurrentControlSetServices 驱动程序的在注册表中的名字
TEXT("Twdm1"), // 注册表驱动程序的 DisplayName 值
SERVICE_ALL_ACCESS, // 加载驱动程序的访问权限
SERVICE_KERNEL_driver,// 表示加载的服务是驱动程序
SERVICE_DEMAND_START, // 注册表驱动程序的 Start 值
SERVICE_ERROR_IGNORE, // 注册表驱动程序的 ErrorControl 值
lpszBinaryPathName, // 注册表驱动程序的 ImagePath 值
NULL,
NULL,
NULL,
NULL,
NULL);

if( hServiceTwdm == NULL )
{
dwRtn = GetLastError();
if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_EXISTS )
{
CloseServiceHandle( hServiceMgr );
printf( "CrateService() Faild %d ! n", dwRtn );
return 0;
}
else
{
printf( "CrateService() Faild Service is ERROR_IO_PENDING or ERROR_SERVICE_EXISTS! n" );
}

// 驱动程序已经加载,只需要打开
hServiceTwdm = OpenService( hServiceMgr, TEXT("Twdm1"), SERVICE_ALL_ACCESS );
if( hServiceTwdm == NULL )
{
dwRtn = GetLastError();
CloseServiceHandle( hServiceMgr );
printf( "OpenService() Faild %d ! n", dwRtn );
return 0;
}
else
{
printf( "OpenService() ok ! n" );
}
}
else
{
printf( "CrateService() ok ! n" );
}

// 启动驱动程序,调用驱动程序的 DriverEntry 函数
bRtn = StartService( hServiceTwdm, NULL, NULL );
if( !bRtn )
{
dwRtn = GetLastError();
if( dwRtn != ERROR_IO_PENDING && dwRtn != ERROR_SERVICE_ALREADY_RUNNING )
{
printf( "StartService() Faild %d ! n", dwRtn );
CloseServiceHandle( hServiceTwdm );
CloseServiceHandle( hServiceMgr );
return 0;
}
else
{
if( dwRtn != ERROR_IO_PENDING )
{
printf( "StartService() Faild ERROR_IO_PENDING ! n");
}
else
{
printf( "StartService() Faild ERROR_SERVICE_ALREADY_RUNNING ! n");
}
}
}

//测试驱动程序
hWdm = CreateFile(".Twdm1",
GENERIC_WRITE | GENERIC_READ,
0,
NULL,
OPEN_EXISTING,
0,
NULL);
if( hWdm != INVALID_HANDLE_VALUE )
{
printf( "Open Driver Twdm ok ! n" );
}
else
{
printf( "Open Driver Twdm faild %d ! n", GetLastError() );
}
CloseHandle( hWdm );
CloseServiceHandle( hServiceTwdm );
CloseServiceHandle( hServiceMgr );

//这时候你可以通过注册表,或其他查看符号连接的软件验证。
printf( "按任意键 卸载驱动程序 !n" );
getch();
//卸载驱动程序。
DelSvr( "Twdm1" );
return 0;
}

//卸载驱动程序。
void DelSvr( char * szSvrName )
{
SC_HANDLE hServiceMgr, hServiceTwdm;
SERVICE_STATUS SvrSta;
hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
if( hServiceMgr == NULL )
{
printf( "DelSvr::OpenSCManager() Faild %d ! n", GetLastError() );
return;
}
else
{
printf( "DelSvr::OpenSCManager() ok ! n" );
}
hServiceTwdm = OpenService( hServiceMgr, TEXT(szSvrName), SERVICE_ALL_ACCESS );

if( hServiceTwdm == NULL )
{
CloseServiceHandle( hServiceMgr );
printf( "DelSvr::OpenService() Faild %d ! n", GetLastError() );
return;
}
else
{
printf( "DelSvr::OpenService() ok ! n" );
}
//停止驱动程序,如果停止失败,只有重新启动才能,再动态加载。
if( !ControlService( hServiceTwdm, SERVICE_CONTROL_STOP , &SvrSta ) )
{
printf( "DelSvr::ControlService() Faild %d !n", GetLastError() );
}
else
{
printf( "DelSvr::ControlService() ok !n" );
}
//动态卸载驱动程序。
if( !DeleteService( hServiceTwdm ) )
{
printf( "DelSvr:eleteSrevice() Faild %d !n", GetLastError() );
}
else
{
printf( "DelSvr:eleteSrevice() ok !n" );
}
CloseServiceHandle( hServiceTwdm );
CloseServiceHandle( hServiceMgr );
return;
}

驱动程序:驱动程序很简单,
只有一个文件,实现了DriverEntry,DispatchCreate,DispatchClose,GpdUnload 四个函数。

#include

#define NT_DEVICE_NAME L"DeviceTwdm1"
#define DOS_DEVICE_NAME L"DosDevicesTwdm1"

NTSTATUS DriverEntry( IN PDRIVER_object DriverObject, IN PUNICODE_STRING RegistryPath );
NTSTATUS DispatchCreate(PDEVICE_OBJECT fdo, PIRP Irp);
NTSTATUS DispatchClose(PDEVICE_OBJECT fdo, PIRP Irp);
VOID GpdUnload(PDRIVER_OBJECT DriverObject);

//////////////////////
PDEVICE_OBJECT fdo;
BOOLEAN fSymbolicLink;


NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
{

//UNREFERENCED_PARAMETER (RegistryPath);
NTSTATUS status;
UNICODE_STRING ntDeviceName;
UNICODE_STRING win32DeviceName;

dbgPrint( "TWDM: DriverEntry for Twdm.sys ...... n" );
fSymbolicLink = FALSE;

//
// Create dispatch points for the IRPs.
//

DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
//DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = GpdDispatch;
DriverObject->DriverUnload = GpdUnload;
//DriverObject->MajorFunction[IRP_MJ_PNP] = GpdDispatchPnp;
//DriverObject->MajorFunction[IRP_MJ_POWER] = GpdDispatchPower;
//DriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = GpdDispatchSystemControl;
//DriverObject->DriverExtension->AddDevice = GpdAddDevice;

RtlInitUnicodeString(&ntDeviceName, NT_DEVICE_NAME);

//创建设备
status = IoCreateDevice(DriverObject,
0,
&ntDeviceName,
FILE_DEVICE_UNKNOWN,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&fdo);

if (!NT_SUCCESS (status))
{
DbgPrint( "TWDM: IoCreateDevice() faild ! n" );
}
else
{
DbgPrint( "TWDM: IoCreateDevice() ok ! n" );
RtlInitUnicodeString(&win32DeviceName, DOS_DEVICE_NAME);

//创建符号连接
status = IoCreateSymbolicLink( &win32DeviceName, &ntDeviceName );
if (!NT_SUCCESS(status))
{
DbgPrint( "TWDM: IoCreateSymbolicLink() faild ! n" );
}
else
{
DbgPrint( "TWDM: IoCreateSymbolicLink() ok ! n" );
fSymbolicLink = TRUE;
}
fdo->Flags &= ~DO_DEVICE_INITIALIZING;
}

if (!NT_SUCCESS(status))
{
if(fdo)
{
IoDeleteDevice(fdo);
}
if(fSymbolicLink)
{
IoDeleteSymbolicLink(&win32DeviceName);
}
}
return status;
}

NTSTATUS DispatchCreate(PDEVICE_OBJECT fdo, PIRP Irp)
{
NTSTATUS status;
DbgPrint( "TWDM: IRP_MJ_CREATE for Twdm.sys ...... n" );
status = STATUS_SUCCESS;
return status;
} // DispatchCreate

NTSTATUS DispatchClose(PDEVICE_OBJECT fdo, PIRP Irp)
{ // DispatchClose
NTSTATUS status;
DbgPrint( "TWDM: IRP_MJ_CLOSE for Twdm.sys ...... n" );
status = STATUS_SUCCESS;
return status;
} // DispatchClose

VOID GpdUnload(PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING win32DeviceName;

DbgPrint( "TWDM: GpdUnload() for Twdm.sys ...... n" );

RtlInitUnicodeString(&win32DeviceName, DOS_DEVICE_NAME);
if(fdo)
{
IoDeleteDevice(fdo);
}
if(fSymbolicLink)
{
IoDeleteSymbolicLink(&win32DeviceName);
}
}




.NET/FileBBS/files/2001_9/T_606_1.zip" target=_blank>2001-09-24_Test1.zip

Test1.zip 源代码

其中驱动程序部分的一个文件,修改以下就可以了。

Mk.cmd

@echo off
echo Aouther : Qian
echo Date : 2001.9.20
echo Function : Start DDK Environment And Build Driver
call c:NTDDKbinsetenv.bat c:NTDDK checked //此处改为你的 2k ddk 的路径
rem call c:NTDDKbinsetenv.bat c:NTDDK free
echo on

d: //此处改为你的编写驱动程序的驱动器
cd workqianwdmtest1sys ////此处改为你的编写驱动程序的目录


build -b -w -nmake /a

 


来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/10752043/viewspace-990093/,如需转载,请注明出处,否则将追究法律责任。

请登录后发表评论 登录
全部评论
  • 博文量
    6241
  • 访问量
    2411232