其他缓冲区方式模拟文件操作

还有一种操作内存的方式, MicroSoft没有给其起名字, 然后Windows驱动编程详解上面就叫这种方式为其他方式, 其实什么方式没有什么所谓了.. 不过据说这种方式用的是非常少了. 一般需要快的时候使用MDL就已经很好了. 除非那种内核和用户态大量进行交互的程序才会想着用这个款式吧,貌似文件系统之类的驱动应该搞这个比较合适. 反正这个也只有学习的时候使用下了. 平时应该是用不到的.

一直说用户态的地址直接传递进内核里面是会出问题的, 我至今没有搞明白, 不是说驱动的分发函数会一直在发起调用的进程空间运行么? 怎么会无缘无故的切换了呢?哪怕是进程调度, 回头再运行这个内核代码, 不是说也可以保证在发起调用的内存地址空间运行么? 这个问题一直没有搞明白..

其他的话款式和上两篇是一样的, 就是模拟Windows那个文件读写的款式. 没有什么好说的, 直接上代码比较合适, 这里是内核态的代码, 用户层和前两篇是一样的, 就不列出了!

OtherIo.rar

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211


/*
	Windows内核下模拟文件的读写操作, IRP的处理(直接使用3环地址) 0环代码
	编译方法参见makefile. TAB = 8
*/
#include <ntddk.h>

#define  DEVICE_NAME	L"\\Device\\DevJoenDevice"
#define  SYS_LINK_NAME	L"\\??\\SysLinkJoenDevice"
#define  MAX_LENGTH	1024

typedef struct tagDeviceExt {
	ULONG		dwFileCurrentLength;
	CHAR*		pBuffer;
	PDEVICE_OBJECT	pDeviceObj;
	UNICODE_STRING	USzDeviceName;
	UNICODE_STRING	USzSysLinkName;
}DEVICEEXT, *PDEVICEEXT;

//===========================================================================
//	驱动卸载例程
VOID DriverUnLoad( PDRIVER_OBJECT pDriverObj ) {
	PDEVICEEXT pDeviceExt;
	PDEVICE_OBJECT pNextDeviceObj;

	pNextDeviceObj = pDriverObj->DeviceObject;

	while ( pNextDeviceObj != NULL ) {
		pDeviceExt = pNextDeviceObj->DeviceExtension;

		IoDeleteDevice( pDeviceExt->pDeviceObj );
		IoDeleteSymbolicLink( &pDeviceExt->USzSysLinkName );
		pNextDeviceObj = pNextDeviceObj->NextDevice;

		KdPrint( ( "删除%wZ设备成功!\n", &pDeviceExt->USzSysLinkName ) );
	}
}

//===========================================================================
//	所有我们不关心的IRP处理, 直接放过
NTSTATUS DispatchRoutin( PDEVICE_OBJECT pDeviceObj, PIRP pIrp ) {

	pIrp->IoStatus.Information = 0;
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	return STATUS_SUCCESS;
}

//===========================================================================
//	读请求过滤
NTSTATUS DispatchRead( PDEVICE_OBJECT pDeviceObj, PIRP pIrp ) {
	ULONG ulReadLen;
	ULONG ulReadOffset;
	PVOID pAddress;
	PDEVICEEXT pDeviceExt;
	NTSTATUS Status;
	PIO_STACK_LOCATION Stack;

	Stack = IoGetCurrentIrpStackLocation( pIrp );

	//得到读取的长度和偏移量, 和地址
	ulReadLen = Stack->Parameters.Read.Length;
	ulReadOffset = ( ULONG )Stack->Parameters.Read.ByteOffset.QuadPart;
	pAddress = pIrp->UserBuffer;

	KdPrint( ( "用户态传递的地址是%p\n", pAddress ) );

	do {
		//如果欲读取的长度大于最大长度
		if ( ulReadLen + ulReadOffset > MAX_LENGTH ) {
			Status = STATUS_FILE_INVALID;
			ulReadLen = 0;
			break;
		}

		__try {

			pDeviceExt = pDeviceObj->DeviceExtension;

			//测试用户地址是否可写, 如果不可写会异常
			ProbeForWrite( pAddress, ulReadLen, 4 );

			//copy数据到用户层
			RtlCopyMemory( pAddress, pDeviceExt->pBuffer + ulReadOffset, ulReadLen );
			Status = STATUS_SUCCESS;

		}__except( EXCEPTION_EXECUTE_HANDLER ) {
			//如果发生异常. 说明不可写
			Status = STATUS_UNSUCCESSFUL;
			ulReadLen = 0;
			KdPrint( ( "用户层传递的地址不可写而发生异常!\n" ) );
		}
	} while ( FALSE );

	pIrp->IoStatus.Information = ulReadLen;

	pIrp->IoStatus.Status = Status;

	IoCompleteRequest( pIrp, IO_NO_INCREMENT );

	KdPrint( ( "读取请求处理完毕!\n" ) );

	return Status;
}

//===========================================================================
//	写请求的过滤
NTSTATUS DispatchWrite( PDEVICE_OBJECT pDeviceObj, PIRP pIrp ) {
	ULONG ulWriteLen;
	ULONG ulWriteOffset;
	PVOID pAddress;
	NTSTATUS Status;
	PDEVICEEXT pDeviceExt;
	PIO_STACK_LOCATION Stack;

	Stack = IoGetCurrentIrpStackLocation( pIrp );

	//得到用户层的缓冲区地址和写入长度与偏移
	ulWriteLen = Stack->Parameters.Write.Length;
	ulWriteOffset = ( ULONG )Stack->Parameters.Write.ByteOffset.QuadPart;
	pAddress = pIrp->UserBuffer;

	KdPrint( ( "用户层地址是%p\n", pAddress ) );

	pDeviceExt = pDeviceObj->DeviceExtension;

	do {
		if ( ulWriteLen + ulWriteOffset > MAX_LENGTH ) {
			ulWriteLen = 0;
			Status = STATUS_UNSUCCESSFUL;
			break;
		}

		__try {

			//测试是否可读
			ProbeForRead( pAddress, ulWriteLen, 4 );

			//Copy到内核缓冲区中
			RtlCopyMemory( pDeviceExt->pBuffer + ulWriteOffset, pAddress, ulWriteLen  );

			if ( ulWriteOffset + ulWriteLen > pDeviceExt->dwFileCurrentLength ) {
				pDeviceExt->dwFileCurrentLength = ulWriteOffset + ulWriteLen;
			}

			Status = STATUS_SUCCESS;

		}__except( EXCEPTION_EXECUTE_HANDLER ) {
			Status = STATUS_UNSUCCESSFUL;
			ulWriteLen = 0;
		}

	} while ( FALSE );

	//完成IRP
	pIrp->IoStatus.Information = ulWriteLen;

	pIrp->IoStatus.Status = Status;

	IoCompleteRequest( pIrp, IO_NO_INCREMENT );

	return Status;
}

//===========================================================================
//	驱动入口函数
NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pUSzRegPath ) {
	ULONG i;
	NTSTATUS Status;
	PDEVICEEXT pDeviceExt;
	PDEVICE_OBJECT PDeviceObj;
	UNICODE_STRING USzDeviceName = RTL_CONSTANT_STRING( DEVICE_NAME );
	UNICODE_STRING USzSysLinkName = RTL_CONSTANT_STRING( SYS_LINK_NAME );

	Status = IoCreateDevice( pDriverObj, sizeof( DEVICEEXT ), &USzDeviceName,
	                         FILE_DEVICE_UNKNOWN, 0, 0, &PDeviceObj );

	if ( !NT_SUCCESS( Status ) ) {
		KdPrint( ( "创建设备失败!\n" ) );
		return Status;
	}

	Status = IoCreateSymbolicLink( &USzSysLinkName, &USzDeviceName );

	if ( !NT_SUCCESS( Status ) ) {
		KdPrint( ( "创建符号链接失败!\n" ) );
	}

	//设置设备扩展属性
	pDeviceExt = PDeviceObj->DeviceExtension;

	pDeviceExt->USzDeviceName = USzDeviceName;

	pDeviceExt->USzSysLinkName = USzSysLinkName;

	pDeviceExt->pDeviceObj = PDeviceObj;

	pDeviceExt->pBuffer = ExAllocatePool( PagedPool, MAX_LENGTH );

	pDeviceExt->dwFileCurrentLength = 0;

	//设置分发例程
	for ( i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++ ) {
		pDriverObj->MajorFunction\[i\] = &DispatchRoutin;
	}

	pDriverObj->DriverUnload = DriverUnLoad;

	pDriverObj->MajorFunction\[IRP_MJ_READ\] = &DispatchRead;
	pDriverObj->MajorFunction\[IRP_MJ_WRITE\] = &DispatchWrite;
	return Status;
}

文章目录