Wrk中IO部分学习总结

*********************************************io object type ******************************************************

IopCreateObjectTypes		//create sorts of object type   OBJECT_TYPE_INITIALIZER
|
|
v
ObpAllocateObject
|
|
V
ObCreateObjectType   		//create object type  by object name and OBJECT_TYPE_INITIALIZER    POBJECT_TYPE
|
|
V
ObpInsertDirectoryEntry

ObpInsertDirectoryEntry()

dc ObpTypeDirectoryObject    _object_directory

_OBJECT_DIRECTORY_ENTRY->Object    _object_type

nt!_OBJECT_DIRECTORY
+0x000 HashBuckets      : [37] Ptr32 _OBJECT_DIRECTORY_ENTRY
+0x094 Lock             : _EX_PUSH_LOCK
+0x098 DeviceMap        : Ptr32 _DEVICE_MAP
+0x09c SessionId        : Uint4B
+0x0a0 Reserved         : Uint2B
+0x0a2 SymbolicLinkUsageCount : Uint2B

kd> dt _OBJECT_DIRECTORY_ENTRY
nt!_OBJECT_DIRECTORY_ENTRY
+0x000 ChainLink        : Ptr32 _OBJECT_DIRECTORY_ENTRY
+0x004 Object           : Ptr32 Void   -----_object_type

_OBJECT_DIRECTORY
+---------------------------+      contains 37 _OBJECT_DIRECTORY_ENTRY items
|HashBuckets[37]            |--------------------+
|                           |                    |
+---------------------------+                    V
_OBJECT_DIRECTORY_ENTRY
+------------------------+   point to
|ChainLink               |-------------------->_OBJECT_DIRECTORY_ENTRY
|                        |
+------------------------+
point  to                   |Object                  |
+-- ----------------------------|                        |
|				  +------------------------+
V
_object_type
+----------------------+
|                      |   contains
|TypeInfo              |----------------->_OBJECT_TYPE_INITIALIZER
+----------------------+

_object_header
+--------------+
| NameInfo     |-------------------------------------->_OBJECT_HEADER_NAME_INFO
|              |                                      +------------------+
|              |                                      | _OBJECT_DIRECTORY|
+--------------+       point to                       |                  |
|  type        |------------------>_object_type       +------------------+
| 	       |
+--------------+  point to
|body          |-----+
+--------------+     |
|              |<----+
|              | for object type header  is _OBJECT_TYPE
+--------------+ for _driver_object
for other object

member driverextension is pointer to address is append to driver_object

_Driver_object
+------------------+
|                  |
+------------------+                  for boot load point to _LDR_DATA_TABLE_ENTRY  which contain module info
| DriverSection    |----------------------------->KLDR_DATA_TABLE_ENTRY
+------------------+
| driverextension  |-----+
+------------------+     |point to
|                  |<----+
| Driver_Extension |
+------------------+

####
PsInitialSystemProcess    system process  eprocess

***************************************io create object********************************************************
#####
ObpKernelHandleTable

ObCreateObject
|
|
V

ObInsertObject
|
|
V

***************************************io load driver *************************************************************

system load dirver time can be divide into 4 parts
1. boot load
2. sys load
3. auto load
4. demand load
5. disabled

1 boot load

NTSTATUS
IopInitializeBuiltinDriver(
IN PUNICODE_STRING DriverName,
IN PUNICODE_STRING RegistryPath,
IN PDRIVER_INITIALIZE DriverInitializeRoutine,
IN PKLDR_DATA_TABLE_ENTRY DriverEntry,
IN BOOLEAN IsFilter,				//is  filter driver or not
OUT PDRIVER_OBJECT *Result
);

####
we can get boot load driver list by traverse PsLoadedModuleList
PsLoadedModuleList
KLDR_DATA_TABLE_ENTRY

IopInitializeBootDrivers
|
|
V
IopInitializeBuiltinDriver  (ioinit.c)
|
|
V
IopInitializeAttributesAndCreateObject -> ObCreateObject
|
|
V
ObInsertObject
|
|
V  fill drvier section by traverse PsLoadedModuleList
|
|
V  fill driver start addr and image size
|
|
V  fill driver name and driverextension serverkey name and get hardware info from reg
|
|
V  call InitRoutine    i guess call driver_entry
|
|
V
IopReadyDeviceObjects    traverse device_object and do ~DO_DEVICE_INITIALIZING

2 system load

IopInitializeSystemDrivers
|
|
V
CmGetSystemDriverList  (base\ntos\config\cmsysini.c) traverse controlset***   get system load type driver list
|       first grouporderlist and ServiceGroupOrder  then CmpResolveDriverDependencies
|       http://support.microsoft.com/kb/115486/zh-cn tell us grouporderlist is define load order
|
|
V
IopLoadDriver  (base\ntos\io\iomgr\internal.c)  CheckForSafeBoot = true  IsFilter = false
|
|
V  construct driver full path
|
|
V  MmLoadSystemImage   load image to system space
|
|
V
same as IopInitializeBuiltinDriver

but system load will check safemode and check driver is loaded or not
and check is legacy driver or not. these two loader type both in system process
just beacuse call these from IoInitSystem.

3 auto load   scm (services.exe) to load

check call it from user mode or kernel mode, if call it from user mode,
then check have privelge or not,;and then check is in system process or not,
if in system process, directly call IopLoadUnloadDriver, otherwise put a workitem
to workitemqueue, system thread will do it.

NtLoadDriver  (base\ntos\io\iomgr\loadunld.c)
|
|
V
IopLoadUnloadDriver  (base\ntos\io\iomgr\internal.c)  PLOAD_PACKET is parameter
|
|
V
IopLoadDriver

typedef struct _LOAD_PACKET {
WORK_QUEUE_ITEM WorkQueueItem;
KEVENT Event;
PDRIVER_OBJECT DriverObject;
PUNICODE_STRING DriverServiceName;
NTSTATUS FinalStatus;
} LOAD_PACKET, *PLOAD_PACKET;

if DriverObject is null to call IopLoadDriver, otherwise to unload driver

4 demand load

IoCreateDriver (base\ntos\io\iomgr\iosubs.c)

*****************************************driver object,device object, file object*********************************

Driver_object                             Device Stack
+-----------------------+ <-------------------------------------------------+    <-------------------------------------------------+
|                       |                      Device_object                |                                                     |
|PDevice_object         |------------------>+-----------------------+<------|-------------+                                       |
+-----------------------+                   |                       |       |             |                                       |
|    PDriverObject      |-------+             |                                       |
+-----------------------+                     |                    Device_object      |
|    NextDevice         |---------------------|----------->+-----------------------+  |
+-----------------------+                     |            |                       |  |
+-----|   AttachedDevice      |                     |            |    PDriverObject      |--+
|     +-----------------------+                     |            +-----------------------+
|     |   DeviceExtension     |                     |
|     +-----------------------+                     |
|					    		  |
|                                                   |
|                                                   |
|                                                   |
|                                                   |
Driver_object                     |                                                   |
+-----------------------+ <-------------------------------------------------+             |
|                       |             |        Device_object                |             |
|PDevice_object         |-------------+---->+-----------------------+       |             |
+-----------------------+                   |                       |       |             |
|    PDriverObject      |-------+             |
+-----------------------+                     |
|   AttachedDevice      |-------+             |
+-----------------------+       |             |
+----|   DeviceExtension     |       |             |
|    +-----------------------+       V             |
|                                                  |
|                                                  |
+--->+-----------------------+                     |
|                       |                     |
|   AttachedTo          |---------------------+
+-----------------------+

file object  is an instance of opened device object.

file_object
+------------------+
|                  |             point to                               device_object
|    DeviceObject  |------------------------------------------------>+----------------+
+------------------+                                                 |                |
|                  |                                                 +----------------+
|     Vpb          |------------------+
+------------------+                  |
|                  |                  V  _VPB
| RelatedFileObject|          +--------------------+
+------------------+          |                    |          point to     device_object
|   DeviceObject     |-------------------->
+--------------------+          point to     device_object
|   RealObject       |-------------------->
+--------------------+

relation between  handle ,file object and device object.

n        1                    n       1
handle---------------- file object --------------device object

how to understand 3 pointer relate to device object.
Let us insight into how file object created

IoCreateFile
|
|
V
IopCreateFile (base\ntos\io\iomgr\iosubs.c)
|
|
V
ObOpenObjectByName
|
|
V
ObpLookupObjectName
|
|
V
ObpLookupDirectoryEntry

|
|
V
IopParseDevice

|
|
V
ObCreateObject

ObpRootDirectoryObject