自己构造IRP包来实现驱动与驱动之间的通信(成功笔记下来以后参考用)

#include <ntddk.h>

#define DEVICE_NAMEL"\\device\\NTModelDrv"

#define LINK_NAMEL"\\dosDevices\\NTModelDrv"

#define IOCTL_BASE 0x8000

#define MY_CTL_CODE(i) \

CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_HELLO MY_CTL_CODE(0)

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

{

DbgPrint("DriverUnload: DriverUnload is Run!\n");

}

NTSTATUS

LM87RequestComplete (

IN PDEVICE_OBJECT DeviceObject,

IN PIRP Irp,

IN PVOID Context

)

{

PKEVENT Event;

Event = (PKEVENT) Context;

__asm int 3

KeSetEvent (Event, IO_NO_INCREMENT, FALSE);

return STATUS_MORE_PROCESSING_REQUIRED;

}

VOID WorkThread(PVOID pContext)

{

NTSTATUS ntStatus = STATUS_SUCCESS;

PIRP SMBIrp;

PIO_STACK_LOCATION irpStack;

IO_STACK_LOCATION status_block;

UNICODE_STRING usDeviceToFilter = { 0 };

KEVENT SyncEvent;

//注意这里定义的指针哦

PFILE_OBJECT FileObject = NULL;

PDEVICE_OBJECT DeviceObject = NULL;

ULONG i = 0;

LARGE_INTEGER waitTime = { 0 };

waitTime.QuadPart = -3 * 10000000i64;

DbgPrint("In WorkThread!\n");

//这里使用的设备对象名而不是符号链接名称

RtlInitUnicodeString(&usDeviceToFilter, DEVICE_NAME);

KeInitializeEvent(&SyncEvent, NotificationEvent, FALSE);

while(1)

{

DbgPrint("WorkThread: %x\n", i);

//得到设备对象

__asm int 3

//尽管FileObject与DeviceObject定义的是指针，这里还是要取地址表示是双指针

ntStatus = IoGetDeviceObjectPointer(&usDeviceToFilter,

GENERIC_ALL,&FileObject,&DeviceObject);

if( !NT_SUCCESS(ntStatus) )

{

DbgPrint("IoGetDeviceObjectPointer is Failed!\n");

continue;

}

//根据设备对象创建针对该设备对象的IRP包

SMBIrp = IoAllocateIrp (DeviceObject->StackSize, FALSE);

if(!SMBIrp)

{

KdPrint(("IoAllocateIrp: Allocate irp failed!\n "));

continue;

}

SMBIrp->UserEvent = &SyncEvent;

//SMBIrp->UserIosb = &status_block;

//SMBIrp->Tail.Overlay.Thread = PsGetCurrentThread();

//这句有什么作用呢?

irpStack = IoGetNextIrpStackLocation(SMBIrp);

//设置IRP包的控制码

irpStack->MajorFunction = IRP_MJ_DEVICE_CONTROL;

irpStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_HELLO;

//irpStack->FileObject = FileObject;

//设置完成函数，完成函数中要对我们发送的IRP包进行完成，不能再发回到IO管理器上

IoSetCompletionRoutine (SMBIrp, LM87RequestComplete, &SyncEvent, TRUE, TRUE, TRUE);

//直接向设备发送IRP包,这里设备对象为指针对象

IoCallDriver(DeviceObject, SMBIrp);

KeWaitForSingleObject(&SyncEvent, Executive, KernelMode, FALSE, NULL);

i++;

KeDelayExecutionThread(KernelMode, FALSE, &waitTime);//延迟3秒

//最后释放IRP包

IoFreeIrp(SMBIrp);

}

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)

{

NTSTATUS ntStatus = STATUS_SUCCESS;

HANDLE hThread;

ntStatus = PsCreateSystemThread(

&hThread,

0,

NULL,

(HANDLE)0,

NULL,

WorkThread,

NULL

);

if(!NT_SUCCESS(ntStatus))

{

DbgPrint("PsCreateSystemThread is Failed!\n");

}

ZwClose(hThread);

return STATUS_SUCCESS;

}