Visual Studio 2013开发 mini-filter driver step by step (2) - 编译，部署，运行

编译driver

一个基本的mini filter项目创建好了以后，就可以编译，部署和运行了，在部署之前，我们要先确定在什么样的系统上运行，我有一台windows 2008 r2拟机，所以我的运行的目标系统就是windows 2008 r2。

这个工程默认已经配置了好几个build选项，注意的是，选择的配置选项一定要与目标机器匹配，否则，不能在目标机器上正常运行，由于我的目标机器是windows 2008 r2，所以我选择“Win7 Debug-X64”配置选项。

直接build，由于我们还没有写任何自己的代码，所以build没有任何问题，我的项目的名称叫SSMF，所以在Win7Debug目录下面生成了SSMF.sys和SSMF.inf文件，SSMF.inf文件我们要必须进行修改才能使用，修改后的结果如下：

————————————————————————————————————————————————————————————————————————————————————

;;;

;;; SSMF

;;;

[Version]

Signature   = "$Windows NT$"

; TODO - Change the Class and ClassGuid to match the Load Order Group value, see http://msdn.microsoft.com/en-us/windows/hardware/gg462963
Class       = "ActivityMonitor"                         ;This is determined by the work this filter driver does

ClassGuid   = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}    ;This value is determined by the Load Order Group value

Provider    = %ManufacturerName%

DriverVer=08/10/2014,15.12.25.950

CatalogFile = SSMF.cat

[DestinationDirs]

DefaultDestDir          = 12

SSMF.DriverFiles  = 12            ;%windir%\system32\drivers

;;

;; Default install sections

;;

[DefaultInstall]

OptionDesc          = %ServiceDescription%

CopyFiles           = SSMF.DriverFiles

[DefaultInstall.Services]

AddService          = %ServiceName%,,SSMF.Service

;;

;; Default uninstall sections

;;

[DefaultUninstall]

DelFiles   = SSMF.DriverFiles

[DefaultUninstall.Services]

DelService = %ServiceName%,0x200      ;Ensure service is stopped before deleting

;

; Services Section

;

[SSMF.Service]

DisplayName      = %ServiceName%

Description      = %ServiceDescription%

ServiceBinary    = %12%\%DriverName%.sys        ;%windir%\system32\drivers\

Dependencies     = "FltMgr"

ServiceType      = 2                            ;SERVICE_FILE_SYSTEM_DRIVER

StartType        = 3                            ;SERVICE_DEMAND_START

ErrorControl     = 1                            ;SERVICE_ERROR_NORMAL

; TODO - Change the Load Order Group value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512
LoadOrderGroup = "FSFilter Activity Monitor"

;LoadOrderGroup = "_TODO_Change_LoadOrderGroup_appropriately_"

AddReg           = SSMF.AddRegistry

;

; Registry Modifications

;

[SSMF.AddRegistry]

HKR,,"DebugFlags",0x00010001 ,0x0

HKR,,"SupportedFeatures",0x00010001,0x3

HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%

HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%

HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%

;

; Copy Files

;

[SSMF.DriverFiles]

%DriverName%.sys

[SourceDisksFiles]

SSMF.sys = 1,,

[SourceDisksNames]

1 = %DiskId1%,,,

;;

;; String Section

;;

[Strings]

; TODO - Add your manufacturer

ManufacturerName        = "Template"

ServiceDescription      = "SSMF Mini-Filter Driver"

ServiceName             = "SSMF"

DriverName              = "SSMF"

DiskId1                 = "SSMF Device Installation Disk"

;Instances specific information.

DefaultInstance         = "SSMF Instance"

Instance1.Name          = "SSMF Instance"

; TODO - Change the altitude value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512
Instance1.Altitude      = "370030"

;Instance.Altitude       = "_TODO_Change_Altitude_appropriately_"

Instance1.Flags         = 0x0              ; Allow all attachments

————————————————————————————————————————————————————————————————————————————————

具体的每一项的含义可以查看相关的文档和msdn等。

部署driver

将SSMF.sys和SSMF.inf拷贝到目标系统，在SSMF.inf文件上点击右键菜单，选择“Install”，就将SSMF driver部署到了系统中。

如果要卸载driver，可以用下面的这个命令：

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 132 c:\ssmf\ssmf.inf

启动driver

检验SSMF驱动是否安装成功，在命令行里面执行下面的命令：

sc start ssmf

看一下启动的状态会发现时running，就表示已经启动成功了，如下所示：

C:\Users\Administrator>sc start ssmf

SERVICE_NAME: ssmf

        TYPE               : 2  FILE_SYSTEM_DRIVER

        STATE              : 4  RUNNING

                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

        WIN32_EXIT_CODE    : 0  (0x0)

        SERVICE_EXIT_CODE  : 0  (0x0)

        CHECKPOINT         : 0x0

        WAIT_HINT          : 0x0

        PID                : 0

        FLAGS              :

也可以通过命令 fltmc instances去查看里面是否有SSMF。

停止driver

可以执行sc stop ssmf

其他注意事项

1.如果选择的配置选项与对应的目标机器不匹配，driver将不能正确启动，可能会出现如下的这个错误：

C:\Users\Administrator>sc start ssmf

[SC] StartService FAILED 1275:

This driver has been blocked from loading

也有可能是编译的32位driver放到了64位系统上运行的结果。

2.由于是我们自己编写的driver，还没有进行签名，所以在windows 2008 等系统上不能直接启动，所以，要在系统启动的时候按F8，选择“ Dlsable
Driver Signature Enforcement ”。