正文
DeviceIOControl与驱动层 - 缓冲区模式
提示：扫一扫查出行【扫一扫了解最新限行尾号】
复制提示
IO交互模式中的DeviceIOControl与驱动层交互有三种：缓冲区模式、直接访问模式、其他模式，这里本人学习的是缓冲区访问模式，原理如图：
驱动中最好不要直接访问用户模式下的内存地址，使用缓冲区方式可以避免程序员访问内存模式下的内存地址。
Win32API DeviceIoControl的内部，用户提供的输入缓冲区的内容呗复制到IRP中的pIrp->AssociateIrp.SystemBuffer内存地址，复制的字节数是由DeviceIoControl指定的输入字节数。
派遣函数可以读取pIrp->AssociateIrp.SystemBuffer的内存地址，从而获得应用程序提供的输入缓冲数据。另外，派遣函数还可以写入pIrp->AssociateIrp.SystemBuffer的内存地址，被当做设备输出的数据。操作系统会将这个地址的数据再次复制到DeviceIoControl提供的输出缓冲区。复制的字节数有pIrp->IoStatus.Information指定。DeviceIoControl也可以通过它的第七个参数(lpBytesReturned)得到这个操作字节数。
派遣函数先通过IoGetCurrentIrpStackLocation函数->得到当前IO堆栈(IO_STACK_LOCATION)->派遣函数通过stack->Parameters.DeviceIoControl.InputBufferLength得到输入缓冲区大小->通过stack->Parameters.DeviceIoControl.OutputBufferLength得到输出缓冲区大小->最后通过stack->Parameters.DeviceIoControl.IoControlCode得到IOCTL
在派遣函数中通过C语言中的switch处理不同的IOCTL
代码：
BufferedIO.c
#include "BufferedIO.h" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
NTSTATUS Status = STATUS_SUCCESS;
PDEVICE_OBJECT DeviceObject = NULL;
UNICODE_STRING DeviceObjectName;//设备对象名称
UNICODE_STRING DeviceLinkName; //设备连接名称
int i = ; DriverObject->DriverUnload = DriverUnload; //1.创建设备对象名称
RtlInitUnicodeString(&DeviceObjectName, DEVICE_OBJECT_NAME); //2.创建设备对象
Status = IoCreateDevice(
DriverObject,//驱动程序对象.
NULL, //指定驱动程序为设备扩展对象而定义的结构体的大小.
&DeviceObjectName, //(可选的参数)指向一个以零结尾的包含Unicode字符串的缓冲区, 那是这个设备的名称, 该字符串必须是一个完整的设备路径名.
FILE_DEVICE_UNKNOWN, //指定一个由一个系统定义的FILE_DEVICE_XXX常量, 表明了这个设备的类型
, //一个或多个系统定义的常量, 连接在一起, 提供有关驱动程序的设备其他信息.
FALSE, //设备是独占的,独占的话设置为TRUE，非独占设置为FALSE.一般FALSE
&DeviceObject
);//成功时返回STATUS_SUCCESS if (!NT_SUCCESS(Status))
{
return Status;
} //3.创建设备连接名称
RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME); //4.将设备连接名称与设备名称关联
Status = IoCreateSymbolicLink(
&DeviceLinkName,
&DeviceObjectName
);//创建一个设备链接。
//驱动程序虽然有了设备名称，但是这种设备名称只能在内核态可见，
//而对于应用程序是不可见的，因此，驱动需要要暴露一个符号链接，
//该链接指向真正的设备名称 if (!NT_SUCCESS(Status))
{
IoDeleteDevice(DeviceObject);
return Status;
} //Ring3请求->设备对象-> 驱动对象找到派遣历程 //5.设置符合我们代码的派遣历程
for (i = ; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
{
//MinorFunction ring3 与ring0 的协议 DriverObject->MajorFunction[i] = PassThroughDispatch;
} //IRP_MJ_DEVICE_CONTROL DeviceIOControl函数产生
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ControlThroughDispatch; return Status;
} //基本派遣历程
NTSTATUS PassThroughDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
Irp->IoStatus.Status = STATUS_SUCCESS; //LastError()
Irp->IoStatus.Information = ; //ReturnLength
IoCompleteRequest(Irp, IO_NO_INCREMENT); //将Irp返回给Io管理器
return STATUS_SUCCESS;
} NTSTATUS ControlThroughDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
NTSTATUS Status;
ULONG_PTR Informaiton = ;
PVOID InputData = NULL;
ULONG InputDataLength = ;
PVOID OutputData = NULL;
ULONG OutputDataLength = ;
ULONG IoControlCode = ; //1.得到当前IO堆栈(IO_STACK_LOCATION)
PIO_STACK_LOCATION IoStackLocation = IoGetCurrentIrpStackLocation(Irp); //Irp堆栈 //2.看笔记或者代码中的图 而且在Ring0层中都是SystemBuffer
InputData = Irp->AssociatedIrp.SystemBuffer;
OutputData = Irp->AssociatedIrp.SystemBuffer; //得到输入缓冲区大小
InputDataLength = IoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
//输出缓冲区大小
OutputDataLength = IoStackLocation->Parameters.DeviceIoControl.OutputBufferLength; //3.得到IOCTL
IoControlCode = IoStackLocation->Parameters.DeviceIoControl.IoControlCode; //在派遣函数中通过Cswitch处理不同的IOCTL
switch (IoControlCode)
{
case CTL_HELLO:
{
if (InputData != NULL && InputDataLength > )
{
DbgPrint("%s\r\n", InputData);
}
if (OutputData != NULL&&OutputDataLength >= strlen("Ring0->Ring3") + )
{
memcpy(OutputData, "Ring0->Ring3", strlen("Ring0->Ring3") + );
Status = STATUS_SUCCESS;
Informaiton = strlen("Ring0->Ring3") + ;
}
else
{
Status = STATUS_INSUFFICIENT_RESOURCES; //内存不够
Informaiton = ;
} break;
}
default:
break;
} Irp->IoStatus.Status = Status; //Ring3 GetLastError();
Irp->IoStatus.Information = Informaiton;
IoCompleteRequest(Irp, IO_NO_INCREMENT); //将Irp返回给Io管理器 return Status;
} VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING DeviceLinkName;
PDEVICE_OBJECT v1 = NULL;
PDEVICE_OBJECT DeleteDeviceObject = NULL; RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME);
IoDeleteSymbolicLink(&DeviceLinkName); RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME);
IoDeleteSymbolicLink(&DeviceLinkName); DeleteDeviceObject = DriverObject->DeviceObject;
while (DeleteDeviceObject != NULL)
{
v1 = DeleteDeviceObject->NextDevice;
IoDeleteDevice(DeleteDeviceObject);
DeleteDeviceObject = v1;
} DbgPrint("DriverUnload()\r\n");
} /*
typedef struct _DRIVER_OBJECT {
CSHORT Type;
CSHORT Size; //
// The following links all of the devices created by a single driver
// together on a list, and the Flags word provides an extensible flag
// location for driver objects.
// PDEVICE_OBJECT DeviceObject;//
ULONG Flags; //
// The following section describes where the driver is loaded. The count
// field is used to count the number of times the driver has had its
// registered reinitialization routine invoked.
// PVOID DriverStart;
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension; //
// The driver name field is used by the error log thread
// determine the name of the driver that an I/O request is/was bound.
// UNICODE_STRING DriverName; //
// The following section is for registry support. Thise is a pointer
// to the path to the hardware information in the registry
// PUNICODE_STRING HardwareDatabase; //
// The following section contains the optional pointer to an array of
// alternate entry points to a driver for "fast I/O" support. Fast I/O
// is performed by invoking the driver routine directly with separate
// parameters, rather than using the standard IRP call mechanism. Note
// that these functions may only be used for synchronous I/O, and when
// the file is cached.
// PFAST_IO_DISPATCH FastIoDispatch; //
// The following section describes the entry points to this particular
// driver. Note that the major function dispatch table must be the last
// field in the object so that it remains extensible.
// PDRIVER_INITIALIZE DriverInit;
PDRIVER_STARTIO DriverStartIo;
PDRIVER_UNLOAD DriverUnload;
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT; */ /*
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT {
CSHORT Type;
USHORT Size;
LONG ReferenceCount;
struct _DRIVER_OBJECT *DriverObject;
struct _DEVICE_OBJECT *NextDevice; //
struct _DEVICE_OBJECT *AttachedDevice;
struct _IRP *CurrentIrp;
PIO_TIMER Timer;
ULONG Flags; // See above: DO_...
ULONG Characteristics; // See ntioapi: FILE_...
__volatile PVPB Vpb;
PVOID DeviceExtension;
DEVICE_TYPE DeviceType;
CCHAR StackSize;
union {
LIST_ENTRY ListEntry;
WAIT_CONTEXT_BLOCK Wcb;
} Queue;
ULONG AlignmentRequirement;
KDEVICE_QUEUE DeviceQueue;
KDPC Dpc; //
// The following field is for exclusive use by the filesystem to keep
// track of the number of Fsp threads currently using the device
// ULONG ActiveThreadCount;
PSECURITY_DESCRIPTOR SecurityDescriptor;
KEVENT DeviceLock; USHORT SectorSize;
USHORT Spare1; struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
PVOID Reserved; } DEVICE_OBJECT;
*/
BufferIO.h
#include <ntifs.h> //设备与设备之间通信
#define DEVICE_OBJECT_NAME L"\\Device\\BufferedIODeviceObjectName" //设备与Ring3之间通信
#define DEVICE_LINK_NAME L"\\DosDevices\\BufferedIODeviceLinkName" //Ring3 Ring0 握手协议 CTL_HELLO
#define CTL_HELLO \
CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS) NTSTATUS PassThroughDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp);
NTSTATUS ControlThroughDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp); VOID DriverUnload(PDRIVER_OBJECT DriverObject);
缓冲区IO(Ring3).cpp
// 缓冲区IO(Ring3).cpp : 定义控制台应用程序的入口点。
// #include "stdafx.h"
#include <windows.h> #define DEVICE_LINK_NAME L"\\\\.\\BufferedIODeviceLinkName"//Ring3格式 #define CTL_HELLO \
CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS) /*
DeviceIoControl内部会使操作系统创建一个
IRP_MJ_DEVICE_CONTROL类型的IRP，然后操作系统将这个IRP转发到派遣函数 我们用DeviceIoControl定义除了读写之外的其他操作，让Ring3程序与Ring0程序通信 e.g:自定义一种IO控制码，然后用DeviceIoControl将这个控制码和请求一起传递给驱动程序
派遣函数中，分别对不同的IO控制码进行处理 BOOL WINAPI DeviceIoControl(
_In_ HANDLE hDevice, //已经打开的设备
_In_ DWORD dwIoControlCode,//控制码
_In_opt_ LPVOID lpInBuffer, //输入缓冲区
_In_ DWORD nInBufferSize, //输入缓冲区大小
_Out_opt_ LPVOID lpOutBuffer, //输出缓冲区
_In_ DWORD nOutBufferSize, //输出缓冲区大小
_Out_opt_ LPDWORD lpBytesReturned,//实际返回字节数
_Inout_opt_ LPOVERLAPPED lpOverlapped //是否OverLapp
); */ int main()
{ HANDLE DeviceHandle = CreateFile(
DEVICE_LINK_NAME,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL); if (DeviceHandle == INVALID_HANDLE_VALUE)
{
return ;
} char BufferData = NULL;
DWORD ReturnLength = ; //操作系统内部是操作系统创建IRP_MJ_DEVICE_CONTROL类型的IRP
//Ring3->Ring0
BOOL IsOk = DeviceIoControl(
DeviceHandle, //已经打开的设备
CTL_HELLO,//控制码
"Ring3->Ring0",//输入缓冲区
strlen("Ring3->Ring0") + ,//输入缓冲区大小
(LPVOID)BufferData,//输出缓冲区
,//输出缓冲区大小
&ReturnLength,//实际返回字节数
NULL//是否OVERLAP操作
); if (IsOk == FALSE)
{
//上面的nOutBufferSize = 0 所以必定发生错误 int LastError = GetLastError(); if (LastError == ERROR_NO_SYSTEM_RESOURCES)
{
char BufferData[MAX_PATH] = { }; //Ring3请求->设备对象-> 驱动对象找到派遣历程 IsOk = DeviceIoControl(
DeviceHandle,
CTL_HELLO,
"Ring3->Ring0",
strlen("Ring3->Ring0") + ,
(LPVOID)BufferData,
MAX_PATH,
&ReturnLength,
NULL); if (IsOk == TRUE)
{
printf("%s\r\n", BufferData);
}
}
} if (DeviceHandle != NULL)
{
CloseHandle(DeviceHandle);
DeviceHandle = NULL;
}
printf("Input AnyKey To Exit\r\n"); getchar(); return ;
}
