您好,登錄后才能下訂單哦!
這篇文章主要講解了“什么是內(nèi)核驅(qū)動對象”,文中的講解內(nèi)容簡單清晰,易于學(xué)習(xí)與理解,下面請大家跟著小編的思路慢慢深入,一起來研究和學(xué)習(xí)“什么是內(nèi)核驅(qū)動對象”吧!
驅(qū)動對象講解
1.1 結(jié)構(gòu)
1.2 輸出代碼輸出基本的驅(qū)動對象信息
1.3 結(jié)果
在內(nèi)核中. 每一個驅(qū)動模塊都是一個驅(qū)動對象. 都有一個 DRIVER_OBJECT結(jié)構(gòu)體代表. 可以想象成驅(qū)動對象是一個進程容器. 容納百川.
下面針對驅(qū)動對象做一下簡單的成員輸出.以熟悉驅(qū)動對象.
驅(qū)動對象結(jié)構(gòu)如下:
typedef struct _DRIVER_OBJECT {CSHORT Type;CSHORT Size;//// The following links all of the devices created by a single driver// together on a list, and the Flags word provides an extensible flag// location for driver objects.//PDEVICE_OBJECT DeviceObject;ULONG Flags;//// The following section describes where the driver is loaded. The count// field is used to count the number of times the driver has had its// registered reinitialization routine invoked.//PVOID DriverStart; //驅(qū)動對象的起始地址ULONG DriverSize; //驅(qū)動對象的大小PVOID DriverSection; //驅(qū)動對象結(jié)構(gòu).可以解析為_LDR_DATA_TABLE_ENTRY 是一個鏈表存儲著下一個驅(qū)動對象 PDRIVER_EXTENSION DriverExtension; //驅(qū)動的擴展信息.可以自定義存放我們的數(shù)據(jù) //// The driver name field is used by the error log thread// determine the name of the driver that an I/O request is/was bound.//UNICODE_STRING DriverName; //驅(qū)動對象的名字//// The following section is for registry support. This is a pointer// to the path to the hardware information in the registry//PUNICODE_STRING HardwareDatabase;//// The following section contains the optional pointer to an array of// alternate entry points to a driver for "fast I/O" support. Fast I/O// is performed by invoking the driver routine directly with separate// parameters, rather than using the standard IRP call mechanism. Note// that these functions may only be used for synchronous I/O, and when// the file is cached.//PFAST_IO_DISPATCH FastIoDispatch;PDRIVER_INITIALIZE DriverInit;PDRIVER_STARTIO DriverStartIo;PDRIVER_UNLOAD DriverUnload; //驅(qū)動對象的卸載地址PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT;typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
#include <ntddk.h> VOID MyDriverUnLoad( _In_ struct _DRIVER_OBJECT* DriverObject ) { DbgPrint("驅(qū)動卸載了\r\n"); }extern "C" NTSTATUS DriverEntry( _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath ){ ULONG64 uImage = 0; DriverObject->DriverUnload = MyDriverUnLoad; DbgPrint("驅(qū)動加載了開始打印輸出\r\n"); DbgPrint("驅(qū)動名字 = %wZ \r\n", DriverObject->DriverName); DbgPrint("驅(qū)動起始地址 %x 大小 %x 結(jié)束地址 %x\r\n", DriverObject->DriverStart, DriverObject->DriverSize, uImage = ((ULONG64)DriverObject->DriverStart + DriverObject->DriverSize)); DbgPrint("驅(qū)動對象的卸載地址 = %p\r\n", DriverObject->DriverUnload); //輸出驅(qū)動對象的所有回調(diào)地址. DbgPrint("驅(qū)動對象的IoControl回調(diào)地址 = %p\r\n", DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]); DbgPrint("驅(qū)動對象的讀回調(diào)地址 = %p\r\n",DriverObject->MajorFunction[IRP_MJ_READ]); DbgPrint("驅(qū)動對象的寫回調(diào)地址 = %p\r\n",DriverObject->MajorFunction[IRP_MJ_WRITE]); DbgPrint("驅(qū)動對象的創(chuàng)建回調(diào)地址 = %p\r\n",DriverObject->MajorFunction[IRP_MJ_CREATE]); DbgPrint("驅(qū)動對象的關(guān)閉回調(diào)地址 = %p\r\n",DriverObject->MajorFunction[IRP_MJ_CLOSE]); DbgPrint("-------遍歷回調(diào)輸出------------\r\n"); //宏從DrverObject對象中查找for (auto i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) { DbgPrint("回調(diào)的IRP_MJ 調(diào)用號 = %d 回調(diào)函數(shù)地址 = %p \r\n", i, DriverObject->MajorFunction[i]); } DbgPrint("執(zhí)行所有功能完畢"); return STATUS_SUCCESS; }
感謝各位的閱讀,以上就是“什么是內(nèi)核驅(qū)動對象”的內(nèi)容了,經(jīng)過本文的學(xué)習(xí)后,相信大家對什么是內(nèi)核驅(qū)動對象這一問題有了更深刻的體會,具體使用情況還需要大家實踐驗證。這里是億速云,小編將為大家推送更多相關(guān)知識點的文章,歡迎關(guān)注!
免責(zé)聲明:本站發(fā)布的內(nèi)容(圖片、視頻和文字)以原創(chuàng)、轉(zhuǎn)載和分享為主,文章觀點不代表本網(wǎng)站立場,如果涉及侵權(quán)請聯(lián)系站長郵箱:is@yisu.com進行舉報,并提供相關(guān)證據(jù),一經(jīng)查實,將立刻刪除涉嫌侵權(quán)內(nèi)容。