驱动相关数据结构

1、驱动对象：

typedef struct _DRIVER_OBJECT {

CSHORT Type;

CSHORT Size;

// The following links all of the devices created by a single driver

// together on a list, and the Flags word provides an extensible flag

// location for driver objects.

PDEVICE_OBJECT DeviceObject;

ULONG Flags;

//

// The following section describes where the driver is loaded. The count

// field is used to count the number of times the driver has had its

// registered reinitialization routine invoked.

//

PVOID DriverStart;

ULONG DriverSize;

PVOID DriverSection;

PDRIVER_EXTENSION DriverExtension;

//

// The driver name field is used by the error log thread

// determine the name of the driver that an I/O request is/was bound.

//

UNICODE_STRING DriverName;

//

// The following section is for registry support. Thise is a pointer

// to the path to the hardware information in the registry

//

PUNICODE_STRING HardwareDatabase;

//

// The following section contains the optional pointer to an array of

// alternate entry points to a driver for \"fast I/O\" support. Fast I/O

// is performed by invoking the driver routine directly with separate

// parameters, rather than using the standard IRP call mechanism. Note

// that these functions may only be used for synchronous I/O, and when

// the file is cached.

//

PFAST_IO_DISPATCH FastIoDispatch;

//

// The following section describes the entry points to this particular

// driver. Note that the major function dispatch table must be the last

// field in the object so that it remains extensible.

//

PDRIVER_INITIALIZE DriverInit;

PDRIVER_STARTIO DriverStartIo;

PDRIVER_UNLOAD DriverUnload;

PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];

} DRIVER_OBJECT;

typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;

用到的几个数据结构：

typedef

NTSTATUS

DRIVER_INITIALIZE (

__in struct _DRIVER_OBJECT *DriverObject,

__in PUNICODE_STRING RegistryPath

);

typedef DRIVER_INITIALIZE *PDRIVER_INITIALIZE;

typedef

VOID

DRIVER_STARTIO (

__inout struct _DEVICE_OBJECT *DeviceObject,

__inout struct _IRP *Irp

);

typedef DRIVER_STARTIO *PDRIVER_STARTIO;

typedef

VOID

DRIVER_UNLOAD (

__in struct _DRIVER_OBJECT *DriverObject

);

typedef DRIVER_UNLOAD *PDRIVER_UNLOAD;

typedef

NTSTATUS

DRIVER_DISPATCH (

__in struct _DEVICE_OBJECT *DeviceObject,

__inout struct _IRP *Irp

);

typedef DRIVER_DISPATCH *PDRIVER_DISPATCH;

2、FAST_IO_DISPATCH

//

// Define the structure to describe the Fast I/O dispatch routines. Any

// additions made to this structure MUST be added monotonically to the end

// of the structure, and fields CANNOT be removed from the middle.

//

typedef struct _FAST_IO_DISPATCH {

ULONG SizeOfFastIoDispatch;

PFAST_IO_CHECK_IF_POSSIBLE FastIoCheckIfPossible;

PFAST_IO_READ FastIoRead;

PFAST_IO_WRITE FastIoWrite;

PFAST_IO_QUERY_BASIC_INFO FastIoQueryBasicInfo;

PFAST_IO_QUERY_STANDARD_INFO FastIoQueryStandardInfo;

PFAST_IO_LOCK FastIoLock;

PFAST_IO_UNLOCK_SINGLE FastIoUnlockSingle;

PFAST_IO_UNLOCK_ALL FastIoUnlockAll;

PFAST_IO_UNLOCK_ALL_BY_KEY FastIoUnlockAllByKey;

PFAST_IO_DEVICE_CONTROL FastIoDeviceControl;

PFAST_IO_ACQUIRE_FILE AcquireFileForNtCreateSection;

PFAST_IO_RELEASE_FILE ReleaseFileForNtCreateSection;

PFAST_IO_DETACH_DEVICE FastIoDetachDevice;

PFAST_IO_QUERY_NETWORK_OPEN_INFO FastIoQueryNetworkOpenInfo;

PFAST_IO_ACQUIRE_FOR_MOD_WRITE AcquireForModWrite;

PFAST_IO_MDL_READ MdlRead;

PFAST_IO_MDL_READ_COMPLETE MdlReadComplete;

PFAST_IO_PREPARE_MDL_WRITE PrepareMdlWrite;

PFAST_IO_MDL_WRITE_COMPLETE MdlWriteComplete;

PFAST_IO_READ_COMPRESSED FastIoReadCompressed;

PFAST_IO_WRITE_COMPRESSED FastIoWriteCompressed;

PFAST_IO_MDL_READ_COMPLETE_COMPRESSED MdlReadCompleteCompressed;

PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED MdlWriteCompleteCompressed;

PFAST_IO_QUERY_OPEN FastIoQueryOpen;

PFAST_IO_RELEASE_FOR_MOD_WRITE ReleaseForModWrite;

PFAST_IO_ACQUIRE_FOR_CCFLUSH AcquireForCcFlush;

PFAST_IO_RELEASE_FOR_CCFLUSH ReleaseForCcFlush;

} FAST_IO_DISPATCH, *PFAST_IO_DISPATCH;

3、设备对象：

Typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)

_DEVICE_OBJECT {

CSHORT Type;

USHORT Size;

LONG ReferenceCount;

struct _DRIVER_OBJECT *DriverObject;

struct _DEVICE_OBJECT *NextDevice;

struct _DEVICE_OBJECT *AttachedDevice;

struct _IRP *CurrentIrp;

PIO_TIMER Timer;

ULONG Flags;

ULONG Characteristics;

__volatile PVPB Vpb;

PVOID DeviceExtension;

DEVICE_TYPE DeviceType;

CCHAR StackSize;

union {

LIST_ENTRY ListEntry;

WAIT_CONTEXT_BLOCK Wcb;

} Queue;

ULONG AlignmentRequirement;

KDEVICE_QUEUE DeviceQueue;

KDPC Dpc;

//

// The following field is for exclusive use by the filesystem to keep

// track of the number of Fsp threads currently using the device

//

ULONG ActiveThreadCount;

PSECURITY_DESCRIPTOR SecurityDescriptor;

KEVENT DeviceLock;

USHORT SectorSize;

USHORT Spare1;

struct _DEVOBJ_EXTENSION *DeviceObjectExtension;

PVOID Reserved;

} DEVICE_OBJECT;

typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;

4、驱动扩展：

typedef struct _DRIVER_EXTENSION {

//

// Back pointer to Driver Object

//

struct _DRIVER_OBJECT *DriverObject;

//

// The AddDevice entry point is called by the Plug & Play manager

// to inform the driver when a new device instance arrives that this

// driver must control.

//

PDRIVER_ADD_DEVICE AddDevice;

//

// The count field is used to count the number of times the driver has

// had its registered reinitialization routine invoked.

//

ULONG Count;

//

// The service name field is used by the pnp manager to determine

// where the driver related info is stored in the registry.

//

UNICODE_STRING ServiceKeyName;

//

// Note: any new shared fields get added here.

//

} DRIVER_EXTENSION, *PDRIVER_EXTENSION;