驱动程序入门（Driver programming）.doc

驱动程序入门（Driver programming） We are learning program design, starting from the Hello World, the driver is no exception, today I wrote a drive version of Hello World to warm up, to hope that we can understand the basic framework of the driver. The driver is divided into 2 categories, one is the Kernel mode driver, the other is a Windows mode driver, 2 modes of the essence is the same, but the details are different, this paper introduces the installation and use of kernel mode drivers and drivers. The driver, like the common EXE, DLL, belongs to the PE file, and has an entry function. In EXE, however, the entry function is the entry function of wmain () /WinMain () and Unicode () /wWinmain (), DLL of main () Its optional. Its DllMain (). The driver also has an entry function, and it is necessary, it is DriverEntry (), and again, it is necessary, because the I/O manager will first call the drivers DriverEntry () It works like DllMain () - doing some initialization. There are 2 parameters in DriverEntry (): 1) PDRIVER_OBJECT DriverObject, pointer to the driver object, and we operate the driver, Based on it, it is passed by the I/O manager; 2) PUNICODE_STRING RegistryPath, the driver of the service key, use this parameter is not much, but it should be noted that, in the DriverEntry () returns, it may It will disappear, so remember to save it if you need to use it. DriverEntry () returns a NTSTATUS value, which is a ULONG value. For specific definitions, see the NTSTATUS.H header file in DDK, which is detailed Definition. Since the write drive version of Hello World, we need to determine how to drive and program communication, shared memory, shared common events, IOCTL macro, or the direct use of ReadFile (WriteFile) or () to read and write, in this paper I will use a simple, but very commonly used IOCTL macro, it depends on the IRP dispatch routines IRP_MJ_DEVICE_CONTROL, Win32 program using DeviceIoControl () to communicate with the driver, according to different IOCTL ma