第五章 驱动程序加载实验指导书.docVIP

第五章 驱动程序加载实验指导书 1. 实验 1.1实验目的 验证驱动程序的动态加载过程。 1.2 实验原理 验证用户态应用程序在动态加载驱动程序时对NtLoadDriver ( )函数的调用过程。 1.3 实验环境 调试工具：Windbg 编程工具：Visual Studio 2005 操作系统：VMware 5.0+Windows Server 2003 1.4 实验内容 利用Visual Studio编写一个loadsys函数实现驱动程序的动态加载，然后编写一个程序test001，对驱动程序的功能表现进行测试。 1.5 实验过程 步骤1：修改源代码 (1)根据关键代码分析部分的结果，对\wrk-v1.2\base\ntos\io\iomgr\loadunld.c中的NtLoadDriver函数做如下修改，标记出NtLoadDriver执行的六个主要步骤： NTSTATUS NtLoadDriver (__in PUNICODE_STRING DriverServiceName) { ……… requestorMode = KeGetPreviousModeByThread(CurrentThread-Tcb); DbgPrint ((1) get the previous mode!); DbgPrint ((2) Then check: KernelMode or UserMode!); if (requestorMode != KernelMode) { DbgPrint ((3-1) In UserMode!); …………… } else { DbgPrint ((3-2) IN kernel model); driverServiceName = *DriverServiceName; } DbgPrint ((4) do the exact load driver job!); KeInitializeEvent (loadPacket.Event, NotificationEvent, FALSE); loadPacket.DriverObject = (PDRIVER_OBJECT) NULL; loadPacket.DriverServiceName = driverServiceName; if (PsGetCurrentProcessByThread(CurrentThread) == PsInitialSystemProcess) { IopLoadUnloadDriver (loadPacket); DbgPrint (“(4-1) NtLoadDriver calls IopLoadUnloadDriver!\n”); } else { ExInitializeWorkItem (loadPacket.WorkQueueItem, IopLoadUnloadDriver, loadPacket); ExQueueWorkItem (loadPacket.WorkQueueItem, DelayedWorkQueue); KeWaitForSingleObject (loadPacket.Event, UserRequest, KernelMode, FALSE, (PLARGE_INTEGER) NULL); DbgPrint (“(4-2) Not in a system process! \n”); } DbgPrint ((5) free allocated buffer!); if (nameBuffer) { ExFreePool (nameBuffer); } DbgPrint ((6) return operation status code!); return loadPacket.FinalStatus; } 说明：用DbgPrint( )函数打印的这些调试信息可以在Windbg中看到，也就验证了对NtLoadDriver函数的调用过程。 (2)要验证NtLoad