詳解應用程序與驅動程序通信DeviceIoControl

#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
　　((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
　　)

#define DEVICE_OBJECT_NAME  L"\\Device\\BufferedIODeviceObjectName"
//設備與設備之間通信
#define DEVICE_LINK_NAME    L"\\DosDevices\\BufferedIODevcieLinkName"
//設備與Ring3之間通信

 //創建設備對象名稱
RtlInitUnicodeString(&DeviceObjectName,DEVICE_OBJECT_NAME);
//創建設備對象
Status = IoCreateDevice(DriverObject,NULL,
    &DeviceObjectName,
    FILE_DEVICE_UNKNOWN,
    0, FALSE,
    &DeviceObject);
if (!NT_SUCCESS(Status))
{
    return Status;
}
 
//創建設備連接名稱
RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME);
//將設備連接名稱與設備名稱關聯
Status = IoCreateSymbolicLink(&DeviceLinkName,&DeviceObjectName);
 
if (!NT_SUCCESS(Status))
{
    IoDeleteDevice(DeviceObject);
    return Status;
}       

BOOL WINAPI DeviceIoControl(
  _In_         HANDLE hDevice,       //CreateFile函數打開的設備句柄
  _In_         DWORD dwIoControlCode,//自定義的控制碼
  _In_opt_     LPVOID lpInBuffer,    //輸入緩沖區
  _In_         DWORD nInBufferSize,  //輸入緩沖區的大小
  _Out_opt_    LPVOID lpOutBuffer,   //輸出緩沖區
  _In_         DWORD nOutBufferSize, //輸出緩沖區的大小
  _Out_opt_    LPDWORD lpBytesReturned, //實際返回的字節數，對應驅動程序中pIrp->IoStatus.Information。
  _Inout_opt_  LPOVERLAPPED lpOverlapped //重疊操作結構指針。同步設為NULL，DeviceIoControl將進行阻塞調用；否則，應在編程時按異步操作設計
);
HANDLE CreateFile(
  LPCTSTR lpFileName,                         //打開的文件名
  DWORD dwDesiredAccess,                    //訪問權限
  DWORD dwShareMode,                      //共享模式
  LPSECURITY_ATTRIBUTES lpSecurityAttributes,   //安全屬性
  DWORD dwCreationDisposition,               //文件存在與不存在時的文件創建模式
  DWORD dwFlagsAndAttributes,                //文件屬性設定（隱藏、隻讀、壓縮、指定為系統文件等）
  HANDLE hTemplateFile                       //文件副本句柄
);

#pragma once
#include <ntifs.h>

#define CTL_SYS \
    CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS)

#define DEVICE_OBJECT_NAME  L"\\Device\\BufferedIODeviceObjectName"
//設備與設備之間通信
#define DEVICE_LINK_NAME    L"\\DosDevices\\BufferedIODevcieLinkName"
//設備與Ring3之間通信
VOID DriverUnload(PDRIVER_OBJECT DriverObject);
NTSTATUS PassThroughDispatch(PDEVICE_OBJECT  DeviceObject, PIRP Irp);
NTSTATUS ControlThroughDispatch(PDEVICE_OBJECT  DeviceObject, PIRP Irp);

#include "BufferedIO.h"

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
    NTSTATUS Status = STATUS_SUCCESS;
    PDEVICE_OBJECT  DeviceObject = NULL;
    UNICODE_STRING  DeviceObjectName;
    UNICODE_STRING  DeviceLinkName;
    ULONG           i;
    //   棧
    //   堆
    //   全局(global Static Const)
    DriverObject->DriverUnload = DriverUnload;
 
    //創建設備對象名稱
    RtlInitUnicodeString(&DeviceObjectName,DEVICE_OBJECT_NAME);
 
    //創建設備對象
    Status = IoCreateDevice(DriverObject,NULL,
        &DeviceObjectName,
        FILE_DEVICE_UNKNOWN,
        0, FALSE,
        &DeviceObject);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
    //創建設備連接名稱
    RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME);
 
    //將設備連接名稱與設備名稱關聯
    Status = IoCreateSymbolicLink(&DeviceLinkName,&DeviceObjectName);
 
    if (!NT_SUCCESS(Status))
    {
        IoDeleteDevice(DeviceObject);
        return Status;
    }
    //設計符合我們代碼的派遣歷程
    for (i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)
    {
        DriverObject->MajorFunction[i] = PassThroughDispatch;   //函數指針
    }
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ControlThroughDispatch;
    return Status;
}
//派遣歷程
NTSTATUS PassThroughDispatch(PDEVICE_OBJECT  DeviceObject,PIRP Irp)
{
    Irp->IoStatus.Status = STATUS_SUCCESS;     //LastError()
    Irp->IoStatus.Information = 0;             //ReturnLength
    IoCompleteRequest(Irp, IO_NO_INCREMENT);   //將Irp返回給Io管理器
    return STATUS_SUCCESS;
}
NTSTATUS ControlThroughDispatch(PDEVICE_OBJECT  DeviceObject, PIRP Irp)
{
    NTSTATUS Status;
    ULONG_PTR Informaiton = 0;
    PVOID InputData = NULL;
    ULONG InputDataLength = 0;
    PVOID OutputData = NULL;
    ULONG OutputDataLength = 0;
    ULONG IoControlCode = 0;
    PIO_STACK_LOCATION  IoStackLocation = IoGetCurrentIrpStackLocation(Irp);  //Irp堆棧  
    IoControlCode = IoStackLocation->Parameters.DeviceIoControl.IoControlCode;
    InputData  = Irp->AssociatedIrp.SystemBuffer;
    OutputData = Irp->AssociatedIrp.SystemBuffer;
    InputDataLength  = IoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
    OutputDataLength = IoStackLocation->Parameters.DeviceIoControl.OutputBufferLength;
    switch (IoControlCode)
    {
    case CTL_SYS:
    {
        if (InputData != NULL&&InputDataLength > 0)
        {
            DbgPrint("%s\r\n", InputData);
        }
        if (OutputData != NULL&&OutputDataLength >= strlen("Ring0->Ring3") + 1)
        {
            memcpy(OutputData, "Ring0->Ring3", strlen("Ring0->Ring3") + 1);
            Status = STATUS_SUCCESS;
            Informaiton = strlen("Ring0->Ring3") + 1;
        }
        else
        {
            Status = STATUS_INSUFFICIENT_RESOURCES;   //內存不夠
            Informaiton = 0;
        }
        break;
    }
    default:
        break;
    }
    Irp->IoStatus.Status = Status;             //Ring3 GetLastError();
    Irp->IoStatus.Information = Informaiton;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);  //將Irp返回給Io管理器
    return Status;                            //Ring3 DeviceIoControl()返回值
}
VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
    UNICODE_STRING  DeviceLinkName;
    PDEVICE_OBJECT  v1 = NULL;
    PDEVICE_OBJECT  DeleteDeviceObject = NULL;
     
    RtlInitUnicodeString(&DeviceLinkName, DEVICE_LINK_NAME);
    IoDeleteSymbolicLink(&DeviceLinkName);
 
    DeleteDeviceObject = DriverObject->DeviceObject;
    while (DeleteDeviceObject != NULL)
    {
        v1 = DeleteDeviceObject->NextDevice;
        IoDeleteDevice(DeleteDeviceObject);
        DeleteDeviceObject = v1;
    }
}

// 緩沖區IO.cpp : 定義控制臺應用程序的入口點。
//
 
#include "stdafx.h"
#include <windows.h>
#define DEVICE_LINK_NAME    L"\\\\.\\BufferedIODevcieLinkName"
 
#define CTL_SYS \
    CTL_CODE(FILE_DEVICE_UNKNOWN,0x830,METHOD_BUFFERED,FILE_ANY_ACCESS)
int main()
{
    HANDLE DeviceHandle = CreateFile(DEVICE_LINK_NAME,
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL);
    if (DeviceHandle==INVALID_HANDLE_VALUE)
    {
        return 0;
    }
    char BufferData = NULL;
    DWORD ReturnLength = 0;
    BOOL IsOk = DeviceIoControl(DeviceHandle, CTL_SYS,
        "Ring3->Ring0",
        strlen("Ring3->Ring0")+1,
        (LPVOID)BufferData,
        0,
        &ReturnLength,
        NULL);
    if (IsOk == FALSE)
    {
        int LastError = GetLastError();
 
        if (LastError == ERROR_NO_SYSTEM_RESOURCES)
        {
            char BufferData[MAX_PATH] = { 0 };
            IsOk = DeviceIoControl(DeviceHandle, CTL_SYS,
                "Ring3->Ring0",
                strlen("Ring3->Ring0") + 1,
                (LPVOID)BufferData,
                MAX_PATH,
                &ReturnLength,
                NULL);
 
            if (IsOk == TRUE)
            {
                printf("%s\r\n", BufferData);
            }
        }
    }
    if (DeviceHandle != NULL)
    {
        CloseHandle(DeviceHandle);
        DeviceHandle = NULL;
    }
    printf("Input AnyKey To Exit\r\n");
 
    getchar();
    return 0;
}