| 发表于：2007-08-03 17:34:10 楼主 |
在网上找到的方法一般是用deviceiocontrol、readfile、writefile等，但是用这些方法的前提是先调用 createfile，这个函数的第一个参数是一个symboliclink（例如："\\\\.\\testsample"），这个 symboliclink一般是在驱动程序中调用iocreatesymboliclink创建的，这样的驱动程序一般有类似如下入口例程：
ntstatus driverentry（in pdriver_object driverobject,in punicode_string registrypath)
{
pfile_object plowerfileobject=null;
unicode_string devicename;
unicode_string dosdevicename;
unicode_string name;
pdevice_object plowerdeviceobject=null;
pdevice_object pdeviceobject=null;
ntstatus status;
driverobject-> driverunload=driverunload;
driverobject-> majorfunction[irp_mj_read] = testsampleread;
driverobject-> majorfunction[irp_mj_write] = testsamplewrite;
driverobject-> majorfunction[irp_mj_create] = testsamplecreate;
driverobject-> majorfunction[irp_mj_close] = testsampleclose;
driverobject-> majorfunction[irp_mj_device_control] = testsampledevicecontrol;
rtlinitunicodestring（&devicename,gdevicename);
rtlinitunicodestring（&dosdevicename,gdosdevicename);
iocreatedevice（driverobject,0,&devicename,file_device_unknown,0,false,&pdeviceobject);
pdeviceobject-> flags ¦=do_buffered_io;
status = iocreatesymboliclink（&dosdevicename,&devicename);
if（status)
dbgprint（"iocreatesymboliclink return %0x\n",status);
keinitializespinlock（&gspinlock);
rtlinitunicodestring（&name,gkeventname);
pmsgkevent = iocreatesynchronizationevent（&name,&hmsgevent);
status = obreferenceobjectbyhandle（hmsgevent,event_all_access,*exeventobjecttype,kernelmode,（pvoid*)&gkeventobject,null);
if（!nt_success（status))
{
dbgprint（"sdbgmsg : obreferenceobjectbyhandle\n");
}
else
{
dbgprint（"gkeventobject = %x pmsgkevent=%x\n",gkeventobject,pmsgkevent);
}
if（gkeventobject)
keclearevent（gkeventobject);
if（pmsgkevent)
keresetevent（pmsgkevent);
return 0;
}
我现在碰到一个这样的驱动程序，它的入口例程如下：
ulong
driverentry （
in pdriver_object driverobject,
in punicode_string registrypath
)
{
hw_initialization_data hwinitdata;
ulong returnvalue;
rtlzeromemory（&hwinitdata, sizeof（hwinitdata));
hwinitdata.hwinitializationdatasize = sizeof（hwinitdata);
//
// set the adapter entry points for the driver
//
hwinitdata.hwinterrupt = null; // hwinterrupt;
hwinitdata.hwreceivepacket = adapterreceivepacket;
hwinitdata.hwcancelpacket = adaptercancelpacket;
hwinitdata.hwrequesttimeouthandler = adaptertimeoutpacket;
hwinitdata.deviceextensionsize = sizeof（hw_device_extension);
hwinitdata.perrequestextensionsize = sizeof（srb_extension);
hwinitdata.filterinstanceextensionsize = 0;
hwinitdata.perstreamextensionsize = sizeof（streamex);
hwinitdata.busmasterdma = false;
hwinitdata.dma24bitaddresses = false;
hwinitdata.bufferalignment = 3;
hwinitdata.dmabuffersize = 0;
// don't rely on the stream class using raised irql to synchronize
// ＥＸＥＣution. this single paramter most affects the overall structure
// of the driver.
hwinitdata.turnoffsynchronization = true;
returnvalue = streamclassregisteradapter（driverobject, registrypath, &hwinitdata);
return returnvalue;
}
我现在不知道怎么跟这样的驱动程序通讯啊，大虾们帮帮忙啊。 |
|
|
|
|
