«
»

DeviceIoControl与驱动交互

DeviceIoControl的其实和ReadFile和WriteFile是一样的, 不过这个功能更强, 一次交互能够输入数据, 也可以输出数据. 更加暴力. DeviceIoControl内部创建的IRP是IRP_MJ_DEVICE_CONTROL类型的IRP, 然后操作系统会将这个IRP转发给驱动程序的分发函数中. 就是类似Win32下面的发送自定义消息了.. 但是又有点区别, 如果发送自定义消息, 如果跨进程, 那是不可以传递指针的, 但是和驱动那就无所谓了, 可以传递一块缓冲区过去, 多舒服.

其实这个也没有什么好说的,前面几篇已经试验过了ReadFile, 和WriteFile. 所以这个没有什么区别了.就是多了个定义I/O控制码的流程. I/O控制码也是非常简单的, 使用CTL_CODE宏来创建, 第一个参数是设备类型, 第二个参数就是控制码, 随便选一个大于0x800就可以. 然后就是缓冲区的操作方式了. 前面几篇我们已经见识过3种缓冲区操作方式了. 所以呢, 这个也不是什么问题了.. 最后一个是操作权限, 不要多想. 用FILE_ANY_ACCESS所有权限就OK..

其他就没有什么好说了. 这个代码的话就是用户层这边试验了3中缓冲区方式发送的内核这边, 内核这个做个响应. 没有什么难以理解的地方. 直接上代码!

http://www.joenchen.com/JoenTools/DeviceIoControlIo.rar

用户态:

/*
	Windows内核下DeviceIoControl与驱动进行交互 3环代码
	编译方法参见makefile. TAB = 8
*/
#include <windows.h>
#include <stdio.h>
#include <winioctl.h>

#define  SYS_LINK_NAME	"\\\\.\\SysLinkJoenDevice"
#define  MAX_LENGTH	1024

//		             设备类型             功能号 I/O访问内存使用方式 权限
#define IOCTL_CONTROL_BUFFERED	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS )
#define IOCTL_CONTROL_DIRECT	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_IN_DIRECT, FILE_ANY_ACCESS )
#define IOCTL_CONTROL_NEITHER	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS )

#pragma comment(linker, "/Entry:Jmain")
#pragma comment(linker, "/subsystem:console")

//===========================================================================
int Jmain() {
	HANDLE	hFile = 0;
	BYTE	byBuf[10];
	BYTE	byBuf2[10];
	BOOL	bRet;
	DWORD	dwByteRead, i;

	//打开设备
	hFile = CreateFile( SYS_LINK_NAME, GENERIC_READ | GENERIC_WRITE, 0, 0,
	                    OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0  );

	if ( hFile == INVALID_HANDLE_VALUE ) {
		printf( "打开设备错误了!\n" );
		return -1;
	}

	printf( "打开设备成功!\n" );

	RtlFillMemory( byBuf, sizeof( byBuf ), '1' );
	bRet = DeviceIoControl( hFile, IOCTL_CONTROL_BUFFERED, byBuf, sizeof( byBuf ), \
	                        byBuf2, sizeof( byBuf2 ), &dwByteRead, NULL );

	if ( bRet ) {
		printf( "BUFFERED  返回缓冲区长度%d, 数据:" );
		for ( i = 0; i < dwByteRead; i++ ) {
			printf( "%c", byBuf2[i] );
		}
		printf( "\n" );
	}

	RtlFillMemory( byBuf, sizeof( byBuf ), '2' );

	bRet = DeviceIoControl( hFile, IOCTL_CONTROL_DIRECT, byBuf, sizeof( byBuf ),
	                        byBuf2, sizeof( byBuf2 ), &dwByteRead, NULL );

	if ( bRet ) {

		printf( "DIRECT  返回缓冲区长度%d, 数据:" );
		for ( i = 0; i < dwByteRead; i++ ) {
			printf( "%c", byBuf2[i] );
		}
		printf( "\n" );
	}

	RtlFillMemory( byBuf, sizeof( byBuf ), '3' );

	bRet = DeviceIoControl( hFile, IOCTL_CONTROL_NEITHER, byBuf, sizeof( byBuf ),
	                        byBuf2, sizeof( byBuf2 ), &dwByteRead, NULL );

	if ( bRet ) {
		printf( "NEITHER  返回缓冲区长度%d, 数据:" );
		for ( i = 0; i < dwByteRead; i++ ) {
			printf( "%c", byBuf2[i] );
		}
		printf( "\n" );
	}

	if ( hFile ) {
		CloseHandle( hFile );
	}

	system( "pause" );

	ExitProcess(0);
	return 0;
}

内核态:

/*
	Windows内核下DeviceIoControl与驱动进行交互 0环代码
	编译方法参见makefile. TAB = 8
*/
#include <ntddk.h>

#define  DEVICE_NAME	L"\\Device\\DevJoenDevice"
#define  SYS_LINK_NAME	L"\\??\\SysLinkJoenDevice"
#define  MAX_LENGTH	1024

//		             设备类型             功能号 I/O访问内存使用方式 权限
#define IOCTL_CONTROL_BUFFERED	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS )
#define IOCTL_CONTROL_DIRECT	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_IN_DIRECT, FILE_ANY_ACCESS )
#define IOCTL_CONTROL_NEITHER	CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS )

typedef struct tagDeviceExt {
	PDEVICE_OBJECT pDeviceObj;
	UNICODE_STRING USzDeviceName;
	UNICODE_STRING USzSysLinkName;
}DEVICEEXT, *PDEVICEEXT;

//===========================================================================
//驱动卸载例程
#pragma  code_seg( "PAGE" )
VOID DriverUnload( PDRIVER_OBJECT pDriverObj ) {
	PDEVICEEXT pDeviceExt;
	PDEVICE_OBJECT pNextDeviceObj;

	pNextDeviceObj = pDriverObj->DeviceObject;

	while ( pNextDeviceObj != NULL ) {
		pDeviceExt = pNextDeviceObj->DeviceExtension;

		IoDeleteDevice( pDeviceExt->pDeviceObj );
		IoDeleteSymbolicLink( &pDeviceExt->USzSysLinkName );
		KdPrint( ( "删除%wZ设备成功!\n", &pDeviceExt->USzDeviceName ) );
		pNextDeviceObj = pNextDeviceObj->NextDevice;
	}
}

//===========================================================================
//所有不关心的IRP处理例程
NTSTATUS DispatchRoutine( PDEVICE_OBJECT pDeviceObj, PIRP pIrp ) {

	pIrp->IoStatus.Information = 0;
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	return STATUS_SUCCESS;
}

//===========================================================================
//设备控制请求
NTSTATUS DispatchDeviceControl( PDEVICE_OBJECT pDeviceObj, PIRP pIrp ) {
	ULONG		Code, i;
	NTSTATUS	Status;
	ULONG		ulInBufLen;
	ULONG		ulOutBufLen;
	ULONG		ulOutInfo;
	UCHAR*		InputBuffer = NULL;
	UCHAR*		OutputBuffer = NULL;
	PIO_STACK_LOCATION Stack;

	Stack = IoGetCurrentIrpStackLocation( pIrp );
	//输入缓冲区大小
	ulInBufLen = Stack->Parameters.DeviceIoControl.InputBufferLength;
	//输出缓冲区大小
	ulOutBufLen = Stack->Parameters.DeviceIoControl.OutputBufferLength;
	//IO控制码
	Code = Stack->Parameters.DeviceIoControl.IoControlCode;

	Status = STATUS_SUCCESS;
	ulOutInfo = ulOutBufLen;

	switch ( Code ) {
//===========================================================================
//		缓冲区IO, 很安全
	case IOCTL_CONTROL_BUFFERED:
		InputBuffer = ( UCHAR* )pIrp->AssociatedIrp.SystemBuffer;

		if ( InputBuffer ) {

			KdPrint( ( "BUFFERED输入缓冲区数据:\n" ) );

			for ( i = 0; i < ulInBufLen; i++ ) {
				KdPrint( ( "%X", InputBuffer[i]  ) );
			}
			KdPrint(( "\n" ));

			RtlFillMemory( pIrp->AssociatedIrp.SystemBuffer, ulOutBufLen, 'a' );
		}
		break;
//===========================================================================
//		MDL类型的IO, MDL的输入缓冲区和缓冲区IO是一样的.
	case IOCTL_CONTROL_DIRECT:
		InputBuffer = ( UCHAR* )pIrp->AssociatedIrp.SystemBuffer;

		if ( InputBuffer ) {
			KdPrint( ( "IN_DIRECT/IO输入缓冲区的数据:\n" ) );

			for ( i = 0; i < ulInBufLen; i++ ) {
				KdPrint( ( "%X", InputBuffer[i] ) );
			}
			KdPrint( ( "\n" ) );
		}

		KdPrint( ( "用户传入OutputBuffer地址: %p\n",
		           MmGetMdlVirtualAddress( pIrp->MdlAddress ) ) );

		//得到输出缓冲地址
		OutputBuffer = MmGetSystemAddressForMdlSafe( pIrp->MdlAddress, NormalPagePriority );

		if ( OutputBuffer ) {
			KdPrint( ( "映射到内核中的地址是: %p\n", OutputBuffer ) );

			RtlFillMemory( OutputBuffer,ulOutBufLen, 'b' );
		}
		break;
//===========================================================================
//		其他方式的IO
	case IOCTL_CONTROL_NEITHER:

		//得到输入/输出缓冲区
		InputBuffer = ( UCHAR* )Stack->Parameters.DeviceIoControl.Type3InputBuffer;
		OutputBuffer = ( UCHAR* )pIrp->UserBuffer;

		KdPrint( ( "NEITHER/IO用户模式传入的地址%p\n", InputBuffer ) );

		__try {
			//测试用户层传递的内存可读性
			ProbeForRead( InputBuffer, ulInBufLen, 4 );

			for ( i = 0; i < ulInBufLen; i++ ) {
				KdPrint( ( "%X", InputBuffer[i] ) );
			}
			KdPrint(( "\n" ));

			ProbeForWrite( OutputBuffer, ulOutBufLen, 4 );

			RtlFillMemory( OutputBuffer, ulOutBufLen, 'c' );

		}__except( EXCEPTION_EXECUTE_HANDLER ) {
			KdPrint( ( "Win32程序传入了一个无效的地址!\n" ) );
			Status = STATUS_UNSUCCESSFUL;
		}

		break;
//---------------------------------------------------------------------------

	default:
		Status = STATUS_INVALID_VARIANT;
	}

	pIrp->IoStatus.Status = Status;
	pIrp->IoStatus.Information = ulOutInfo;
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	return Status;
}

//===========================================================================
//驱动程序入口
#pragma  code_seg( "INIT" )
NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pUSzRegPath ) {
	ULONG i;
	NTSTATUS Status;
	PDEVICEEXT pDeviceExt;
	PDEVICE_OBJECT pDeviceObj;
	UNICODE_STRING USzDeviceName = RTL_CONSTANT_STRING( DEVICE_NAME );
	UNICODE_STRING USzSysLinkName = RTL_CONSTANT_STRING( SYS_LINK_NAME );

	Status = IoCreateDevice( pDriverObj, sizeof( DEVICEEXT ), &USzDeviceName,
	                         FILE_DEVICE_UNKNOWN, 0, TRUE, &pDeviceObj );

	if ( !NT_SUCCESS( Status ) ) {
		KdPrint( ( "创建设备失败!\n" ) );
		return Status;
	}

	Status = IoCreateSymbolicLink( &USzSysLinkName, &USzDeviceName );

	if ( !NT_SUCCESS( Status ) ) {
		KdPrint( ( "创建符号链接!\n" ) );
		return Status;
	}

	//采用直接IO方式
	pDeviceObj->Flags |= DO_DIRECT_IO;
	pDeviceExt = pDeviceObj->DeviceExtension;
	pDeviceExt->pDeviceObj = pDeviceObj;
	pDeviceExt->USzDeviceName = USzDeviceName;
	pDeviceExt->USzSysLinkName = USzSysLinkName;

	for ( i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++ ) {
		pDriverObj->MajorFunction[i] = &DispatchRoutine;
	}
	pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = &DispatchDeviceControl;
	pDriverObj->DriverUnload = &DriverUnload;

	return Status;
}

 

文章发表于 2011-10-31 11:14:03， 所属分类 驱动开发详解笔记 。您可以通过订阅RSS 2.0来跟踪该文章的评论。 本文Trackback地址：https://www.joenchen.com/archives/345/trackback。

发表评论


Warning: Undefined variable $user_ID in /www/wwwroot/joenchen.com/wp-content/themes/x-agan/comments.php on line 66

您必须登录 才能进行评论。