Combat DeviceIoControl Six: access to physical ports

Q in Nt/2000/xp, how do I read CMOS data?

Q in Nt/2000/xp, how to control speaker sound?

Q in Nt/2000/xp, how do I access the physical port directly?

A seemingly small problem, how many heroes!

NT/2000/XP from security, reliability, stability, applications and operating systems are separate, operating system code in the nuclear mindset, access to system data and hardware, can execute privileged commands; applications run in user state, interfaces that can be used, and permissions to access system data are severely restricted. When the user program invokes the system service, the processor captures the call and then switches the invoked thread to the kernel mentality. When the system service completes, the operating system switches the thread description table back to user state, and the caller continues to run.

Want to implement I/O read/write in User State application, direct access hardware, can write driver, realize CreateFile, CloseHandle, DeviceIoControl, ReadFile, WriteFile function. Starting with Windows 2000, the concept of WDM kernel mentality drivers is introduced.

Here is a very simple driver that I am writing to implement byte-port I/O.

#include <ntddk.h> #include "MyPort.h"//device type definition//0-32767 is occupied by Microsoft, the user can customize the 32768-65535 #define File_device_m Yport 0x0000f000/I/O control code Definition//0-2047 is occupied by Microsoft, user-defined available 2048-4095 #define MYPORT_IOCTL_BASE 0xf00 #define IOCT L_myport_read_byte Ctl_code (File_device_myport, Myport_ioctl_base, method_buffered, FILE_ANY_ACCESS) #define IOCTL_ Myport_write_byte Ctl_code (File_device_myport, myport_ioctl_base+1, method_buffered, FILE_ANY_ACCESS)/
  
IOPM is a 65,536-port bitmask with 8192 bytes (8192 x 8 = 65536)//0 bit: Allow application access to the corresponding Port/1 bit: Prevent application access to the corresponding port #define Iopm_size 8192
  
typedef UCHAR IOPM[IOPM_SIZE];
  
IOPM *piopm = NULL;
Device name (required in Unicode) const WCHAR namebuffer[] = L "\\Device\\MyPort";
  
Const WCHAR dosnamebuffer[] = L "\\DosDevices\\MyPort";
This is the two Ntoskrnl.exe in the document service routines//No ready-made header files that have been described their prototypes, we declare void ke386setioaccessmap (int, iopm *);
  
void Ke386iosetaccessprocess (peprocess, int); The function prototype indicates NTSTATUS Myportdispatch (in Pdevice_object deviceobject, in PIRP IRP);
  
void Myportunload (in Pdriver_object driverobject); The driver portal, which is automatically invoked by the system, just like the WIN32 application's WinMain NTSTATUS driverentry (in Pdriver_object driverobject, in punicode_string
    Registrypath) {pdevice_object deviceobject;
    NTSTATUS status;
  
    Unicode_string uninamestring, unidosstring;
    Allocating memory for iopm piopm = mmallocatenoncachedmemory (sizeof (IOPM));
    if (piopm = = 0) {return status_insufficient_resources;
  
    }//IOPM all initialized to 0 (allow access to all ports) rtlzeromemory (PIOPM, sizeof (IOPM));
    Loads the iopm into the current process ke386iosetaccessprocess (Psgetcurrentprocess (), 1);
  
    Ke386setioaccessmap (1, PIOPM);
    Specifies the driver name rtlinitunicodestring (&uninamestring, Namebuffer);
  
    Rtlinitunicodestring (&unidosstring, Dosnamebuffer);
            Create Device status = IoCreateDevice (DriverObject, 0, &uninamestring, File_device_myport,
  
    0, FALSE, &deviceobject); if (!
    Nt_success (status)) {return status;
  
  }  Create the symbolic connection required by the WIN32 application status = Iocreatesymboliclink (&unidosstring, &uninamestring); if (!
    Nt_success (status)) {return status; //Specifies the module inlet (function pointer) of the driver for the operation//involving the following two modules: Myportdispatch and Myportunload DRIVEROBJECT-&GT;MAJORFUNCTION[IRP_MJ_CR Eate] = Driverobject->majorfunction[irp_mj_close] = Driverobject->majorfunction[irp_mj_devi
    Ce_control] = Myportdispatch;
  
    Driverobject->driverunload = Myportunload;
return status_success;
    }//IRP processing Module NTSTATUS myportdispatch (in Pdevice_object deviceobject, in Pirp Irp) {pio_stack_location irpstack;
    ULONG dwinputbufferlength;
    ULONG dwoutputbufferlength;
    ULONG Dwiocontrolcode;
    Pulong Pviobuffer;
  
    NTSTATUS NTSTATUS;    Populate several default values irp->iostatus.status = Status_success;            return state irp->iostatus.information = 0; Output length irpstack = IogetcurrentirpStacklocation (IRP);
    Get the pointer to the input/output buffer and it ' s length//input/output shared buffer//Because we specified the method_buffered in IOCTL,
  
    Pviobuffer = irp->associatedirp.systembuffer; Switch (irpstack->majorfunction) {case irp_mj_create://corresponding break with CreateFile in WIN32 application
  
        ;
  
        Case Irp_mj_close://WIN32 in the application of CloseHandle corresponding break; Case Irp_mj_device_control://corresponds to the DeviceIoControl in the WIN32 application Dwiocontrolcode = irpstack->parameters.
            Deviceiocontrol.iocontrolcode; Switch (Dwiocontrolcode) {//We agree that the buffer is a total of two DWORD, the first DWORD is the port, the second DWORD is the data//general Practice is specifically defined as a structure, where the case ioctl_myport_read_byte://Read bytes from the port pviobuffer[1] = _INP (
                    Pviobuffer[0]);  Irp->iostatus.information = 8;
                The output length is 8 break; Case Ioctl_myport_write_byte://Writing section to Port _OUTP (Pviobuffer[0], pviobuffer[1]);
                Break
            Default://Unsupported IOCTL irp->iostatus.status = Status_invalid_parameter;
  
    }} ntStatus = irp->iostatus.status;
  
    IoCompleteRequest (IRP, io_no_increment);
return ntStatus;
  
    }//delete drive void Myportunload (in Pdriver_object driverobject) {unicode_string unidosstring;
    if (PIOPM) {//Free space occupied by iopm Mmfreenoncachedmemory (piopm, sizeof (IOPM));
  
    } rtlinitunicodestring (&unidosstring, Dosnamebuffer);
    Delete symbol connections and device Iodeletesymboliclink (&unidosstring);
Iodeletedevice (Driverobject->deviceobject);
 }