★DriverEntry)
DriverEntry is a function that loads drivers and is called by system processes. The prototype is as follows:
NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject, // point to the driver object created by the System
IN PUNICODE_STRING pRegistryPath // key to the driver service key
);
★Create a device object (IoCreateDevice)
NTSTATUS IoCreateDevice (
IN PDRIVER_OBJECT DriverObject, // point to the driver object
In ulong DeviceExtensionSize, // number of bytes extended by the device
IN_OPTPUNICODE_STRING DeviceName, // device name, which can be NULL
INDEVICE_TYPE DeviceType, // device type
INULONG DeviceCharacteristics, // features of the device object
INBOOLEAN Exclusive; // sets whether the device object is used in kernel mode, which is generally TRUE.
OUTPDEVICE_OBJECT * DeviceObject // Save the address of the created device object
);
★Create a symbolic link (IoCreateSymbolicLink)
NTSTATUS IoCreateSymbolicLink (
IN PUNICODE_STRING SymbolicLinkName, // name of the symbolic link of the device
IN PUNICODE_STRING DeviceName, // device name
);
Note: in kernel mode, the symbolic link starts "\?? \ "; In user mode, the symbolic link starts. For example, drive C:
Kernel Mode :"\?? \ C: "; user mode :"\?? \ C :\".
★IoDeleteSymbolicLink)
NTSTATUS IoDeleteSymbolicLink (
IN PUNICODE_STRING SymbolicLinkName // name of the symbolic link
);
★IoDeleteDevice)
VOID IoDeleteDevice (
IN PDEVICE_OBJECT DeviceObject // pointer to the device object
);