Design of Windows 2000 drivers

This paper introduces the structure and notes of the programming of Windows Coding WDM driver, and finally gives a simple WDM driver and client program source code, hoping to be helpful to everyone.

1. Introduction:

Windows 2000, formerly known as Windows NT 5.0, is a new generation of Windows NT 4.0 operating system that inherits the benefits of Windows NT 4.0 and has a number of technical breakthroughs, one of which is the change in driver architecture, The new WDM (Win32 Driver Model) driver architecture is introduced. Said to be a new technology, in fact, as early as 1997 Microsoft has proposed this technology and has been fully applied in Windows 98, in other words, Windows 98 also support WDM. This allows WDM to become a cross-platform driver model, not only so that the WDM driver can be recompiled and run on a non-Intel platform without modifying the source code, and it is no exaggeration to say that WDM is the driver architecture of the 21st century.

2. The working principle of WDM:

WDM is developed on the NT 4.0 driver structure, so it is very similar to the NT 4.0 driver, but it is essentially improved, such as its support for USB, IEEE 1394, ACPI and other new hardware standards. Although Windows 98 and Windows 2000 support WDM, it does not mean that a VxD under Windows 98 can run under Windows 2000, while VDD under NT can run under Windows 98. But the original plan to run on two platforms at the same time needs to write two different drivers, and now only need to write a WDM driver. As with the NT 4.0 driver, the WDM driver is layered, that is, drivers on different tiers have different priorities, while the VxD under Windows 9x does not have this structure. In addition, WDM also introduces the feature device object FDO (Functional device object) and the physical device object PDO (Physical device object) Two new concepts to describe the hardware, a PDO represents a real hardware, The driver appears to be a fdo, as shown in Figure 1. It is also noteworthy that a hardware allows only one PDO, but it can have multiple fdo, while in the driver we do not directly manipulate the hardware but operate the corresponding PDO and FDO. In Ring-3 and Ring-0 Communications, the operating system packs each user request into an IRP (IO request Packet) structure, sends it to the driver and identifies which device is sent by identifying the PDO in the IRP. In addition, in driver loading, WDM does not rely on a driver name or an ID of a particular significance, but relies on a 128-bit GUID to identify the driver (many things in windows are identified by this).

3. Specific implementation:

Like many applications, the WDM driver is in PE format, but it has no winmain or main entry, and replaces it with DriverEntry:

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
//不同于前面的PDO
IN PUNICODE_STRING RegistryPath)
{
DriverObject- >DriverExtension- >AddDevice =
AddDevice; // DriverExtension 中存放着驱动程序扩展信息，包括设备所需要的硬件资源等。
DriverObject- >MajorFunction[IRP_MJ_CREATE]
= RequestCreate;
DriverObject- >MajorFunction[IRP_MJ_CLOSE]
= RequestClose;
DriverObject- >MajorFunction[IRP_MJ_DEVICE_CONTROL]
= RequestControl;
DriverObject- >MajorFunction[IRP_MJ_PNP]
= RequestPnp;
return STATUS_SUCCESS;
}