// Note that compiling requires the INC directory in the relative path and ntifs. Inc; and extended functions.
// # Include "ntifs. H"
// # Include "stdio. H"
// Constant definition;
# Define device_type_sysmon 0x8266 // DDK indicates that 0-7fffh is retained by the System
# Define nt_device_name l "// device // minsys" // kernel device name
# Define dos_device_name l "// dosdevices // minsys" // symbol used to connect to the device name
// Global variable definition;
Pdriver_object gowendriverobject; // driver object
Pdevice_object gctrldeviceobject; // The object field of the control device.
# Pragma code_seg ("page ")
Void // unload routine;
Unload (pdriver_object driverobject)
{
Unicode_string win32devicename;
Rtlinitunicodestring (& win32devicename, dos_device_name );
Iodeletesymboliclink (& win32devicename );
Iodeletedevice (gctrldeviceobject );
# If (DBG)
{
Dbuplint ("------------------- unload OK/N "));
}
# Endif
Return;
}
Ntstatus
Deviceirpcreate (in pdevice_object deviceobject, in piririrp)
{
Iocompleterequest (IRP, io_no_increment );
Return STATUS_SUCCESS;
}
Ntstatus
Deviceirpclose (in pdevice_object deviceobject, in piririrp)
{
Iocompleterequest (IRP, io_no_increment );
Return STATUS_SUCCESS;
}
Ntstatus
Deviceirpcontrol (in pdevice_object deviceobject, in piririrp)
{
Iocompleterequest (IRP, io_no_increment );
Return STATUS_SUCCESS;
}
# Pragma code_seg ("init ")
Ntstatus // driver entry;
DriverEntry (in pdriver_object driverobject, in punicode_string registrypath)
{
Ntstatus status;
Unicode_string ntdevicename;
Unicode_string win32devicename;
// Save your own driver object.
Gowendriverobject = driverobject;
// Initialize the Unicode string and create a device object;
Rtlinitunicodestring (& ntdevicename, nt_device_name );
Status = iocreatedevice (driverobject, 0, & ntdevicename,
Device_type_sysmon, 0, false, & gctrldeviceobject );
If (! Nt_success (Status) return status;
// Initialize the Unicode string and create a Win32 string connection so that the Win32 program can access it;
Rtlinitunicodestring (& win32devicename, dos_device_name );
Status = iocreatesymboliclink (& win32devicename, & ntdevicename );
If (! Nt_success (Status ))
{
Iodeletedevice (gctrldeviceobject );
Return status;
}
// Enter the driver dispatch routine
Driverobject-> majorfunction [irp_mj_create] = deviceirpcreate;
Driverobject-> majorfunction [irp_mj_close] = deviceirpclose;
Driverobject-> majorfunction [irp_mj_device_control] = deviceirpcontrol;
// Fill in the unload processing routine
Driverobject-> driverunload = unload;
# If (DBG)
{
Dbuplint ("driverobject = % x registrypath = % x/N", driverobject, registrypath );
}
# Endif
Return status;
}