File Filter Driver

Finally, on Sunday, I took the time to write some documents.
Because it is not clear once or twice, I will explain it in parts. This article hopes to explain how to work out a driving framework. The subsequent explanations will be further elaborated on the basis of this framework.

Open.
For the overall description of the file filter driver, I think codewarrior in the following post is very good. Thanks again.
Http://community.csdn.net/Expert/topic/4849/4849948.xml? Temp =. 1946985.

Here we will give a rough description of the basic things in DDK:

Entry function:
Like Win32 programming, the driver also has an entry function DriverEntry (equivalent to main winmain). Here we note that the running Modes between them are different. Win32 entry

The function then enters the message loop. The main function of the DriverEntry driver is to register some functions that are equivalent to the callback processing method, that is, the dispatch function we call ..
IRP:
IRP (I/O Request Packet) is a very important concept in driver programming. To put it bluntly, it is a data structure with data required for corresponding operations. For example, we called the application layer

The createfile function may be used to construct an IRP (irp_mj_create) at the driver layer to complete corresponding operations through the IRP processing. If we open the createfile function to users, create a file

If you are interested in other operations (such as allowing only the specified program to open the corresponding file), you can hook the system to send this IRP to our specified function (that is

DriverEntry), and then...
CDO:
CDO (ontrol device object) controls the device object. This object represents this driver. It is used by our application-layer programs and is created in DriverEntry.

It, note that it does not have device extensions. Here it is necessary to talk about the general do (device object), do is used to bind to the fdo driver of the file system, and CDO

Different. They all use the iocreatedevice function.
Device extension:
Device extension (device extension), which is specified by 2nd parameters when iocreatedevice is used to create do. In fact, it is a memory for storing useful data.

Is a struct. Note that it will be transmitted along with do, which is the key benefit of it.
Let's talk about these things. There are still many other things. When we use them, let's start with DriverEntry.
DriverEntry is generally in the following form. The two parameter types all contain P. I believe you will understand it as a pointer and add a comment.
Ntstatus
DriverEntry (
In pdriver_object driverobject, // point to the driver object created by the system.
In punicode_string registrypath // path for the driver to register the key
)
The first thing we need to do is declare a global pdriver_object variable and save our driverobject, because we may use it elsewhere, and then obtain

Some addresses that need to use functions are stored in global variables. Then we can create our control device object, that is, the previously mentioned CDO, and create it.

Use the iocreatedevice function as follows:

Device_object * ourcdo = NULL; // note that this variable is global. I put it here for clarity !!!!!!!!
// Our CDO control device object, which we mentioned earlier

Ntstatus status = STATUS_SUCCESS; // The returned value is successful by default.
Unicode_string name_2k; // note that I have added 2 K here to attract your attention, because the string below in the XP system will not

// Same
Rtlinitunicodestring (& name_2k, l "// filesystem // ourfilter_cdo"); // This is the string, which is

// L "// filesystem // filters // ourfilter_cdo"
Status = iocreatedevice (driverobject, // Our driver object
0, // the size of the extended device, that is, the device extension mentioned above. Do you still remember that the previously mentioned CDO has no device extension?

//?, Therefore, set 0.
& Name_2k, // device name
File_device_disk_file_system, // device type
File_device_secure_open, // indicates the operation permitted by the device
False, // true indicates that only one thread can use the device, and false indicates that there is no limit for one.
& Ourcdo // The returned control device object CDO
);
If (! Nt_success (Status) // exit if the control device object fails to be created
Return status;

Next, we can create a Win32 visible symbolic connection.
Unicode_string link_2k;
Rtlinitunicodestring (& link_2k, l "// dosdevices // ourfilter ");
Status = iocreatesymboliclink (& link_2k, & name_2k );
If (! Nt_success (Status ))
Return status;

After that, we can set our dispatch function. As we have mentioned above, it is a function that can handle IRP. How to set it? First, let's take a simple approach to dynamically control

The driverunload function is set as an example to illustrate that this function will be called during load control. The code for setting this function is roughly as follows:

Declare the function first. In order to make DriverEntry visible, it is generally declared in the corresponding header file.
Void driverunload (in pdriver_object driverobject );
Add
// Set unload
Driverobject-> driverunload = driverunload;
What do driverunload functions need to do? They mainly include deletion of DO and CDO functions, release of resources, and cancel mounting.

It is relatively simple, so there are not many things to release
Void driverunload (in pdriver_object pdriverobject)
{
Unicode_string uninamestring;

Rtlinitunicodestring (& uninamestring, l "// filesystem // ourfilter_cdo ");
Iodeletesymboliclink (& uninamestring); // Delete Win32 visibility
Iodeletedevice (pdriverobject-> deviceobject); // delete a device

Return;
}

At this point, a basic driver framework is also available. After dbuplint () debugging information is added, the output debugging information is displayed after xx. sys is compiled and loaded for debugging.
Because the driverunload settings enable it to support dynamic load control, how to compile and debug it will not be mentioned here. Future data will be expanded on the basis of this framework.

I want to explain it again because I was in a rush to write in an Internet cafe and added a good level of food. I did not make it clear or wrong. Please point out that I will write all the subsequent articles if I have time.

Helpful