One of the kernel APIs bound to the device in Windows Filter

One of the kernel APIs bound to the device in Windows Filter

The most important method for filtering is to bind a device object. As you can imagine, the reason why Windows can operate is that many Device objects provide various functions in windows. These Device objects receive requests and complete the functions of the actual hardware.
We can first consider that a real device corresponds to a device object (although the actual relationship may be much more complex ). By programming, you can generate a virtual device object and "Attach" it to a real device. Once bound, the request sent by the operating system to the real device is first sent to the virtual device.
The following code is used to explain. Readers may want to compile and execute the Code. For drivers, read chapter 1 of this book to learn how to install the development environment, compile the code, and debug the program.
In wdk, Multiple kernel APIs can be bound. The following is the prototype of a function:
Ntstatus
Ioattachdevice (
In pdevice_object sourcedevice,
In punicode_string targetdevice,
Out pdevice_object * attacheddevice
);
The ioattachdevice parameters are as follows:
Sourcedevice is a virtual device generated by the caller for filtering, while targetdevice is the target device to be bound. The targetdevice here is not a pdevice_object (device_object is the data structure of the device object and its pointer starts with P ), it is a string (in driver development, the string is represented by unicode_string ). In fact, this string is the name of the device to be bound.
In Windows, many Device objects have names, but not all Device objects have names. Only a device with a name can be bound with this kernel API.
Here is a question: if this function is bound to a device with a name, what if the device has been bound to another device?
If a device is bound by another device, a group of devices together is called the device stack (called the stack because it is related to the request transfer method ). In fact, ioattachdevice always binds the device on the top of the device stack.
Attacheddevice is a pointer used to return pointers. After successful binding, the bound device pointer is returned to this address.
In the following example, Serial Port 1 is bound. It is very convenient to bind a serial device here because the serial device has a fixed name in windows. The first serial port is named "/device/serial0", the second is "/device/serial1", and so on. Note that "/" in the C language must be written as "//" in actual encoding.
Unicode_string com_name = rlt_constant_string (L "// device // serial0 ");
Ntstatus status = ioattachdevice (
Com_filter_device, // generated filter device
& Com_device_name, // device name of the serial port
& Attached_device); // The bound device pointer is returned here.
Of course, readers who try to execute this Code may find that there is no code for generating a filter device. After the second API introduction, you will see the complete example.