裝置對象(DEVICE_OBJECT)—————–主要成員

一、裝置對象(DEVICE_OBJECT)

kd> dt _device_object
ntdll!_DEVICE_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Uint2B
   +0x004 ReferenceCount   : Int4B
   +0x008 DriverObject     : Ptr32 _DRIVER_OBJECT  ;該裝置所屬的驅動對象
   +0x00c NextDevice       : Ptr32 _DEVICE_OBJECT   ;指向下一個裝置，該裝置與下一個裝置同屬於一個驅動對象
   +0x010 AttachedDevice   : Ptr32 _DEVICE_OBJECT  ;附加到上面的最近的裝置，該附加元件一般屬於對本層進行過濾的另一個驅動對象
   +0x014 CurrentIrp       : Ptr32 _IRP
   +0x018 Timer            : Ptr32 _IO_TIMER
   +0x01c Flags            : Uint4B  ;例如DO_...
   +0x020 Characteristics  : Uint4B ;例如FILE_...
   +0x024 Vpb              : Ptr32 _VPB
   +0x028 DeviceExtension  : Ptr32 Void
   +0x02c DeviceType       : Uint4B  ;裝置類型FILE_DEVICE_...
   +0x030 StackSize        : Char
   +0x034 Queue            : __unnamed
   +0x05c AlignmentRequirement : Uint4B
   +0x060 DeviceQueue      : _KDEVICE_QUEUE
   +0x074 Dpc              : _KDPC
   +0x094 ActiveThreadCount : Uint4B
   +0x098 SecurityDescriptor : Ptr32 Void
   +0x09c DeviceLock       : _KEVENT
   +0x0ac SectorSize       : Uint2B
   +0x0ae Spare1           : Uint2B
   +0x0b0 DeviceObjectExtension : Ptr32 _DEVOBJ_EXTENSION
   +0x0b4 Reserved         : Ptr32 Void

(1)FLAG

flag值	含義
DO_BUFFERED_IO	讀寫操作使用緩衝方式（系統複製緩衝區）訪問使用者模式資料
DO_EXCLUSIVE	一次只允許一個線程開啟裝置控制代碼
DO_DIRECT_IO	讀寫操作使用直接方式（記憶體描述符表）訪問使用者模式資料
DO_BUS_ENUMERATED_DEVICE	Bus drivers set this flag in the PDO of each device they enumerate. This flag pertains only to the PDO; it must not be set in an FDO or filter DO. Therefore, higher-level drivers layered over a bus driver must not propagate this value up the device stack.
DO_DEVICE_INITIALIZING	裝置對象正在初始化
DO_POWER_INRUSH	Drivers of devices that require inrush current when powering on must set this flag. A driver cannot set both this flag and DO_POWER_PAGABLE.裝置上電期間需要大電流
DO_POWER_PAGABLE	Windows? 2000 and later drivers that are pageable, are not part of the paging path, and do not require inrush current must set this flag. The system calls such drivers at IRQL PASSIVE_LEVEL. Drivers cannot set both this flag and DO_POWER_INRUSH. All WDM, Windows 98, and Windows Me drivers must set DO_POWER_PAGABLE.必須在PASSIVE_LEVEL級上處理IRP_MJ_PNP請求
DO_VERIFY_VOLUME	Removable-media drivers set this flag while processing transfer requests. Such drivers should also check for this flag in the target for a transfer request before transferring any data. See the Supporting Removable Media for details

    Characteristics: 包含另一組標誌位，描述裝置的可選特徵
      FILE_REMOVABLE_MEDIA: 可更換媒介裝置
      FILE_READ_ONLY_DEVICE: 唯讀裝置
      FILE_FLOPPY_DISKETTE: 軟碟機裝置
      FILE_WRITE_ONCE_MDEIA: 唯寫一次裝置
      FILE_REMOTE_DEVICE: 通過網路連接訪問的裝置
      FILE_DEVICE_IS_MOUNTED: 物理媒介已在裝置中
      FILE_DEVICE_SECURE_OPEN: 在開啟操作中檢查裝置對象的安全屬性
   DeviceType: 一個枚舉常量，描述裝置類型。
      FILE_DEVICE_PRINTER: 印表機
      FILE_DEVICE_SCANNER: 掃描器
      ...
      FILE_DEVICE_UNKNOWN: 未知裝置