自己構造IRP包來實現驅動與驅動之間的通訊(成功筆記下來以後參考用)

#include <ntddk.h>

#define DEVICE_NAMEL"\\device\\NTModelDrv"
#define LINK_NAMEL"\\dosDevices\\NTModelDrv"

#define IOCTL_BASE 0x8000
#define MY_CTL_CODE(i) \
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_HELLO MY_CTL_CODE(0)

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("DriverUnload: DriverUnload is Run!\n");
}

NTSTATUS
LM87RequestComplete (
     IN PDEVICE_OBJECT       DeviceObject,
     IN PIRP                 Irp,
     IN PVOID                Context
     )
{
    PKEVENT         Event;
    Event = (PKEVENT) Context;
__asm int 3
    KeSetEvent (Event, IO_NO_INCREMENT, FALSE);
    return STATUS_MORE_PROCESSING_REQUIRED;
}

VOID WorkThread(PVOID pContext)
{
NTSTATUS ntStatus = STATUS_SUCCESS;
PIRP SMBIrp;
PIO_STACK_LOCATION      irpStack;
IO_STACK_LOCATION      status_block;
UNICODE_STRING          usDeviceToFilter = { 0 };

KEVENT         SyncEvent;

//注意這裡定義的指標哦
PFILE_OBJECT  FileObject = NULL;
PDEVICE_OBJECT  DeviceObject = NULL;

ULONG i = 0;
LARGE_INTEGER waitTime = { 0 };
waitTime.QuadPart = -3 * 10000000i64;
DbgPrint("In WorkThread!\n");

//這裡使用的裝置對象名而不是符號連結名稱

RtlInitUnicodeString(&usDeviceToFilter, DEVICE_NAME);
KeInitializeEvent(&SyncEvent, NotificationEvent, FALSE);

while(1)
{
DbgPrint("WorkThread: %x\n", i);
//得到裝置對象
__asm int 3
//儘管FileObject與DeviceObject定義的是指標，這裡還是要取地址表示是雙指標
ntStatus = IoGetDeviceObjectPointer(&usDeviceToFilter,
GENERIC_ALL,&FileObject,&DeviceObject);
if( !NT_SUCCESS(ntStatus) )
{
DbgPrint("IoGetDeviceObjectPointer is Failed!\n");
continue;
}

//根據裝置對象建立針對該裝置對象的IRP包
SMBIrp = IoAllocateIrp (DeviceObject->StackSize, FALSE);
if(!SMBIrp)
{
KdPrint(("IoAllocateIrp: Allocate irp failed!\n "));
continue;
}

SMBIrp->UserEvent = &SyncEvent;
//SMBIrp->UserIosb = &status_block;
//SMBIrp->Tail.Overlay.Thread = PsGetCurrentThread();

//這句有什麼作用呢?
irpStack = IoGetNextIrpStackLocation(SMBIrp);

//設定IRP包的控制碼
irpStack->MajorFunction = IRP_MJ_DEVICE_CONTROL;
irpStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_HELLO;
//irpStack->FileObject = FileObject;

//設定完成函數，完成函數中要對我們發送的IRP包進行完成，不能再發回到IO管理器上
IoSetCompletionRoutine (SMBIrp, LM87RequestComplete, &SyncEvent, TRUE, TRUE, TRUE);

//直接向裝置發送IRP包,這裡裝置對象為指標對象
IoCallDriver(DeviceObject, SMBIrp);

KeWaitForSingleObject(&SyncEvent, Executive, KernelMode, FALSE, NULL);
i++;
KeDelayExecutionThread(KernelMode, FALSE, &waitTime);//延遲3秒

//最後釋放IRP包
IoFreeIrp(SMBIrp);


}
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
NTSTATUS ntStatus = STATUS_SUCCESS;
HANDLE hThread;

ntStatus = PsCreateSystemThread(
&hThread,
0,
NULL,
(HANDLE)0,
NULL,
WorkThread,
NULL
);

if(!NT_SUCCESS(ntStatus))
{
DbgPrint("PsCreateSystemThread is Failed!\n");
}

ZwClose(hThread);

return STATUS_SUCCESS;
}