1.缓冲区方式读写操作
1.1 ReadFile
读取字节数:stack->Parameters.Read.Length
偏移:stack->Parameters.Read.ByteOffset.QuadPart
输出缓冲区:pIrp->AssociatedIrp.SystemBuffer
输出字节数:pIrp->IoStatus.Information
1.2 WriteFile
写入字节数:stack->Parameters.Write.Length
偏移:stack->Parameters.Write.ByteOffset.QuadPart
写入缓冲区:pIrp->AssociatedIrp.SystemBuffer
返回字节数:pIrp->IoStatus.Information
1.3 IRP_MJ_QUERY_INFORMATION
FILE_INFORMATION_CLASS: stack->Parameters.QueryFile.FileInformation
输入输出缓冲区:pIrp->AssociatedIrp.SystemBuffer
返回字节数:pIrp->IoStatus.Information=stack->Parameters.QueryFile.Length
2.直接方式读写操作
2.1 ReadFile
读取字节数:stack->Parameters.Read.Length
偏移:stack->Parameters.Read.ByteOffset.QuadPart
输出缓冲区:MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority)
输出字节数:pIrp->IoStatus.Information
2.2 WriteFile
写入字节数:stack->Parameters.Write.Length
偏移:stack->Parameters.Write.ByteOffset.QuadPart
写入缓冲区:MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority)
返回字节数:pIrp->IoStatus.Information
3.其他方式读写操作
3.1 ReadFile
读取字节数:stack->Parameters.Read.Length
偏移:stack->Parameters.Read.ByteOffset.QuadPart
输出缓冲区:ProbeForWrite(pIrp->UserBuffer)
输出字节数:pIrp->IoStatus.Information
3.2 WriteFile
写入字节数:stack->Parameters.Write.Length
偏移:stack->Parameters.Write.ByteOffset.QuadPart
写入缓冲区:ProbeForRead(pIrp->UserBuffer)
返回字节数:pIrp->IoStatus.Information
IO设备控制操作
1.缓冲内存模式IOCTL
输入缓冲区大小:stack->Parameters.DeviceIoControl.InputBufferLength
输出缓冲区大小:stack->Parameters.DeviceIoControl.OutputBufferLength
输入缓冲区:pIrp->AssociatedIrp.SystemBuffer
输出缓冲区:pIrp->AssociatedIrp.SystemBuffer
2.直接内存模式IOCTL之METHOD_IN_DIRECT
输入缓冲区大小:stack->Parameters.DeviceIoControl.InputBufferLength
输出缓冲区大小:stack->Parameters.DeviceIoControl.OutputBufferLength
输入缓冲区:MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority)
输出缓冲区:pIrp->AssociatedIrp.SystemBuffer
3.直接内存模式IOCTL之METHOD_OUT_DIRECT
输入缓冲区大小:stack->Parameters.DeviceIoControl.InputBufferLength
输出缓冲区大小:stack->Parameters.DeviceIoControl.OutputBufferLength
输入缓冲区:MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority)
输出缓冲区:pIrp->AssociatedIrp.SystemBuffer
METHOD_IN_DIRECT与METHOD_OUT_DIRECT区别在于打开设备的权限
1) 只读权限打开设备，METHOD_IN_DIRECT的IOCTL操作成功，而METHOD_OUT_DIRECT的操作失败
2) 读写权限打开设备，METHOD_IN_DIRECT与METHOD_OUT_DIRECT的IOCTL操作都成功
4.其他内存模式IOCTL
输入缓冲区大小:stack->Parameters.DeviceIoControl.InputBufferLength
输出缓冲区大小:stack->Parameters.DeviceIoControl.OutputBufferLength
输入缓冲区:ProbeForRead(stack->Parameters.DeviceIoControl.Type3InputBuffer)
输出缓冲区:ProbeForWrite(pIrp->UserBuffer)
