Chinaunix首页 | 论坛 | 博客
  • 博客访问: 214131
  • 博文数量: 64
  • 博客积分: 2010
  • 博客等级: 上尉
  • 技术积分: 720
  • 用 户 组: 普通用户
  • 注册时间: 2008-02-25 19:03
文章分类

全部博文(64)

文章存档

2013年(1)

2012年(9)

2011年(25)

2010年(7)

2009年(16)

2008年(6)

分类: WINDOWS

2010-06-08 09:53:36

typedef struct _DRIVER_OBJECT {
/*+000*/    CSHORT Type;
/*+002*/    CSHORT Size;
    //
    // The following links all of the devices created by a single driver
    // together on a list, and the Flags word provides an extensible flag
    // location for driver objects.
    //
/*+004*/    PDEVICE_OBJECT DeviceObject;
/*+008*/    ULONG Flags;
    //
    // The following section describes where the driver is loaded.  The count
    // field is used to count the number of times the driver has had its
    // registered reinitialization routine invoked.
    //
/*+00c*/    PVOID DriverStart;
/*+010*/    ULONG DriverSize;
/*+014*/    PVOID DriverSection;
/*+018*/    PDRIVER_EXTENSION DriverExtension;
    //
    // The driver name field is used by the error log thread
    // determine the name of the driver that an I/O request is/was bound.
    //
/*+01c*/    UNICODE_STRING DriverName;
    //
    // The following section is for registry support.  Thise is a pointer
    // to the path to the hardware information in the registry
    //
/*+024*/    PUNICODE_STRING HardwareDatabase;
    //
    // The following section contains the optional pointer to an array of
    // alternate entry points to a driver for "fast I/O" support.  Fast I/O
    // is performed by invoking the driver routine directly with separate
    // parameters, rather than using the standard IRP call mechanism.  Note
    // that these functions may only be used for synchronous I/O, and when
    // the file is cached.
    //
/*+028*/    PFAST_IO_DISPATCH FastIoDispatch;
    //
    // The following section describes the entry points to this particular
    // driver.  Note that the major function dispatch table must be the last
    // field in the object so that it remains extensible.
    //
/*+02c*/    PDRIVER_INITIALIZE DriverInit;
/*+030*/    PDRIVER_STARTIO DriverStartIo;
/*+034*/    PDRIVER_UNLOAD DriverUnload;
 
 
#define IRP_MJ_MAXIMUM_FUNCTION 0x1b
 
#define IRP_MJ_CREATE                   0x00
#define IRP_MJ_CREATE_NAMED_PIPE        0x01
#define IRP_MJ_CLOSE                    0x02
#define IRP_MJ_READ                     0x03
#define IRP_MJ_WRITE                    0x04
#define IRP_MJ_QUERY_INFORMATION        0x05
#define IRP_MJ_SET_INFORMATION          0x06
#define IRP_MJ_QUERY_EA                 0x07
#define IRP_MJ_SET_EA                   0x08
#define IRP_MJ_FLUSH_BUFFERS            0x09
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
#define IRP_MJ_SET_VOLUME_INFORMATION   0x0b
#define IRP_MJ_DIRECTORY_CONTROL        0x0c
#define IRP_MJ_FILE_SYSTEM_CONTROL      0x0d
#define IRP_MJ_DEVICE_CONTROL           0x0e
#define IRP_MJ_INTERNAL_DEVICE_CONTROL  0x0f
#define IRP_MJ_SHUTDOWN                 0x10
#define IRP_MJ_LOCK_CONTROL             0x11
#define IRP_MJ_CLEANUP                  0x12
#define IRP_MJ_CREATE_MAILSLOT          0x13
#define IRP_MJ_QUERY_SECURITY           0x14
#define IRP_MJ_SET_SECURITY             0x15
#define IRP_MJ_POWER                    0x16
#define IRP_MJ_SYSTEM_CONTROL           0x17
#define IRP_MJ_DEVICE_CHANGE            0x18
#define IRP_MJ_QUERY_QUOTA              0x19
#define IRP_MJ_SET_QUOTA                0x1a
#define IRP_MJ_PNP                      0x1b
#define IRP_MJ_PNP_POWER                IRP_MJ_PNP     
#define IRP_MJ_MAXIMUM_FUNCTION         0x1b

/*+038*/    PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
} DRIVER_OBJECT;
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; // ntndis
 
 
typedef struct _IRP {
/*+000*/    CSHORT Type;
/*+002*/    USHORT Size;
    //
    // Define the common fields used to control the IRP.
    //
    //
    // Define a pointer to the Memory Descriptor List (MDL) for this I/O
    // request.  This field is only used if the I/O is "direct I/O".
    //
/*+004*/    PMDL MdlAddress;
    //
    // Flags word - used to remember various flags.
    //
/*+008*/    ULONG Flags;
    //
    // The following union is used for one of three purposes:
    //
    //    1. This IRP is an associated IRP.  The field is a pointer to a master
    //       IRP.
    //
    //    2. This is the master IRP.  The field is the count of the number of
    //       IRPs which must complete (associated IRPs) before the master can
    //       complete.
    //
    //    3. This operation is being buffered and the field is the address of
    //       the system space buffer.
    //
/*+00c*/    union {
        struct _IRP *MasterIrp;
        LONG IrpCount;
        PVOID SystemBuffer;
    } AssociatedIrp;
    //
    // Thread list entry - allows queueing the IRP to the thread pending I/O
    // request packet list.
    //
/*+010*/    LIST_ENTRY ThreadListEntry;
    //
    // I/O status - final status of operation.
    //
 
typedef struct _IO_STATUS_BLOCK {
    union {
        NTSTATUS Status;
        PVOID Pointer;
    };
    ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
 
/*+018*/    IO_STATUS_BLOCK IoStatus;
    //
    // Requestor mode - mode of the original requestor of this operation.
    //
 
typedef CCHAR KPROCESSOR_MODE;
 
/*+020*/    KPROCESSOR_MODE RequestorMode;
    //
    // Pending returned - TRUE if pending was initially returned as the
    // status for this packet.
    //
/*+021*/    BOOLEAN PendingReturned;
    //
    // Stack state information.
    //
/*+022*/    CHAR StackCount;
/*+023*/     CHAR CurrentLocation;
    //
    // Cancel - packet has been canceled.
    //
/*+024*/    BOOLEAN Cancel;
    //
    // Cancel Irql - Irql at which the cancel spinlock was acquired.
    //
/*+025*/    KIRQL CancelIrql;
    //
    // ApcEnvironment - Used to save the APC environment at the time that the
    // packet was initialized.
    //
/*+026*/     CCHAR ApcEnvironment;
    //
    // Allocation control flags.
    //
/*+027*/    UCHAR AllocationFlags;
    //
    // User parameters.
    //
/*+028*/    PIO_STATUS_BLOCK UserIosb;
/*+02c*/    PKEVENT UserEvent;
/*+030*/    union {
        struct {
            PIO_APC_ROUTINE UserApcRoutine;
            PVOID UserApcContext;
        } AsynchronousParameters;
        LARGE_INTEGER AllocationSize;
    } Overlay;
    //
    // CancelRoutine - Used to contain the address of a cancel routine supplied
    // by a device driver when the IRP is in a cancelable state.
    //
/*+038*/    PDRIVER_CANCEL CancelRoutine;
    //
    // Note that the UserBuffer parameter is outside of the stack so that I/O
    // completion can copy data back into the user's address space without
    // having to know exactly which service was being invoked.  The length
    // of the copy is stored in the second half of the I/O status block. If
    // the UserBuffer field is NULL, then no copy is performed.
    //
/*+03c*/    PVOID UserBuffer;
    //
    // Kernel structures
    //
    // The following section contains kernel structures which the IRP needs
    // in order to place various work information in kernel controller system
    // queues.  Because the size and alignment cannot be controlled, they are
    // placed here at the end so they just hang off and do not affect the
    // alignment of other fields in the IRP.
    //
/*+040*/    union {
/*+040*/        struct {
            union {
                //
                // DeviceQueueEntry - The device queue entry field is used to
                // queue the IRP to the device driver device queue.
                //
                KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
                struct {
                    //
                    // The following are available to the driver to use in
                    // whatever manner is desired, while the driver owns the
                    // packet.
                    //
                    PVOID DriverContext[4];
                } ;
            } ;
            //
            // Thread - pointer to caller's Thread Control Block.
            //
/*+050*/            PETHREAD Thread;
            //
            // Auxiliary buffer - pointer to any auxiliary buffer that is
            // required to pass information to a driver that is not contained
            // in a normal buffer.
            //
/*+054*/            PCHAR AuxiliaryBuffer;
            //
            // The following unnamed structure must be exactly identical
            // to the unnamed structure used in the minipacket header used
            // for completion queue entries.
            //
/*+058*/            struct {
                //
                // List entry - used to queue the packet to completion queue, among
                // others.
                //
/*+058*/                LIST_ENTRY ListEntry;
/*+060*/                 union {
                    //
                    // Current stack location - contains a pointer to the current
                    // IO_STACK_LOCATION structure in the IRP stack.  This field
                    // should never be directly accessed by drivers.  They should
                    // use the standard functions.
                    //
                    struct _IO_STACK_LOCATION *CurrentStackLocation;
                    //
                    // Minipacket type.
                    //
                    ULONG PacketType;
                };
            };
            //
            // Original file object - pointer to the original file object
            // that was used to open the file.  This field is owned by the
            // I/O system and should not be used by any other drivers.
            //
            PFILE_OBJECT OriginalFileObject;
        } Overlay;
        //
        // APC - This APC control block is used for the special kernel APC as
        // well as for the caller's APC, if one was specified in the original
        // argument list.  If so, then the APC is reused for the normal APC for
        // whatever mode the caller was in and the "special" routine that is
        // invoked before the APC gets control simply deallocates the IRP.
        //
        KAPC Apc;
        //
        // CompletionKey - This is the key that is used to distinguish
        // individual I/O operations initiated on a single file handle.
        //
        PVOID CompletionKey;
    } Tail;
} IRP, *PIRP;
 
 
typedef struct _IO_STACK_LOCATION {
/*+000*/    UCHAR MajorFunction;
/*+001*/    UCHAR MinorFunction;
/*+002*/    UCHAR Flags;
/*+003*/     UCHAR Control;
    //
    // The following user parameters are based on the service that is being
    // invoked.  Drivers and file systems can determine which set to use based
    // on the above major and minor function codes.
    //
/*+004*/     union {
        //
        // System service parameters for:  NtCreateFile
        //
        struct {
            PIO_SECURITY_CONTEXT SecurityContext;
            ULONG Options;
            USHORT POINTER_ALIGNMENT FileAttributes;
            USHORT ShareAccess;
            ULONG POINTER_ALIGNMENT EaLength;
        } Create;

        //
        // System service parameters for:  NtReadFile
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Read;
        //
        // System service parameters for:  NtWriteFile
        //
        struct {
            ULONG Length;
            ULONG POINTER_ALIGNMENT Key;
            LARGE_INTEGER ByteOffset;
        } Write;

        //
        // System service parameters for:  NtQueryInformationFile
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
        } QueryFile;
        //
        // System service parameters for:  NtSetInformationFile
        //
        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
            PFILE_OBJECT FileObject;
            union {
                struct {
                    BOOLEAN ReplaceIfExists;
                    BOOLEAN AdvanceOnly;
                };
                ULONG ClusterCount;
                HANDLE DeleteHandle;
            };
        } SetFile;

        //
        // System service parameters for:  NtQueryVolumeInformationFile
        //
        struct {
            ULONG Length;
            FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
        } QueryVolume;

        //
        // System service parameters for:  NtFlushBuffersFile
        //
        // No extra user-supplied parameters.
        //

        //
        // System service parameters for:  NtDeviceIoControlFile
        //
        // Note that the user's output buffer is stored in the UserBuffer field
        // and the user's input buffer is stored in the SystemBuffer field.
        //
        struct {
/*+004*/             ULONG OutputBufferLength;
/*+008*/             ULONG POINTER_ALIGNMENT InputBufferLength;
/*+00c*/             ULONG POINTER_ALIGNMENT IoControlCode;
/*+010*/             PVOID Type3InputBuffer;
        } DeviceIoControl;
// end_wdm
        //
        // System service parameters for:  NtQuerySecurityObject
        //
        struct {
            SECURITY_INFORMATION SecurityInformation;
            ULONG POINTER_ALIGNMENT Length;
        } QuerySecurity;
        //
        // System service parameters for:  NtSetSecurityObject
        //
        struct {
            SECURITY_INFORMATION SecurityInformation;
            PSECURITY_DESCRIPTOR SecurityDescriptor;
        } SetSecurity;
// begin_wdm
        //
        // Non-system service parameters.
        //
        // Parameters for MountVolume
        //
        struct {
            PVPB Vpb;
            PDEVICE_OBJECT DeviceObject;
        } MountVolume;
        //
        // Parameters for VerifyVolume
        //
        struct {
            PVPB Vpb;
            PDEVICE_OBJECT DeviceObject;
        } VerifyVolume;
        //
        // Parameters for Scsi with internal device contorl.
        //
        struct {
            struct _SCSI_REQUEST_BLOCK *Srb;
        } Scsi;

        //
        // Parameters for IRP_MN_QUERY_DEVICE_RELATIONS
        //
        struct {
            DEVICE_RELATION_TYPE Type;
        } QueryDeviceRelations;
        //
        // Parameters for IRP_MN_QUERY_INTERFACE
        //
        struct {
            CONST GUID *InterfaceType;
            USHORT Size;
            USHORT Version;
            PINTERFACE Interface;
            PVOID InterfaceSpecificData;
        } QueryInterface;
// end_ntifs
        //
        // Parameters for IRP_MN_QUERY_CAPABILITIES
        //
        struct {
            PDEVICE_CAPABILITIES Capabilities;
        } DeviceCapabilities;
        //
        // Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS
        //
        struct {
            PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
        } FilterResourceRequirements;
        //
        // Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG
        //
        struct {
            ULONG WhichSpace;
            PVOID Buffer;
            ULONG Offset;
            ULONG POINTER_ALIGNMENT Length;
        } ReadWriteConfig;
        //
        // Parameters for IRP_MN_SET_LOCK
        //
        struct {
            BOOLEAN Lock;
        } SetLock;
        //
        // Parameters for IRP_MN_QUERY_ID
        //
        struct {
            BUS_QUERY_ID_TYPE IdType;
        } QueryId;
        //
        // Parameters for IRP_MN_QUERY_DEVICE_TEXT
        //
        struct {
            DEVICE_TEXT_TYPE DeviceTextType;
            LCID POINTER_ALIGNMENT LocaleId;
        } QueryDeviceText;
        //
        // Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION
        //
        struct {
            BOOLEAN InPath;
            BOOLEAN Reserved[3];
            DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
        } UsageNotification;
        //
        // Parameters for IRP_MN_WAIT_WAKE
        //
        struct {
            SYSTEM_POWER_STATE PowerState;
        } WaitWake;
        //
        // Parameter for IRP_MN_POWER_SEQUENCE
        //
        struct {
            PPOWER_SEQUENCE PowerSequence;
        } PowerSequence;
        //
        // Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER
        //
        struct {
            ULONG SystemContext;
            POWER_STATE_TYPE POINTER_ALIGNMENT Type;
            POWER_STATE POINTER_ALIGNMENT State;
            POWER_ACTION POINTER_ALIGNMENT ShutdownType;
        } Power;
        //
        // Parameters for StartDevice
        //
        struct {
            PCM_RESOURCE_LIST AllocatedResources;
            PCM_RESOURCE_LIST AllocatedResourcesTranslated;
        } StartDevice;
// begin_ntifs
        //
        // Parameters for Cleanup
        //
        // No extra parameters supplied
        //
        //
        // WMI Irps
        //
        struct {
            ULONG_PTR ProviderId;
            PVOID DataPath;
            ULONG BufferSize;
            PVOID Buffer;
        } WMI;
        //
        // Others - driver-specific
        //
        struct {
            PVOID Argument1;
            PVOID Argument2;
            PVOID Argument3;
            PVOID Argument4;
        } Others;
    } Parameters;
    //
    // Save a pointer to this device driver's device object for this request
    // so it can be passed to the completion routine if needed.
    //
/*+014*/     PDEVICE_OBJECT DeviceObject;
    //
    // The following location contains a pointer to the file object for this
    //
/*+018*/     PFILE_OBJECT FileObject;
    //
    // The following routine is invoked depending on the flags in the above
    // flags field.
    //
/*+01c*/     PIO_COMPLETION_ROUTINE CompletionRoutine;
    //
    // The following is used to store the address of the context parameter
    // that should be passed to the CompletionRoutine.
    //
/*+020*/     PVOID Context;
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;
 
 
IoControlCode =
  (DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method)
 
即:
DeviceType  Access   Function     Method
|-16bits-| |-2bit-|  |-12bits-|  |-2bits-|
 
 
Method::
#define METHOD_BUFFERED                 0
#define METHOD_IN_DIRECT                1
#define METHOD_OUT_DIRECT               2
#define METHOD_NEITHER                  3
 
Access::
#define FILE_ANY_ACCESS                 0
#define FILE_SPECIAL_ACCESS    (FILE_ANY_ACCESS)
#define FILE_READ_ACCESS          ( 0x0001 )    // file & pipe
#define FILE_WRITE_ACCESS         ( 0x0002 )    // file & pipe


 
阅读(1233) | 评论(0) | 转发(0) |
0

上一篇:汇编指令集

下一篇:Delphi 逆向工程

给主人留下些什么吧!~~