使用DeviceIoControl与驱动进行通信

使用DeviceIoControl与驱动进行通信

除了通过ReadFile和WriteFile和驱动进行通信以外，还可以通过DeviceIoControl与驱动进行通信。

使用这种方式的优点是可以通过控制码来让驱动进行特定的操作。

下面直接上代码。

驱动代码

#include <ntddk.h>

UNICODE_STRING g_devName;
UNICODE_STRING g_symLinkName;

// CTL_CODE
// 设备对象类型，和IoCreateDevice中使用的类型一致
// 驱动程序定义的IOCTL码，0X800到0XFFF由程序员自己定义
// 操作模式
// 访问权限

// 驱动程序读控制码
#define MY_IOCTL_INPUT CTL_CODE( \
	FILE_DEVICE_UNKNOWN,         \
	0x800,                       \
	METHOD_BUFFERED,             \
	FILE_ANY_ACCESS)

// 驱动程序写控制码
#define MY_IOCTL_OUTPUT CTL_CODE( \
	FILE_DEVICE_UNKNOWN,          \
	0x801,                        \
	METHOD_BUFFERED,              \
	FILE_ANY_ACCESS)

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	IoDeleteDevice(pDriver->DeviceObject);
	IoDeleteSymbolicLink(&g_symLinkName);
	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "驱动已成功卸载\n");
}

NTSTATUS CreateDevice(PDRIVER_OBJECT pDriver)
{
	g_devName = RTL_CONSTANT_STRING(L"\\Device\\My_Device");
	PDEVICE_OBJECT pDev;
	NTSTATUS status = IoCreateDevice(pDriver, 0, &g_devName, FILE_DEVICE_UNKNOWN, 0, true, &pDev);

	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "IoCreateDevice函数状态: %d\n", status);
	if (!NT_SUCCESS(status))
	{
		return status;
	}

	pDev->Flags |= DO_BUFFERED_IO;

	g_symLinkName = RTL_CONSTANT_STRING(L"\\??\\My_Device");
	status = IoCreateSymbolicLink(&g_symLinkName, &g_devName);
	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "IoCreateSymblickLink函数状态: %d\n", status);
	if (!NT_SUCCESS(status))
	{
		return status;
	}

	return status;
}

NTSTATUS DispatchCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "DispatchCreate执行完毕\n");

	return STATUS_SUCCESS;
}

NTSTATUS DispatchClose(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "DispatchClose执行完毕\n");

	return STATUS_SUCCESS;
}

NTSTATUS DispatchIoctrl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	PIO_STACK_LOCATION pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
	ULONG ulCtrlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
	// 控制缓冲区，DeviceIoControl的InBuffer和OutBuffer都是它
	PVOID pCtrlBuf = pIrp->AssociatedIrp.SystemBuffer;
	// 驱动接收用户态程序的数据长度，DeviceIoControl的nOutBufferSize
	ULONG ulInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
	// 驱动发送给用户程序的数据长度，DeviceIoControl的nOutBufferSize
	ULONG ulOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;

	// 处理不同的控制信号
	NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
	switch (ulCtrlCode)
	{
	case MY_IOCTL_INPUT: // 相对于设备而言进行写操作
	{
		DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "%s\n", pCtrlBuf);

		pIrp->IoStatus.Status = STATUS_SUCCESS;
		pIrp->IoStatus.Information = ulInSize;

		status = STATUS_SUCCESS;
		break;
	}
	case MY_IOCTL_OUTPUT: // 相对设备而言进行读操作
	{
		memset(pCtrlBuf, 0x42, ulOutSize - 1);

		pIrp->IoStatus.Status = STATUS_SUCCESS;
		pIrp->IoStatus.Information = ulOutSize - 1;

		status = STATUS_SUCCESS;
		break;
	}
	}

	if (!NT_SUCCESS(status))
		pIrp->IoStatus.Information = 0;

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return status;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, UNICODE_STRING RegistryPath)
{
	UNREFERENCED_PARAMETER(RegistryPath);
	pDriver->DriverUnload = DriverUnload;

	NTSTATUS status = CreateDevice(pDriver);
	if (!NT_SUCCESS(status))
	{
		DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "CreateDevice函数执行失败: %d\n", status);
		return status;
	}

	pDriver->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
	pDriver->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
	pDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctrl;

	return status;
}

用户程序代码

#include <Windows.h>
#include <iostream>

// 驱动程序读控制码
#define MY_IOCTL_INPUT CTL_CODE( \
	FILE_DEVICE_UNKNOWN,         \
	0x800,                       \
	METHOD_BUFFERED,             \
	FILE_ANY_ACCESS)

// 驱动程序写控制码
#define MY_IOCTL_OUTPUT CTL_CODE( \
	FILE_DEVICE_UNKNOWN,          \
	0x801,                        \
	METHOD_BUFFERED,              \
	FILE_ANY_ACCESS)

int main(int argc, char const *argv[])
{
	HANDLE hDevice = CreateFileW(L"\\\\.\\My_Device", GENERIC_READ | GENERIC_WRITE,
		0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hDevice == INVALID_HANDLE_VALUE)
	{
		std::cout << "打开设备失败: " << GetLastError() << std::endl;
		return -1;
	}

	char buffer[0xf]{0};
	memset(buffer, 0x43, 0xf - 1);

	DWORD dwRet = 0;

	// 向设备写入数据
	DeviceIoControl(hDevice, MY_IOCTL_INPUT, buffer, 0xf, nullptr, 0, &dwRet, nullptr);

	// 从设备读取数据
	memset(buffer, 0, 0xf);
	DeviceIoControl(hDevice, MY_IOCTL_OUTPUT, nullptr, 0, buffer, 0xf, &dwRet, nullptr);
	std::cout << buffer << std::endl;

	return 0;
}

运行效果图