初探IRP（代码&程序演示）

由于篇幅太长了，一篇没法装下，所以程序的完整代码和程序演示放到这篇来。程序演示部分需要结合前一篇文章一起看。这里不再赘述具体过程。

完整代码

Ring3部分

c

#include "stdafx.h"
#include "Windows.h"
#include "winioctl.h"

#define OPCODE1 CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define OPCODE2 CTL_CODE(FILE_DEVICE_UNKNOWN, 0x900, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define SYM_LINK_NAME L"\\\\.\\MyRing3Device"

int main(int argc, char* argv[])
{
	//Call IRP_MJ_CREATE
	getchar();
	HANDLE hDevice = CreateFileW(
		SYM_LINK_NAME, 
		GENERIC_READ | GENERIC_WRITE, 
		0,
		NULL, 
		OPEN_EXISTING, 
		FILE_ATTRIBUTE_NORMAL, 
		NULL);
	
	if (hDevice == INVALID_HANDLE_VALUE){
		printf("Create File Failed!");
		getchar();
		return -1;
	} else {
		printf("Create File Success!");
	}

	//Call IRP_MY_DEVICE_CONTROL
	getchar();
	char pInputBuffer[20] = {1, 2, 4, 8, 16, 32, 64, 0};
	char pOutputBuffer[20] = {0};
	DWORD dwReturnSize = 0;
    BOOL bDIC = DeviceIoControl(hDevice, OPCODE2, pInputBuffer, 8, pOutputBuffer, 20, &dwReturnSize, NULL);
	if(bDIC != 0){
		printf("ReturnSize: %x\n", dwReturnSize);
		printf("OutputBuffer: ");
		for(int i = 0; i < dwReturnSize; i++){
			printf("%x ", pOutputBuffer[i]);
		}
	}
	else {
		printf("Communicate Failed!\n");
		return -1;
	}
	printf("\nRing3 And Ring0 Communicate Success!\n");

	//Call IRP_MJ_CLOSE
	getchar();
	BOOL bCH = CloseHandle(hDevice);
	if(bCH != 0){
		printf("Close File Success!");
	}
	getchar();
	return 0;
}

Ring0部分

c

#include "ntifs.h"

#define DEVICE_NAME L"\\Device\\MyDevice"
#define SYM_LINK_NAME L"\\??\\MyRing3Device"
#define OPCODE1 CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define OPCODE2 CTL_CODE(FILE_DEVICE_UNKNOWN,0x900,METHOD_BUFFERED,FILE_ANY_ACCESS)

VOID Drvier_Unload(PDRIVER_OBJECT pDriverObj);
NTSTATUS IrpCreateProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp);
NTSTATUS IrpCloseProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp);
NTSTATUS IrpDeviceControlProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp);

//Driver Entry                                   
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING RegistryPath) {
	DbgPrint("Driver is running!\n");

	PDEVICE_OBJECT pDeviceObj = NULL;
	NTSTATUS status = 0;

	//Create Deivce Object
	UNICODE_STRING DeviceName;
	RtlInitUnicodeString(&DeviceName, DEVICE_NAME);
	status = IoCreateDevice(pDriverObj,
		0,
		&DeviceName,
		FILE_DEVICE_UNKNOWN,
		0,
		FALSE,
		&pDeviceObj);

	if (status != STATUS_SUCCESS) {
		DbgPrint("Device Create Failed!\n");
		return status;
	}
	else {
		DbgPrint("Device Create Success!\n");
	}

	//Set Communicate Ways
	//注意这里一定要用"|=", 而不能直接用"=",因为在创建Device时会给Fllags赋上一个初值
	pDeviceObj->Flags |= DO_BUFFERED_IO;

	//Create Symbollic Link
	UNICODE_STRING SymbolicLinkName;
	RtlInitUnicodeString(&SymbolicLinkName, SYM_LINK_NAME);
	IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);

	//Set Dispatch Function
	pDriverObj->MajorFunction[IRP_MJ_CREATE] = IrpCreateProc;
	pDriverObj->MajorFunction[IRP_MJ_CLOSE] = IrpCloseProc;
	pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IrpDeviceControlProc;

	//Set Unload Function
	pDriverObj->DriverUnload = Drvier_Unload;

	return STATUS_SUCCESS;
}

NTSTATUS IrpCreateProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp) {
	DbgPrint("Irp Create Dispatch Function...\n");

	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}


NTSTATUS IrpCloseProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp) {
	DbgPrint("Irp Close Dispatch Function...\n");

	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

NTSTATUS IrpDeviceControlProc(PDEVICE_OBJECT pDeviceObj, PIRP pIrp) {
	DbgPrint("Irp DeviceControl Dispatch Function...\n");

	//获取缓冲区数据
	PVOID pSystemBuffer = pIrp->AssociatedIrp.SystemBuffer;

	//获取IO_STACK_LOCATION
	PIO_STACK_LOCATION pStackLocation = IoGetCurrentIrpStackLocation(pIrp);
	ULONG InputBufferLength = pStackLocation->Parameters.DeviceIoControl.InputBufferLength;
	ULONG FsControlCode = pStackLocation->Parameters.DeviceIoControl.IoControlCode;

	//判断操作码
	switch (FsControlCode)
	{
	case OPCODE1:
		DbgPrint("不打印操作码");
		pIrp->IoStatus.Status = STATUS_SUCCESS;
		pIrp->IoStatus.Information = 2;
		break;
	case OPCODE2:
		DbgPrint("操作码：%x\n", FsControlCode);
		for (UINT32 i = 0; i < InputBufferLength; i++) {
			DbgPrint("Ring3 Data: %x\n", ((PUCHAR)pSystemBuffer)[i]);
		}
		pIrp->IoStatus.Status = STATUS_SUCCESS;
		pIrp->IoStatus.Information = 5;
		break;
	}
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

VOID Drvier_Unload(PDRIVER_OBJECT pDriverObj) {
	//Delete SymbolicLink
	UNICODE_STRING SymbolicLinkName;
	RtlInitUnicodeString(&SymbolicLinkName, SYM_LINK_NAME);
	IoDeleteSymbolicLink(&SymbolicLinkName);

	//Delete Deivce
	IoDeleteDevice(pDriverObj->DeviceObject);

	DbgPrint("Unload Success!\n");
}

程序演示

操作码1

操作码2