samyu520
驱动牛犊
驱动牛犊
  • 注册日期2010-03-15
  • 最后登录2010-09-24
  • 粉丝0
  • 关注0
  • 积分3分
  • 威望21点
  • 贡献值0点
  • 好评度0点
  • 原创分0分
  • 专家分0分
阅读:1354回复:0

求教,驱动卸载不了

楼主#
更多 发布于:2010-09-24 20:40
filter.h头文件
#ifdef __cplusplus
extern "C"{
#endif

#include <ntddk.h>
#include <ntddkbd.h>

#ifdef __cplusplus
}
#endif

#define KEY_UP 1
#define KEY_DOWN 0

typedef struct _MYDEVICE_EXTENSION{
PDEVICE_OBJECT TopOfDevice;
}MYDEVICE_EXTENSION,*PMYDEVICE_EXTENSION;

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath);
NTSTATUS FilterInit(IN PDRIVER_OBJECT DriverObject);
NTSTATUS FilterDispatchGeneral(IN PDEVICE_OBJECT,IN PIRP);
NTSTATUS FilterDispatchRead(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp);
NTSTATUS FilterCompleteRead(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp,IN PVOID Context);
VOID FilterUnload(IN PDRIVER_OBJECT DriverObject);

filter.cpp源文件
#include "filter.h"

//#pragma INITEDCODE
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath){
//ULONG i;
KdPrint(("Enter DriverEntry..."));

__try{
for(int i = 0;i < IRP_MJ_MAXIMUM_FUNCTION;i++){
DriverObject->MajorFunction = FilterDispatchGeneral;
}

DriverObject->MajorFunction[IRP_MJ_READ] = FilterDispatchRead;
DriverObject->DriverUnload = FilterUnload;


NTSTATUS status2 = FilterInit(DriverObject);
if(NT_SUCCESS(status2)){
KdPrint(("初始化成功"));
}

KdPrint(("Leave DriverEntry..."));

}__except(EXCEPTION_EXECUTE_HANDLER){
KdPrint(("加载失败"));
}
return STATUS_SUCCESS;
}

//#pragma INITEDCODE
NTSTATUS FilterInit(IN PDRIVER_OBJECT DriverObject){
KdPrint(("Enter FilterInit"));



__try{    

PDEVICE_OBJECT DeviceObject;
PMYDEVICE_EXTENSION devExt;
NTSTATUS status;
UNICODE_STRING attachDeviceName;

RtlInitUnicodeString(&attachDeviceName,L"\\Device\\KeyboardClass0");

status = IoCreateDevice(DriverObject,
sizeof(MYDEVICE_EXTENSION),
NULL,
FILE_DEVICE_KEYBOARD,
0,
FALSE,
&DeviceObject);

if(!NT_SUCCESS(status)){
KdPrint(("Create Device Fail..."));

return STATUS_SUCCESS;
}

RtlZeroMemory(DeviceObject->DeviceExtension,sizeof(MYDEVICE_EXTENSION));

DeviceObject->Flags |= DO_BUFFERED_IO;
DeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
devExt = (PMYDEVICE_EXTENSION) DeviceObject->DeviceExtension;

status = IoAttachDevice(DeviceObject,&attachDeviceName,&devExt->TopOfDevice);

if(!NT_SUCCESS(status)){
KdPrint(("Attach Device Fail..."));
IoDeleteDevice(DeviceObject);

return STATUS_SUCCESS;
}


}__except(EXCEPTION_EXECUTE_HANDLER){
KdPrint(("在生成驱动时出问题"));
}

KdPrint(("Leave FilterInit..."));
return STATUS_SUCCESS;
}


//#pragma PAGEDCODE
NTSTATUS FilterCompleteRead(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp,IN PVOID Context){
KdPrint(("Enter FilterCompleteRead...\n"));
PKEYBOARD_INPUT_DATA keyData;
int numKeys;

if(NT_SUCCESS(Irp->IoStatus.Status)){
KdPrint(("push Keyborad...\n"));
keyData = (PKEYBOARD_INPUT_DATA)Irp->AssociatedIrp.SystemBuffer;
numKeys = Irp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA);

for(int i = 0; i < numKeys ; i++){
KdPrint(("Key Num Was: %x\n",keyData.MakeCode));
KdPrint(("Key Status Was: %s\n",keyData.Flags?"Up" : "Down"));

//过滤可以做一些动作,比如把键盘按下的操作输入到一个日志文件中
}
}

if(Irp->PendingReturned){
IoMarkIrpPending(Irp);
}

KdPrint(("Leave FilterCompleteRead...\n"));
return Irp->IoStatus.Status;
}

//#pragma PAGEDCODE
NTSTATUS FilterDispatchGeneral(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp){
IoSkipCurrentIrpStackLocation(Irp);
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION) DeviceObject->DeviceExtension;
return IoCallDriver(devExt->TopOfDevice,Irp);
}

//#pragma PAGEDCODE
NTSTATUS FilterDispatchRead(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp){

PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION) DeviceObject->DeviceExtension;

PIO_STACK_LOCATION currentStack;
PIO_STACK_LOCATION nextStack;



currentStack = IoGetCurrentIrpStackLocation(Irp);
nextStack = IoGetNextIrpStackLocation(Irp);

*nextStack = *currentStack;

IoSetCompletionRoutine(Irp,FilterCompleteRead,DeviceObject,TRUE,TRUE,TRUE);

return IoCallDriver(devExt->TopOfDevice,Irp);
}

//#pragma PAGEDCODE
VOID FilterUnload(IN PDRIVER_OBJECT DriverObject){
KdPrint(("Unload Driver..."));
PDEVICE_OBJECT OldDeviceObject;
OldDeviceObject = DriverObject->DeviceObject;
while(OldDeviceObject != NULL){
PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)OldDeviceObject->DeviceExtension;

if(devExt->TopOfDevice){
IoDetachDevice(devExt->TopOfDevice);
}
IoDeleteDevice(OldDeviceObject);
OldDeviceObject = OldDeviceObject->NextDevice;


}


KdPrint(("Leave FilterUnload..."));
}

这是一个键盘过滤驱动,安装与使用都没有问题,当我把驱动停止之后(调用了Unload函数之后),如果我再按键盘就会蓝屏,如果不按键盘直接卸载它没有问题,但如果我再次按安装,安装没有问题,但启动不了,卸载没有问题,请大虾帮帮解答一下啊
游客

返回顶部