第4章 驱动程序：从头到尾

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    // 1. 从注册表读协议配置（上层服务键的 Parameters 子键）
    UNICODE_STRING keyPath = RegistryPath->Buffer[0]
        ? *RegistryPath : RTL_CONSTANT_STRING(L"");
    RTL_QUERY_REGISTRY_TABLE table = {0};
    ULONG maxBuf = 4096;                 // 协议缓冲上限，可被注册表覆盖
    // ... RtlQueryRegistryValues 填充 maxBuf ...
 
    // 2. 创建控制设备，附带 SDDL 门禁：只允许系统与管理
    UNICODE_STRING devName = RTL_CONSTANT_STRING(L"\\Device\\MyDriver");
    PDEVICE_OBJECT devObj = nullptr;
    NTSTATUS st = IoCreateDevice(DriverObject, sizeof(MY_CONTEXT),
        &devName, FILE_DEVICE_UNKNOWN, 0, FALSE, &devObj);
    if (!NT_SUCCESS(st)) return st;
 
    // 3. 挂符号链接，让用户模式能通过 \\.\MyDriver 打开
    UNICODE_STRING linkName = RTL_CONSTANT_STRING(L"\\??\\MyDriver");
    st = IoCreateSymbolicLink(&linkName, &devName);
    if (!NT_SUCCESS(st)) { IoDeleteDevice(devObj); return st; }
 
    // 4. 注册分发例程（三个办事窗口 + 兜底）
    DriverObject->MajorFunction[IRP_MJ_CREATE] = MyCreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = MyCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = MyDeviceControl;
    return STATUS_SUCCESS;
}

NtLoadDriver 加载 .sys
  │
  ├─→ 读注册表 Parameters\MaxBuffer  → 协议上限
  ├─→ IoCreateDevice(名字, SDDL)     → 建控制设备 + 门禁
  ├─→ IoCreateSymbolicLink(\??\MyDriver → \Device\MyDriver)
  │                                   → 用户模式可见的门牌
  └─→ MajorFunction[CREATE/CLOSE/CONTROL] = 分发例程
      │
      └─→ 返回 STATUS_SUCCESS         → 驱动进入"运行"状态

NTSTATUS MyCreateClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    MY_CONTEXT* ctx = (MY_CONTEXT*)DeviceObject->DeviceExtension;
 
    if (stack->MajorFunction == IRP_MJ_CREATE) {
        if (ctx->clientCount >= 1) {        // 排他协议：只许一个客户
            Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
            Irp->IoStatus.Information = 0;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_ACCESS_DENIED;
        }
        ctx->clientCount++;                 // 登记：占用计数 +1
    } else {
        ctx->clientCount--;                 // 注销：占用计数 -1
    }
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

// 打开控制设备（对应内核 IRP_MJ_CREATE）
HANDLE h = CreateFileW(L"\\\\.\\MyDriver",
    GENERIC_READ | GENERIC_WRITE,
    0, nullptr, OPEN_EXISTING, 0, nullptr);
if (h == INVALID_HANDLE_VALUE) {
    // 第二个客户端在此失败：ERROR_ACCESS_DENIED
}
 
// 关闭控制设备（对应内核 IRP_MJ_CLOSE）
CloseHandle(h);

NTSTATUS MyDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
    ULONG inLen  = stack->Parameters.DeviceIoControl.InputBufferLength;
    ULONG outLen = stack->Parameters.DeviceIoControl.OutputBufferLength;
 
    ULONG info = 0;
    NTSTATUS st = STATUS_SUCCESS;
    switch (code) {
    case IOCTL_MY_ADD: {                    // 自定义协议命令
        auto* in = (MY_ADD_IN*)Irp->SystemBuffer;
        if (inLen < sizeof(MY_ADD_IN)) { st = STATUS_BUFFER_TOO_SMALL; break; }
        if (outLen < sizeof(MY_ADD_OUT)) { st = STATUS_BUFFER_TOO_SMALL; break; }
        auto* out = (MY_ADD_OUT*)Irp->SystemBuffer;
        out->sum = in->a + in->b;           // 真正的业务逻辑
        info = sizeof(MY_ADD_OUT);
        break;
    }
    default:
        st = STATUS_INVALID_DEVICE_REQUEST; // 未知 IOCTL 码
        break;
    }
    Irp->IoStatus.Status = st;
    Irp->IoStatus.Information = info;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return st;
}

// 客户端构造同样的协议结构体，调用一次设备控制
MY_ADD_IN in = { .a = 5, .b = 7 };
MY_ADD_OUT out = { 0 };
DWORD returned = 0;
BOOL ok = DeviceIoControl(h,
    IOCTL_MY_ADD,           // 双方约定的 IOCTL 码
    &in, sizeof(in),        // 输入缓冲区
    &out, sizeof(out),      // 输出缓冲区
    &returned, nullptr);
if (!ok) {
    // 失败时 GetLastError() 映射自驱动的 NTSTATUS
}
// 成功：out.sum == 12，returned == sizeof(MY_ADD_OUT)

void DriverUnload(PDRIVER_OBJECT DriverObject)
{
    PDEVICE_OBJECT devObj = DriverObject->DeviceObject;
 
    // 1. 摘门牌：新客户端无法再打开
    UNICODE_STRING linkName = RTL_CONSTANT_STRING(L"\\??\\MyDriver");
    IoDeleteSymbolicLink(&linkName);
 
    // 2. 拆前台：删除设备对象（含设备扩展内存）
    if (devObj) {
        IoDeleteDevice(devObj);
        DriverObject->DeviceObject = nullptr;
    }
    // 3. 释放驱动级资源（池内存、事件、锁……）
    // 每个客户端上下文应已在 Close 时释放完毕
}

:: 管理员命令行：卸载驱动
sc stop MyDriver     :: 触发 DriverUnload
sc delete MyDriver   :: 删除服务记录
 
:: 若客户端句柄未关闭，sc stop 会失败或挂起——
:: 驱动层应先排空所有打开句柄再执行卸载