第7章 I/O请求包

#include <ntddk.h>
 
#define DEVICE_NAME L"\\Device\\Zero"
 
NTSTATUS CreateClose(PDEVICE_OBJECT, PIRP);
NTSTATUS ReadWrite(PDEVICE_OBJECT, PIRP);
 
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING)
{
    PDEVICE_OBJECT dev;
    UNICODE_STRING name = RTL_CONSTANT_STRING(DEVICE_NAME);
 
    NTSTATUS st = IoCreateDevice(DriverObject, 0, &name,
        FILE_DEVICE_UNKNOWN, 0, FALSE, &dev);
    if (!NT_SUCCESS(st)) return st;
 
    // 注册读写与其他请求的分发例程
    DriverObject->MajorFunction[IRP_MJ_CREATE] = CreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = CreateClose;
    DriverObject->MajorFunction[IRP_MJ_READ] = ReadWrite;
    DriverObject->MajorFunction[IRP_MJ_WRITE] = ReadWrite;
 
    dev->Flags |= DO_BUFFERED_IO;   // 读/写走缓冲 I/O
    dev->Flags &= ~DO_DEVICE_INITIALIZING;
    return STATUS_SUCCESS;
}

DriverEntry
  │
  ├─→ IoCreateDevice(\Device\Zero)     建设备对象
  ├─→ MajorFunction[CREATE/CLOSE] = CreateClose
  ├─→ MajorFunction[READ/WRITE]  = ReadWrite
  ├─→ Flags |= DO_BUFFERED_IO          读写用缓冲 I/O
  └─→ Flags &= ~DO_DEVICE_INITIALIZING 完成初始化

NTSTATUS ReadWrite(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG len = 0;
 
    if (stack->MajorFunction == IRP_MJ_READ) {
        // 请求长度就是可写的最大长度
        len = stack->Parameters.Read.Length;
        // 整个缓冲区填零（缓冲 I/O：直接写 SystemBuffer）
        RtlZeroMemory(Irp->SystemBuffer, len);
        Irp->IoStatus.Information = len;   // 实际返回的字节数
    }
    // 写请求：Zero 驱动忽略数据，同样"成功"
    else {
        len = stack->Parameters.Write.Length;
        Irp->IoStatus.Information = len;   // 假装都"写"进去了
    }
 
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

HANDLE h = CreateFileW(L"\\\\.\\Zero",
    GENERIC_READ | GENERIC_WRITE, 0, nullptr,
    OPEN_EXISTING, 0, nullptr);
 
char buf[64];
DWORD bytes = 0;
 
// 读 64 字节 → 缓冲区应全是 0
ReadFile(h, buf, sizeof(buf), &bytes, nullptr);
for (int i = 0; i < 64; i++) {
    if (buf[i] != 0) { /* 驱动没填零！ */ }
}
 
// 写 64 字节 → 返回成功，数据被忽略
WriteFile(h, buf, sizeof(buf), &bytes, nullptr);
CloseHandle(h);

NTSTATUS CreateClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
    UNREFERENCED_PARAMETER(DeviceObject);
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

CreateFile(\\.\Zero)
  │ IRP_MJ_CREATE 沿栈下发
  ▼
CreateClose
  │ 直接成功 + 完成
  ▼
用户拿到句柄，后续 Read/Write 正常
 
CloseHandle(h)
  │ IRP_MJ_CLOSE
  ▼
CreateClose（同一函数）
  │ 直接成功 + 完成

// DeviceObject->Flags |= DO_BUFFERED_IO（在 DriverEntry 设置）
NTSTATUS ReadZero(PDEVICE_OBJECT, PIRP Irp)
{
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG len = stack->Parameters.Read.Length;
 
    // SystemBuffer 就是你的工作区，直接读写
    RtlZeroMemory(Irp->SystemBuffer, len);
    Irp->IoStatus.Information = len;
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

// DeviceObject->Flags |= DO_DIRECT_IO（DriverEntry 设置）
NTSTATUS ReadDirect(PDEVICE_OBJECT, PIRP Irp)
{
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG len = stack->Parameters.Read.Length;
 
    // 拿 MDL 映射地址：DIRECT 下用户页已锁定
    PVOID va = MmGetSystemAddressForMdlSafe(
        Irp->MdlAddress, NormalPagePriority);
    if (!va) {                      // 映射失败
        Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    RtlZeroMemory(va, len);         // 直接写用户内存（零复制）
    Irp->IoStatus.Information = len;
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}