Windows驱动程序中重要的数据结构

驱动对象DRIVER_OBJECT

设备对象DEVICE_OBJECT

设备扩展DEVICE_EXTENSION

驱动对象DRIVER_OBJECT

typedef struct _DRIVER_OBJECT {

    CSHORT Type;

    CSHORT Size;

    //

    // The following links all of the devices created by a single driver

    // together on a list, and the Flags word provides an extensible flag

    // location for driver objects.

    //

    PDEVICE_OBJECT DeviceObject;

    ULONG Flags;

    //

    // The following section describes where the driver is loaded.  The count

    // field is used to count the number of times the driver has had its

    // registered reinitialization routine invoked.

    //

    PVOID DriverStart;

    ULONG DriverSize;

    PVOID DriverSection;

    PDRIVER_EXTENSION DriverExtension;

    //

    // The driver name field is used by the error log thread

    // determine the name of the driver that an I/O request is/was bound.

    //

    UNICODE_STRING DriverName;

    //

    // The following section is for registry support.  This is a pointer

    // to the path to the hardware information in the registry

    //

    PUNICODE_STRING HardwareDatabase;

    //

    // The following section contains the optional pointer to an array of

    // alternate entry points to a driver for "fast I/O" support.  Fast I/O

    // is performed by invoking the driver routine directly with separate

    // parameters, rather than using the standard IRP call mechanism.  Note

    // that these functions may only be used for synchronous I/O, and when

    // the file is cached.

    //

    PFAST_IO_DISPATCH FastIoDispatch;

    //

    // The following section describes the entry points to this particular

    // driver.  Note that the major function dispatch table must be the last

    // field in the object so that it remains extensible.

    //

    PDRIVER_INITIALIZE DriverInit;

    PDRIVER_STARTIO DriverStartIo;

    PDRIVER_UNLOAD DriverUnload;

    PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];

} DRIVER_OBJECT;

typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; 

设备对象DEVICE_OBJECT

typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT {

    CSHORT Type;

    USHORT Size;

    LONG ReferenceCount;

    struct _DRIVER_OBJECT *DriverObject;

    struct _DEVICE_OBJECT *NextDevice;

    struct _DEVICE_OBJECT *AttachedDevice;

    struct _IRP *CurrentIrp;

    PIO_TIMER Timer;

    ULONG Flags;                                // See above:  DO_...

    ULONG Characteristics;                      // See ntioapi:  FILE_...

    __volatile PVPB Vpb;

    PVOID DeviceExtension;

    DEVICE_TYPE DeviceType;

    CCHAR StackSize;

    union {

        LIST_ENTRY ListEntry;

        WAIT_CONTEXT_BLOCK Wcb;

    } Queue;

    ULONG AlignmentRequirement;

    KDEVICE_QUEUE DeviceQueue;

    KDPC Dpc;

    //

    //  The following field is for exclusive use by the filesystem to keep

    //  track of the number of Fsp threads currently using the device

    //

    ULONG ActiveThreadCount;

    PSECURITY_DESCRIPTOR SecurityDescriptor;

    KEVENT DeviceLock;

    USHORT SectorSize;

    USHORT Spare1;

    struct _DEVOBJ_EXTENSION  *DeviceObjectExtension;

    PVOID  Reserved;

} DEVICE_OBJECT;

typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; 

设备扩展DEVICE_EXTENSION

typedef struct _DEVICE_EXTENSION

{

    PDEVICE_OBJECT fdo;

    PDEVICE_OBJECT NextStackDevice;

UNICODE_STRING ustrDeviceName; // 设备名

UNICODE_STRING ustrSymLinkName; // 符号链接名

} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

NT式驱动的基本结构

入口函数DriverEntry

创建设备对象

DriverUnload卸载例程

DISPATH分发例程

WDM式驱动的基本结构

物理设备对象与功能设备对象（PDO、FDO）

WDM驱动程序的入口函数

WDM驱动程序的AddDevice例程

WDM驱动程序的Unload例程

设备的层次结构

驱动程序的垂直层次结构

驱动程序的水平层次结构

驱动程序的复杂层次结构