使用WDM驱动实现在NT下读取物理端口，特殊寄存器，物理内存的代码(Win32汇编源代码)

在WinNT下Ring3级应用程序不能直接访问硬件I/O和物理内存，需要调用驱动在Ring0下间接访问。本代码在MASM10 + KmdKit v1.8下编译通过。

comment *
  libmio.asm -- Using driver to implement hardware access for Windows.
                allows the ring3 applications to access I/O port,MSR,PMC,PCI bus,Physical memory.
  2011/08/15 Perry<[e-mail]>
*


.586
.model flat, stdcall
 option casemap :none

KmdKit头文件。

include                   w2k\ntddk.inc
include                   w2k\ntstatus.inc
include                   w2k\ntoskrnl.inc
include                   w2k\hal.inc
include                   Strings.mac

KmdKit库文件。

includelib                \masm32\lib\w2k\ntoskrnl.lib
includelib                \masm32\lib\w2k\hal.lib

驱动入口函数声明。

DriverEntry               PROTO :PDRIVER_OBJECT,:PUNICODE_STRING

驱动I/O例程调用函数声明。

OnUnrealized              PROTO :PDEVICE_OBJECT,:PIRP
OnIoControl               PROTO :PDEVICE_OBJECT,:PIRP
OnCreate                  PROTO :PDEVICE_OBJECT,:PIRP
OnClose                   PROTO :PDEVICE_OBJECT,:PIRP
OnUnload                  PROTO :PDRIVER_OBJECT

物理内存读写函数声明。

MmMapPhysical             PROTO :DWORD,:DWORD,:DWORD
MmUnmapPhysical           PROTO :DWORD

本驱动版本常数。

LIBMIO_MAJOR_VERSION      equ 1h
LIBMIO_MINOR_VERSION      equ 0h
LIBMIO_REVISION           equ 0h
LIBMIO_RELESE             equ 2h

内核内存分配标记。

MM_ALLOC_POOL_TAG         equ 6d62696ch

接受DeviceIoControl的常量定义。

IOCTL_GET_DRIVER_REFCOUNT equ CTL_CODE(FILE_DEVICE_UNKNOWN, 8FFh, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_GET_DRIVER_VERSION  equ CTL_CODE(FILE_DEVICE_UNKNOWN, 900h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_MSR            equ CTL_CODE(FILE_DEVICE_UNKNOWN, 901h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_MSR           equ CTL_CODE(FILE_DEVICE_UNKNOWN, 902h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PMC            equ CTL_CODE(FILE_DEVICE_UNKNOWN, 903h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_HALT                equ CTL_CODE(FILE_DEVICE_UNKNOWN, 904h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PORT           equ CTL_CODE(FILE_DEVICE_UNKNOWN, 905h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PORT_BYTE      equ CTL_CODE(FILE_DEVICE_UNKNOWN, 906h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PORT_WORD      equ CTL_CODE(FILE_DEVICE_UNKNOWN, 907h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PORT_DWORD     equ CTL_CODE(FILE_DEVICE_UNKNOWN, 908h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_PORT          equ CTL_CODE(FILE_DEVICE_UNKNOWN, 909h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_PORT_BYTE     equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Ah, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_PORT_WORD     equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Bh, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_PORT_DWORD    equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Ch, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_PCI_READ_CONFIG     equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Dh, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_PCI_WRITE_CONFIG    equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Eh, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_MAP_PHY_MEMORY      equ CTL_CODE(FILE_DEVICE_UNKNOWN, 90Fh, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_UNMAP_PHY_MEMORY    equ CTL_CODE(FILE_DEVICE_UNKNOWN, 910h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_READ_PHY_MEMORY     equ CTL_CODE(FILE_DEVICE_UNKNOWN, 911h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_WRITE_PHY_MEMORY    equ CTL_CODE(FILE_DEVICE_UNKNOWN, 912h, METHOD_BUFFERED, FILE_ANY_ACCESS)

物理内存分配信息结构定义。

_MAP_NODE struct
       node   SINGLE_LIST_ENTRY <?>
        pid   dd ?
       pMdl   dd ?
     ppAddr   dd ?
     pvKenl   dd ?
     pvUser   dd ?
     cbSize   dd ?
_MAP_NODE ends

MAP_NODE typedef _MAP_NODE
PMAP_NODE typedef PTR _MAP_NODE

Windows驱动符号定义。

.const
CCOUNTED_UNICODE_STRING   "\\Device\\libmio", uzWinDeviceName, 4
CCOUNTED_UNICODE_STRING   "\\DosDevices\\libmio", uzDosDeviceName, 4

.data?
MapList                   SINGLE_LIST_ENTRY <?>

.data
dwLibmioVersion           db LIBMIO_RELESE
                          db LIBMIO_REVISION
                          db LIBMIO_MINOR_VERSION
                          db LIBMIO_MAJOR_VERSION
dwRefCount                dd 0
mmnode                    MAP_NODE <<?>,0,0,0,0,0,0>

入口函数。

.code

  ; This function is called by the system.
  ; initialize some resource and create a new device object.
  ; Arguments:
  ;   DriverObject - Pointer to the object that represents our driver.
  ;   RegistryPath - Pointer to the unicode string for the registry path of driver.
  ; Return Value:
  ;   STATUS_SUCCESS if the driver initialized correctly, otherwise an erroror
  ;   indicating the reason for failure.
  DriverEntry proc DriverObject:PDRIVER_OBJECT, RegistryPath:PUNICODE_STRING
    LOCAL pDeviceObject :PDEVICE_OBJECT
    LOCAL ntStatus :NTSTATUS
    
      INVOKE    DbgPrint, $CTA0("DriverEntry: Enter...\n")
      
      ; protect register
      pushad
      
         lea    esi, MapList
      assume    esi: PSINGLE_LIST_ENTRY
         mov    [esi].Next, NULL
      assume    esi: nothing
      
         mov    esi, DriverObject
      assume    esi: PDRIVER_OBJECT
         
         mov    pDeviceObject, NULL
      
      ; create a new DeviceObject
      INVOKE    IoCreateDevice, esi, 0h, addr uzWinDeviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, 0, addr pDeviceObject
         mov    ntStatus, eax
      INVOKE    DbgPrint, $CTA0("DriverEntry: IoCreateDevice(%08X)\n"), ntStatus
         cmp    ntStatus, STATUS_SUCCESS
         jnz    @F

         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_CLOSE], offset OnClose
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_CREATE], offset OnCreate
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_DEVICE_CONTROL], offset OnIoControl
         
         mov    eax, offset OnUnrealized
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_INTERNAL_DEVICE_CONTROL], eax
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_SYSTEM_CONTROL], eax
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_POWER], eax
         mov    [esi].MajorFunction[(sizeof PVOID) * IRP_MJ_PNP], eax
          
         mov    [esi].DriverUnload, offset OnUnload
         
      ; link the pDeviceObject
      INVOKE    IoCreateSymbolicLink, addr uzDosDeviceName, addr uzWinDeviceName
         mov    ntStatus, eax
      INVOKE    DbgPrint, $CTA0("DriverEntry: IoCreateSymbolicLink(%08X)\n"), ntStatus
         cmp    ntStatus, STATUS_SUCCESS
          jz    @F
          
      ; if the IoCreateSymbolicLink was have not succeed.
      ; We need to delete the pDeviceObject for created by IoCreateDevice.
      INVOKE    IoDeleteDevice, pDeviceObject
      INVOKE    DbgPrint, $CTA0("DriverEntry: IoDeleteDevice()\n")

         @@:      
      assume    esi: nothing
       popad
         
      INVOKE    DbgPrint, $CTA0("DriverEntry: Leave...\n\n")
         mov    eax, ntStatus
         ret
  DriverEntry endp

未处理的例程。

  ; other IRP.
  ; Arguments:
  ;   DeviceObject - Pointer to device object.
  ;   pIrp - Pointer to the current IRP.
  ; Return Value:
  ;   STATUS_SUCCESS if the IRP was processed successfully, otherwise an erroror
  ;   indicating the reason for failure.
  OnUnrealized proc uses esi pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
      INVOKE    DbgPrint, $CTA0("OnUnrealized: Enter...\n")
         
        push    esi
         mov    esi, pIrp
      assume    esi :PIRP
         
         mov    [esi].IoStatus.Status, STATUS_SUCCESS
         mov    [esi].IoStatus.Information, 0h
         
      assume    esi :nothing
         pop    esi

    fastcall    IofCompleteRequest, pIrp, IO_NO_INCREMENT
      INVOKE    DbgPrint, $CTA0("OnUnrealized: IoCompleteRequest()\n") 
      
      INVOKE    DbgPrint, $CTA0("OnUnrealized: Leave...\n\n")
         mov    eax, STATUS_SUCCESS
         ret
  OnUnrealized endp

处理应用程式发送的DeviceIoControl例程。

  ; IRP_MJ_DEVICE_CONTROL.
  ; Arguments:
  ;   DeviceObject - Pointer to device object.
  ;   pIrp - Pointer to the current IRP.
  ; Return Value:
  ;   STATUS_SUCCESS if the IRP was processed successfully, otherwise an erroror
  ;   indicating the reason for failure.
  OnIoControl proc uses esi edi ebx pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
    LOCAL ntStatus :NTSTATUS
           
      INVOKE    DbgPrint, $CTA0("OnIoControl: Enter...\n")
         mov    ntStatus, STATUS_INVALID_DEVICE_REQUEST
         
         mov    esi, pIrp
      assume    esi :PIRP
         
         mov    [esi].IoStatus.Information, 0h
         
                IoGetCurrentIrpStackLocation esi               
         mov    edi, eax
      assume    edi :PIO_STACK_LOCATION

获取驱动被调用的实例数量，使驱动能被多个Ring3应用程序调用。

    .if [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_GET_DRIVER_REFCOUNT
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_GET_DRIVER_REFCOUNT\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 4h
          jb    @F
         mov    eax, [esi].AssociatedIrp.SystemBuffer
         mov    ecx, dwRefCount
         mov    [eax], ecx
         mov    [esi].IoStatus.Information, 4h
         mov    ntStatus, STATUS_SUCCESS
         @@:

获取驱动内部版本号。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_GET_DRIVER_VERSION
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_GET_DRIVER_VERSION\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 4h
          jb    @F
         mov    eax, [esi].AssociatedIrp.SystemBuffer
         lea    ebx, dwLibmioVersion
         mov    ecx, [ebx]
         mov    [eax], ecx
         mov    [esi].IoStatus.Information, 4h
         mov    ntStatus, STATUS_SUCCESS
         @@:

读取MSR寄存器。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_MSR
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_MSR\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 4h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 8h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    ecx, [ebx]
       rdmsr
         mov    [ebx], eax
         mov    [ebx + 4h], edx
         mov    [esi].IoStatus.Information, 8h
         mov    ntStatus, STATUS_SUCCESS
         @@:

写MSR寄存器。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_WRITE_MSR
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_WRITE_MSR\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 0Ch
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    ecx, [ebx]
         mov    eax, [ebx + 4h]
         mov    edx, [ebx + 8h]
       wrmsr
         mov    ntStatus, STATUS_SUCCESS
         @@:

读取PMC信息。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PMC
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_PMC\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 4h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 8h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    ecx, [ebx]
       rdpmc
         mov    [ebx], eax
         mov    [ebx + 4h], edx
         mov    [esi].IoStatus.Information, 8h
         mov    ntStatus, STATUS_SUCCESS
         @@:

调用Halt特权指令。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_HALT
         hlt
         mov    ntStatus, STATUS_SUCCESS
    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PORT
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_PORT\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 2h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 0h
          jz    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    dx, [ebx]
         cli
      .if [edi].Parameters.DeviceIoControl.OutputBufferLength >= 4h
          in    eax, dx
         mov    [ebx], eax
         mov    [esi].IoStatus.Information, 4h
      .else
        .if [edi].Parameters.DeviceIoControl.OutputBufferLength >= 2h
          in    ax, dx
         mov    [ebx], ax
         mov    [esi].IoStatus.Information, 2h
        .else
          in    al, dx
         mov    [ebx], al
         mov    [esi].IoStatus.Information, 1h
        .endif
      .endif
         sti
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次读取I/O端口一个字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PORT_BYTE
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_PORT_BYTE\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 2h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 0h
          jz    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
        push    ebx
         xor    eax, eax
         mov    ax, [ebx]
      INVOKE    READ_PORT_UCHAR, eax
         pop    ebx
         mov    [ebx], al
         mov    [esi].IoStatus.Information, 1h
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次读取I/O端口两个字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PORT_WORD
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_PORT_WORD\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 2h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 2h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
        push    ebx
         xor    eax, eax
         mov    ax, [ebx]
      INVOKE    READ_PORT_USHORT, eax
         pop    ebx
         mov    [ebx], ax
         mov    [esi].IoStatus.Information, 2h
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次读取I/O端口四个字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PORT_DWORD
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_READ_PORT_DWORD\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 2h
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 4h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
        push    ebx
         xor    eax, eax
         mov    ax, [ebx]
      INVOKE    READ_PORT_ULONG, eax
         pop    ebx
         mov    [ebx], eax
         mov    [esi].IoStatus.Information, 4h
         mov    ntStatus, STATUS_SUCCESS
         @@:
    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_WRITE_PORT
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_WRITE_PORT\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 3h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    dx, [ebx]
         cli
      .if [edi].Parameters.DeviceIoControl.InputBufferLength >= 6h
         mov    eax, [ebx + 2h]
         out    dx, eax
      .else
        .if [edi].Parameters.DeviceIoControl.InputBufferLength >= 4h
         mov    ax, [ebx + 2h]
         out    dx, ax
        .else
         mov    al, [ebx + 2h]
         out    dx, al
        .endif
      .endif
         sti
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次写I/O端口一个字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_WRITE_PORT_BYTE
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_WRITE_PORT_BYTE\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 8h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    eax, [ebx]
         mov    ecx, [ebx + 4h]
      INVOKE    WRITE_PORT_UCHAR, eax, ecx
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次写I/O端口两个字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_WRITE_PORT_WORD
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_WRITE_PORT_WORD\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 8h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    eax, [ebx]
         mov    ecx, [ebx + 4h]
      INVOKE    WRITE_PORT_USHORT, eax, ecx
         mov    ntStatus, STATUS_SUCCESS
         @@:

一次写I/O端口四字节。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_WRITE_PORT_DWORD
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_WRITE_PORT_DWORD\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 8h
          jb    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    eax, [ebx]
         mov    ecx, [ebx + 4h]
      INVOKE    WRITE_PORT_ULONG, eax, ecx
         mov    ntStatus, STATUS_SUCCESS
         @@:

读写PCI配置信息。

    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_PCI_READ_CONFIG
      ; SystemBuffer for input.
      ;   DWORD[0] = bus number.
      ;   DWORD[1] = slot number.
      ;   DWORD[2] = offset.
      ; SystemBuffer for output.
      ;   DWORD    = data output.
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_PCI_READ_CONFIG\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 0Ch
          jb    @F
         cmp    [edi].Parameters.DeviceIoControl.OutputBufferLength, 0h
          jz    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    eax, [edi].Parameters.DeviceIoControl.OutputBufferLength
      INVOKE    HalGetBusDataByOffset, PCIConfiguration, [ebx], [ebx + 4h], ebx, [ebx + 8h], eax
      .if eax != [edi].Parameters.DeviceIoControl.OutputBufferLength
         mov    [esi].IoStatus.Information, 0h
         mov    ntStatus, STATUS_INVALID_PARAMETER      
      .else
         mov    [esi].IoStatus.Information, eax
         mov    ntStatus, STATUS_SUCCESS   
      .endif
         @@:
    .elseif [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_PCI_WRITE_CONFIG
      ; SystemBuffer for input.
      ;   DWORD[0] = bus number.
      ;   DWORD[1] = slot number.
      ;   DWORD[2] = offset.
      ;   DWORD[3] = data length.
      INVOKE    DbgPrint, $CTA0("OnIoControl: $IOCTL_PCI_WRITE_CONFIG\n")
         mov    ntStatus, STATUS_BUFFER_TOO_SMALL
         cmp    [edi].Parameters.DeviceIoControl.InputBufferLength, 10h
         jbe    @F
         mov    ebx, [esi].AssociatedIrp.SystemBuffer
         mov    eax, ebx
         add    eax, 10h
        push    [ebx + 0Ch]
      INVOKE    HalSetBusDataByOffset, PCIConfiguration, [ebx], [ebx + 4h], eax, [ebx + 8h], [ebx + 0Ch]
         pop    ebx
      .if eax != ebx
         mov    [esi].IoStatus.Information, 0h
         mov    ntStatus, STATUS_INVALID_PARAMETER      
      .else
         mov    [esi].IoStatus.Information, eax
         mov    ntStatus, STATUS_SUCCESS   
      .endif
         @@:
    .endif
         
        push    ntStatus
         pop    [esi].IoStatus.Status
    
      assume    edi :nothing
      assume    esi :nothing
         
    fastcall    IofCompleteRequest, pIrp, IO_NO_INCREMENT
      INVOKE    DbgPrint, $CTA0("OnIoControl: IoCompleteRequest()\n")  
      
      INVOKE    DbgPrint, $CTA0("OnIoControl: Leave...\n\n")
         mov    eax, ntStatus
         ret
  OnIoControl endp

处理应用程序调用CreateFile的例程。

  ; IRP_MJ_CREATE.
  ; Arguments:
  ;   DeviceObject - Pointer to device object.
  ;   pIrp - Pointer to the current IRP.
  ; Return Value:
  ;   STATUS_SUCCESS if the IRP was processed successfully, otherwise an erroror
  ;   indicating the reason for failure.
  OnCreate proc uses esi pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
      INVOKE    DbgPrint, $CTA0("OnCreate: Enter...\n")
         
         inc    dwRefCount
         
        push    esi
         mov    esi, pIrp
      assume    esi :PIRP
         
         mov    [esi].IoStatus.Status, STATUS_SUCCESS
         mov    [esi].IoStatus.Information, 0h
         
      assume    esi :nothing
         pop    esi

    fastcall    IofCompleteRequest, pIrp, IO_NO_INCREMENT
      INVOKE    DbgPrint, $CTA0("OnCreate: IoCompleteRequest()\n")  
      INVOKE    DbgPrint, $CTA0("OnCreate: Leave...\n\n")
         mov    eax, STATUS_SUCCESS
         ret
  OnCreate endp

处理应用程序调用CloseHandle的例程。

  ; IRP_MJ_CLOSE.
  ; Arguments:
  ;   DeviceObject - Pointer to device object.
  ;   pIrp - Pointer to the current IRP.
  ; Return Value:
  ;   STATUS_SUCCESS if the IRP was processed successfully, otherwise an erroror
  ;   indicating the reason for failure.
  OnClose proc uses esi pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
      INVOKE    DbgPrint, $CTA0("OnClose: Enter...\n")
         
         cmp    dwRefCount, 0h
          jz    @F
         dec    dwRefCount
         @@:
         
        push    esi
         mov    esi, pIrp
      assume    esi :PIRP
         
         mov    [esi].IoStatus.Status, STATUS_SUCCESS
         mov    [esi].IoStatus.Information, 0h
         
      assume    esi :nothing
         pop    esi

    fastcall    IofCompleteRequest, pIrp, IO_NO_INCREMENT
      INVOKE    DbgPrint, $CTA0("OnClose: IoCompleteRequest()\n")      
      INVOKE    DbgPrint, $CTA0("OnClose: Leave...\n\n")
         mov    eax, STATUS_SUCCESS
         ret
  OnClose endp

处理系统调用或当应用程序调用DeleteService,ControlService时的例程。

  ; This routine is called by the I/O system to unload the driver.
  ; Any resources previously allocated must be freed.
  ; Arguments:
  ;   DriverObject - Pointer to the object that represents our driver.
  ; Return Value:
  ;   None
  OnUnload proc DriverObject:PDRIVER_OBJECT  
      INVOKE    DbgPrint, $CTA0("OnUnload: Enter...\n")
      
      ; delete the link from our device name to a name in the Win32 namespace.
      INVOKE    IoDeleteSymbolicLink, addr uzDosDeviceName
      INVOKE    DbgPrint, $CTA0("OnUnload: IoDeleteSymbolicLink(%08X)\n"), eax
       
      ; delete the pDeviceObject
         mov    eax, DriverObject
      INVOKE    IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject
      INVOKE    DbgPrint, $CTA0("OnUnload: IoDeleteDevice()\n")
         
      INVOKE    DbgPrint, $CTA0("OnUnload: Leave...\n\n")
         ret
  OnUnload endp