#include?“IrpFile.h“
#include?“FileManage.h“
#include?“Driver.h“


NTSTATUS?DriverEntry（PDRIVER_object?pDriverobject?PUNICODE_STRING?pRegPath）
{
	DbgPrint（“Enter?DriverEntry\n“）;
	NTSTATUS?status?=?STATUS_SUCCESS;

	pDriverobject->DriverUnload?=?DriverUnload;
	pDriverobject->MajorFunction[IRP_MJ_CREATE]?=?DriverDefaultHandle;
	pDriverobject->MajorFunction[IRP_MJ_CLOSE]?=?DriverDefaultHandle;
	pDriverobject->MajorFunction[IRP_MJ_DEVICE_CONTROL]?=?DriverControlHandle;

	status?=?CreateDevice（pDriverobject）;

	//?IRP?操作文件測試
	MyIrpFileTest（）;

	DbgPrint（“Leave?DriverEntry\n“）;
	return?status;
}


VOID?DriverUnload（PDRIVER_object?pDriverobject）
{
	DbgPrint（“Enter?DriverUnload\n“）;

	if?（pDriverobject->Deviceobject）
	{
		IoDeleteDevice（pDriverobject->Deviceobject）;
	}
	UNICODE_STRING?ustrSymName;
	RtlInitUnicodeString（&ustrSymName?SYM_NAME）;
	IoDeleteSymboliclink（&ustrSymName）;

	DbgPrint（“Leave?DriverUnload\n“）;
}


NTSTATUS?DriverDefaultHandle（PDEVICE_object?pDevObj?PIRP?pIrp）
{
	DbgPrint（“Enter?DriverDefaultHandle\n“）;
	NTSTATUS?status?=?STATUS_SUCCESS;

	pIrp->IoStatus.Status?=?status;
	pIrp->IoStatus.Information?=?0;
	IoCompleteRequest（pIrp?IO_NO_INCREMENT）;

	DbgPrint（“Leave?DriverDefaultHandle\n“）;
	return?status;
}


NTSTATUS?DriverControlHandle（PDEVICE_object?pDevObj?PIRP?pIrp）
{
	DbgPrint（“Enter?DriverControlHandle\n“）;
	NTSTATUS?status?=?STATUS_SUCCESS;
	PIO_STACK_LOCATION?pIoStackLocation?=?IoGetCurrentIrpStackLocation（pIrp）;
	ULONG?ulInputLen?=?pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
	ULONG?ulOutputLen?=?pIoStackLocation->Parameters.DeviceIoControl.OutputBufferLength;
	ULONG?ulControlCode?=?pIoStackLocation->Parameters.DeviceIoControl.IoControlCode;
	PVOID?pBuffer?=?pIrp->AssociatedIrp.SystemBuffer;
	ULONG?ulInfo?=?0;

	switch?（ulControlCode）
	{
	case?IOCTL_TEST:
	{
		break;
	}
	default:
		break;
	}

	pIrp->IoStatus.Status?=?status;
	pIrp->IoStatus.Information?=?ulInfo;
	IoCompleteRequest（pIrp?IO_NO_INCREMENT）;

	DbgPrint（“Leave?DriverControlHandle\n“）;
	return?status;
}


NTSTATUS?CreateDevice（PDRIVER_object?pDriverobject）
{
	DbgPrint（“Enter?CreateDevice\n“）;
	NTSTATUS?status?=?STATUS_SUCCESS;
	PDEVICE_object?pDevObj?=?NULL;
	UNICODE_STRING?ustrDevName?ustrSymName;
	RtlInitUnicodeString（&ustrDevName?DEV_NAME）;
	RtlInitUnicodeString（&ustrSymName?SYM_NAME）;

	status?=?IoCreateDevice（pDriverobject?0?&ustrDevName?FILE_DEVICE_UNKNOWN?0?FALSE?&pDevObj）;
	if?（!NT_SUCCESS（status））
	{
		DbgPrint（“IoCreateDevice?Error[0x%X]\n“?status）;
		return?status;
	}

	status?=?IoCreateSymboliclink（&ustrSymName?&ustrDevName）;
	if?（!NT_SUCCESS（status））
	{
		DbgPrint（“IoCreateSymboliclink?Error[0x%X]\n“?status）;
		return?status;
	}

	DbgPrint（“Leave?CreateDevice\n“）;
	return?status;
}


//?IRP?操作文件測試
//?注意：路徑不需要加?\??\?作為前綴
VOID?MyIrpFileTest（）
{
	//?創建文件
	UNICODE_STRING?ustrCreateFile;
	RtlInitUnicodeStr

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\
?????文件????????4268??2018-04-03?10:47??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test.sln
?????文件???????34816??2018-04-05?19:58??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test.v12.suo
?????文件????????4419??2018-04-05?19:58??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\Driver.c
?????文件?????????557??2018-04-03?11:22??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\Driver.h
?????文件????????6988??2018-04-04?14:19??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\FileManage.c
?????文件?????????723??2018-04-04?14:19??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\FileManage.h
?????文件???????17469??2018-04-05?15:17??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile.c
?????文件????????2853??2018-04-04?14:19??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile.h
?????文件?????????399??2018-04-03?10:38??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile_Test.inf
?????文件???????13123??2018-04-03?11:21??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile_Test.vcxproj
?????文件????????1754??2018-04-03?11:21??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile_Test.vcxproj.filters
?????文件????????2456??2018-04-03?22:53??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\IrpFile_Test\IrpFile_Test.vcxproj.user
?????目錄???????????0??2018-11-26?10:12??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\Win7Debug\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\x64\
?????目錄???????????0??2018-11-26?10:12??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之IRP\IrpFile_Test\x64\Win8.1Debug\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\Debug\
?????文件??????557056??2017-09-18?16:05??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\Debug\NTFS_FileLocation_Test.exe
?????目錄???????????0??2018-11-08?08:52??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test\
?????文件????????1012??2017-09-18?15:51??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test.sln
?????文件???????24576??2017-09-18?16:40??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test.v12.suo
?????文件???????14393??2017-09-18?16:08??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test\NtfsFileLocation.cpp
?????文件????????1155??2017-09-18?16:04??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test\NtfsFileLocation.h
?????文件????????1309??2017-09-18?15:59??WINDOWS黑客編程技術詳解-配套代碼\內核層\2\文件管理之NTFS解析\NTFS_FileLocation_Test\NTFS_FileLocation_Test\NTFS_FileLocation_Test.cpp
............此處省略1593個文件信息