Windows NT Driver >> Assembly
Thread
參考資訊：
1. Four-F
2. Source Code
3. operating-system-ch4-multithread
4. user-level-threads-and-kernel-level-threads
Thread是一個最小的執行單位，一個Process可以產生多個Thread，在多核CPU上，產生的Thread可以同時的運作，這意謂著使用Thread技術可以用來改善效能，但是，每個Thread間的資料同步則是另一個課題，在此練習，司徒著重在教導使用者如何撰寫一個最基本的Thread，了解其架構後，使用者可以再更深入了解Thread需要面對的其它問題，而值得注意的是，Thread有區分User Thread和System Thread兩種，各有優缺點，細節可以參考如上的參考資訊。
main.asm
.386p
.model flat, stdcall
option casemap:none
include c:\masm32\include\w2k\ntstatus.inc
include c:\masm32\include\w2k\ntddk.inc
include c:\masm32\include\w2k\ntoskrnl.inc
include c:\masm32\include\w2k\ntddkbd.inc
include c:\masm32\Macros\Strings.mac
includelib c:\masm32\lib\wxp\i386\ntoskrnl.lib
public DriverEntry
OurDeviceExtension struct
bExit DWORD ?
pNextDev PDEVICE_OBJECT ?
pThread PVOID ?
OurDeviceExtension ends
IOCTL_START equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_STOP equ CTL_CODE(FILE_DEVICE_UNKNOWN, 801h, METHOD_BUFFERED, FILE_ANY_ACCESS)
.const
DEV_NAME word "\","D","e","v","i","c","e","\","M","y","D","r","i","v","e","r",0
SYM_NAME word "\","D","o","s","D","e","v","i","c","e","s","\","M","y","D","r","i","v","e","r",0
MSG_START byte "IOCTL_START",0
MSG_STOP byte "IOCTL_STOP",0
.code
MyThread proc pParam:DWORD
local pdx:DWORD
local pStr:DWORD
local stTime:LARGE_INTEGER
or stTime.HighPart, -1
mov stTime.LowPart, -10000000
invoke IoGetCurrentProcess
add eax, 174h
mov pStr, eax
invoke DbgPrint, $CTA0("Current process: %s"), pStr
mov eax, pParam
mov eax, (DEVICE_OBJECT PTR [eax]).DeviceExtension
push eax
pop pdx
mov eax, (OurDeviceExtension PTR [eax]).bExit
.while(eax != TRUE)
invoke KeDelayExecutionThread, KernelMode, FALSE, addr stTime
invoke DbgPrint, $CTA0("Sleep 1s")
mov eax, pdx
mov eax, (OurDeviceExtension PTR [eax]).bExit
.endw
invoke DbgPrint, $CTA0("Exit MyThread")
invoke PsTerminateSystemThread, STATUS_SUCCESS
ret
MyThread endp
IrpOpenClose proc pOurDevice:PDEVICE_OBJECT, pIrp:PIRP
IoGetCurrentIrpStackLocation pIrp
movzx eax, (IO_STACK_LOCATION PTR [eax]).MajorFunction
.if eax == IRP_MJ_CREATE
invoke DbgPrint, $CTA0("IRP_MJ_CREATE")
.elseif eax == IRP_MJ_CLOSE
invoke DbgPrint, $CTA0("IRP_MJ_CLOSE")
.endif
mov eax, pIrp
and (_IRP PTR [eax]).IoStatus.Information, 0
mov (_IRP PTR [eax]).IoStatus.Status, STATUS_SUCCESS
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
mov eax, STATUS_SUCCESS
ret
IrpOpenClose endp
IrpIOCTL proc pOurDevice:PDEVICE_OBJECT, pIrp:PIRP
local pdx:PTR OurDeviceExtension
local pBuf:DWORD
local hThread:DWORD
local pThread:PVOID
mov eax, pOurDevice
push (DEVICE_OBJECT PTR [eax]).DeviceExtension
pop pdx
IoGetCurrentIrpStackLocation pIrp
mov eax, (IO_STACK_LOCATION PTR [eax]).Parameters.DeviceIoControl.IoControlCode
.if eax == IOCTL_START
invoke DbgPrint, offset MSG_START
mov eax, pdx
and (OurDeviceExtension PTR [eax]).bExit, 0
; user thread
invoke PsCreateSystemThread, addr hThread, THREAD_ALL_ACCESS, NULL, -1, NULL, offset MyThread, pOurDevice
; system thread
;invoke PsCreateSystemThread, addr hThread, THREAD_ALL_ACCESS, NULL, NULL, NULL, offset MyThread, pOurDevice
.if eax == STATUS_SUCCESS
mov eax, pdx
invoke ObReferenceObjectByHandle, hThread, THREAD_ALL_ACCESS, NULL, KernelMode, addr (OurDeviceExtension PTR [ebx]).pThread, NULL
invoke ZwClose, hThread
.endif
.elseif eax == IOCTL_STOP
invoke DbgPrint, offset MSG_STOP
mov eax, pdx
mov (OurDeviceExtension PTR [eax]).bExit, TRUE
push (OurDeviceExtension PTR [eax]).pThread
pop pThread
mov eax, pThread
.if eax != NULL
invoke KeWaitForSingleObject, pThread, Executive, KernelMode, FALSE, NULL
invoke ObDereferenceObject, pThread
.endif
.endif
mov eax, pIrp
mov (_IRP PTR [eax]).IoStatus.Status, STATUS_SUCCESS
and (_IRP PTR [eax]).IoStatus.Information, 0
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
mov eax, STATUS_SUCCESS
ret
IrpIOCTL endp
Unload proc pOurDriver:PDRIVER_OBJECT
local szSymName:UNICODE_STRING
invoke RtlInitUnicodeString, addr szSymName, offset SYM_NAME
invoke IoDeleteSymbolicLink, addr szSymName
mov eax, pOurDriver
invoke IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject
ret
Unload endp
DriverEntry proc pOurDriver:PDRIVER_OBJECT, pOurRegistry:PUNICODE_STRING
local pOurDevice:PDEVICE_OBJECT
local suDevName:UNICODE_STRING
local szSymName:UNICODE_STRING
mov eax, pOurDriver
mov (DRIVER_OBJECT PTR [eax]).MajorFunction[IRP_MJ_CREATE * (sizeof PVOID)], offset IrpOpenClose
mov (DRIVER_OBJECT PTR [eax]).MajorFunction[IRP_MJ_CLOSE * (sizeof PVOID)], offset IrpOpenClose
mov (DRIVER_OBJECT PTR [eax]).MajorFunction[IRP_MJ_DEVICE_CONTROL * (sizeof PVOID)], offset IrpIOCTL
mov (DRIVER_OBJECT PTR [eax]).DriverUnload, offset Unload
invoke RtlInitUnicodeString, addr suDevName, offset DEV_NAME
invoke RtlInitUnicodeString, addr szSymName, offset SYM_NAME
invoke IoCreateDevice, pOurDriver, sizeof OurDeviceExtension, addr suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, addr pOurDevice
.if eax == STATUS_SUCCESS
mov eax, pOurDevice
or (DEVICE_OBJECT PTR [eax]).Flags, DO_BUFFERED_IO
and (DEVICE_OBJECT PTR [eax]).Flags, not DO_DEVICE_INITIALIZING
invoke IoCreateSymbolicLink, addr szSymName, addr suDevName
.endif
ret
DriverEntry endp
end DriverEntry
.end
IrpIOCTL收到IOCTL_START後，產生一個新的Thread(注意有User和System區分)，接著呼叫ZwClose()，值得注意的是，這個ZwClose()僅是釋放Handle的資源，實際Thread並不會被關閉，原因在於提前做ObReferenceObjectByHandle()，而當收到IOCTL_STOP，則設定bExit並等待Thread結束，最後呼叫ObDereferenceObject()釋放Object資源。
app.asm
.386p
.model flat, stdcall
option casemap:none
include c:\masm32\include\windows.inc
include c:\masm32\include\masm32.inc
include c:\masm32\include\user32.inc
include c:\masm32\include\msvcrt.inc
include c:\masm32\include\kernel32.inc
include c:\masm32\include\w2k\ntddkbd.inc
include c:\masm32\Macros\Strings.mac
includelib c:\masm32\lib\user32.lib
includelib c:\masm32\lib\masm32.lib
includelib c:\masm32\lib\msvcrt.lib
includelib c:\masm32\lib\kernel32.lib
IOCTL_START equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_ANY_ACCESS)
IOCTL_STOP equ CTL_CODE(FILE_DEVICE_UNKNOWN, 801h, METHOD_BUFFERED, FILE_ANY_ACCESS)
.const
DEV_NAME db "\\.\MyDriver",0
.data?
hFile dd ?
dwRet dd ?
.code
start:
invoke CreateFile, offset DEV_NAME, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
.if eax == INVALID_HANDLE_VALUE
invoke crt_printf, $CTA0("failed to open mydriver")
invoke ExitProcess, -1
.endif
mov hFile, eax
invoke DeviceIoControl, hFile, IOCTL_START, NULL, 0, NULL, 0, offset dwRet, NULL
invoke Sleep, 3000
invoke DeviceIoControl, hFile, IOCTL_STOP, NULL, 0, NULL, 0, offset dwRet, NULL
invoke CloseHandle, hFile
invoke ExitProcess, 0
end start
結果
