Windows NT Driver >> C/C++ >> IOCTL
METHOD_IN_DIRECT、METHOD_OUT_DIRECT
參考資訊:
1. Source Code
METHOD_IN_DIRECT、METHOD_OUT_DIRECT的概念就是直接Mapping User Buffer,然後驅動程式使用該Mapped的MDL(Memory Description List)操作,相較於METHOD_BUFFERED,因為不須I/O Manager更新回User Buffer>,因此,效率會比較好,而相比File的DO_DIRECT_IO,IOCTL細分成IN和OUT兩種,這是因為IOCTL有區分Input和Output Buffer的緣故,因此,會有方向性的考量,Microsoft針對這部份的描述,僅說明MDL描述會有讀>寫存取方向的區分,但是司徒實際測試,發現DeviceIoControl()的Input和Output Buffer是可以混用的,意思就是Input Buffer可以充當Input或Output Buffer使用,而Output Buffer也可以充當Input或Output Buffer使用,只要驅動程式跟User Application定義好即可,當然,METHOD_IN_DIRECT和METHOD_OUT_DIRECT也是可以混用的,關於這部份的細節,有興趣的使用者可以研讀WRK代碼,不過,深怕未知問題可能發生,建議還是依照Microsoft規定去撰寫驅動程式會比較保險。
Microsoft針對I/O部份的說明:
buffer-descriptions-for-i-o-control-codes
記憶體指標:
Buffer | Length | |
---|---|---|
Input | (Irp) AssociatedIrp.SystemBuffer |
(IrpStack) Parameters.DeviceIoControl.InputBufferLength |
Output | (MDL) MmGetSystemAddressForMdlSafe |
(IrpStack) Parameters.DeviceIoControl.OutputBufferLength |
main.c
#include <wdm.h> #define IOCTL_SET CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_ANY_ACCESS) #define IOCTL_GET CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_OUT_DIRECT, FILE_ANY_ACCESS) #define DEV_NAME L"\\Device\\MyDriver" #define SYM_NAME L"\\DosDevices\\MyDriver" char szBuffer[255]={0}; void Unload(PDRIVER_OBJECT pOurDriver) { UNICODE_STRING usSymboName; RtlInitUnicodeString(&usSymboName, L"\\DosDevices\\MyDriver"); IoDeleteSymbolicLink(&usSymboName); IoDeleteDevice(pOurDriver->DeviceObject); } NTSTATUS IrpIOCTL(PDEVICE_OBJECT pOurDevice, PIRP pIrp) { ULONG Len=0; PUCHAR pBuf; PIO_STACK_LOCATION psk = IoGetCurrentIrpStackLocation(pIrp); switch(psk->Parameters.DeviceIoControl.IoControlCode){ case IOCTL_SET: DbgPrint("IOCTL_SET"); Len = psk->Parameters.DeviceIoControl.InputBufferLength; memcpy(szBuffer, pIrp->AssociatedIrp.SystemBuffer, Len); DbgPrint("Buffer: %s, Length: %d", szBuffer, Len); break; case IOCTL_GET: DbgPrint("IOCTL_GET"); pBuf = MmGetSystemAddressForMdlSafe(pIrp->MdlAddress, LowPagePriority); Len = strlen(szBuffer)+1; memcpy(pBuf, szBuffer, Len); break; } pIrp->IoStatus.Status = STATUS_SUCCESS; pIrp->IoStatus.Information = Len; IoCompleteRequest(pIrp, IO_NO_INCREMENT); return STATUS_SUCCESS; } NTSTATUS IrpFile(PDEVICE_OBJECT pOurDevice, PIRP pIrp) { PIO_STACK_LOCATION psk = IoGetCurrentIrpStackLocation(pIrp); switch(psk->MajorFunction){ case IRP_MJ_CREATE: DbgPrint("IRP_MJ_CREATE"); break; case IRP_MJ_CLOSE: DbgPrint("IRP_MJ_CLOSE"); break; } IoCompleteRequest(pIrp, IO_NO_INCREMENT); return STATUS_SUCCESS; } NTSTATUS DriverEntry(PDRIVER_OBJECT pOurDriver, PUNICODE_STRING pOurRegistry) { PDEVICE_OBJECT pOurDevice=NULL; UNICODE_STRING usDeviceName; UNICODE_STRING usSymboName; pOurDriver->MajorFunction[IRP_MJ_CREATE] = pOurDriver->MajorFunction[IRP_MJ_CLOSE] = IrpFile; pOurDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IrpIOCTL; pOurDriver->DriverUnload = Unload; RtlInitUnicodeString(&usDeviceName, L"\\Device\\MyDriver"); IoCreateDevice(pOurDriver, 0, &usDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pOurDevice); RtlInitUnicodeString(&usSymboName, L"\\DosDevices\\MyDriver"); IoCreateSymbolicLink(&usSymboName, &usDeviceName); pOurDevice->Flags&= ~DO_DEVICE_INITIALIZING; pOurDevice->Flags|= DO_BUFFERED_IO; return STATUS_SUCCESS; }
IrpIOCTL()收到IOCTL_SET時,Driver複製User Buffer的內容到szBuffer,而收到IOCTL_GET時,將szBuffer內容又複製回User Buffer,完成暫存的功能,IoStatus.Information的數值就是OutBufferSize回傳的長度。
app.c
#define INITGUID #include <windows.h> #include <winioctl.h> #include <strsafe.h> #include <setupapi.h> #include <stdio.h> #include <stdlib.h> #define IOCTL_SET CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_ANY_ACCESS) #define IOCTL_GET CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_OUT_DIRECT, FILE_ANY_ACCESS) int __cdecl main(int argc, char* argv[]) { DWORD dwRet = 0; HANDLE hFile = NULL; char szBuffer[255]={"I am error"}; hFile = CreateFile("\\\\.\\MyDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (hFile == INVALID_HANDLE_VALUE) { printf("failed to open mydriver"); return 1; } printf("SET: %s, %d\n", szBuffer, strlen(szBuffer)+1); DeviceIoControl(hFile, IOCTL_SET, szBuffer, strlen(szBuffer)+1, NULL, 0, &dwRet, NULL); memset(szBuffer, 0, sizeof(szBuffer)); DeviceIoControl(hFile, IOCTL_GET, NULL, 0, szBuffer, sizeof(szBuffer), &dwRet, NULL); printf("GET: %s, %d\n", szBuffer, dwRet); CloseHandle(hFile); return 0; }
結果