Windows NT Driver >> Pascal >> IOCTL

METHOD_IN_DIRECT、METHOD_OUT_DIRECT

---

參考資訊：
1. Source Code
2. delphidriverdevelopmentkit

METHOD_IN_DIRECT、METHOD_OUT_DIRECT的概念就是直接Mapping User Buffer，然後驅動程式使用該Mapped的MDL(Memory Description List)操作，相較於METHOD_BUFFERED，因為不須I/O Manager更新回User Buffer>，因此，效率會比較好，而相比File的DO_DIRECT_IO，IOCTL細分成IN和OUT兩種，這是因為IOCTL有區分Input和Output Buffer的緣故，因此，會有方向性的考量，Microsoft針對這部份的描述，僅說明MDL描述會有讀>寫存取方向的區分，但是司徒實際測試，發現DeviceIoControl()的Input和Output Buffer是可以混用的，意思就是Input Buffer可以充當Input或Output Buffer使用，而Output Buffer也可以充當Input或Output Buffer使用，只要驅動程式跟User Application定義好即可，當然，METHOD_IN_DIRECT和METHOD_OUT_DIRECT也是可以混用的，關於這部份的細節，有興趣的使用者可以研讀WRK代碼，不過，深怕未知問題可能發生，建議還是依照Microsoft規定去撰寫驅動程式會比較保險。

Microsoft針對I/O部份的說明：
buffer-descriptions-for-i-o-control-codes

記憶體指標：

	Buffer	Length
Input	(Irp) AssociatedIrp.SystemBuffer	(IrpStack) Parameters.DeviceIoControl.InputBufferLength
Output	(MDL) MmGetSystemAddressForMdlSafe	(IrpStack) Parameters.DeviceIoControl.OutputBufferLength

main.pas

unit main;

interface
  uses 
    DDDK;
    
  const 
    DEV_NAME = '\Device\MyDriver';
    SYM_NAME = '\DosDevices\MyDriver';
    IOCTL_SET = $222001; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
    IOCTL_GET = $222006; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
    
  function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall;

implementation
var 
  szBuffer: array[0..255] of char;

function IrpOpen(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall;
begin
  DbgPrint('IRP_MJ_CREATE', []);
  Result:= STATUS_SUCCESS;
  pIrp^.IoStatus.Information:= 0;
  pIrp^.IoStatus.Status:= Result;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
end;

function IrpClose(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall;
begin
  DbgPrint('IRP_MJ_CLOSE', []);
  Result:= STATUS_SUCCESS;
  pIrp^.IoStatus.Information:= 0;
  pIrp^.IoStatus.Status:= Result;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
end;

function IrpIOCTL(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall;
var
  len: ULONG;
  dst: PChar;
  code: ULONG;
  psk: PIoStackLocation;

begin
  len:= 0;
  psk:= IoGetCurrentIrpStackLocation(pIrp);
  code:= psk^.Parameters.DeviceIoControl.IoControlCode;
  case code of 
  IOCTL_GET:begin
    DbgPrint('IOCTL_GET', []);
    len:= strlen(@szBuffer[0])+1;
    dst:= MmGetSystemAddressForMdlSafe(pIrp^.MdlAddress, LowPagePriority);
    memcpy(dst, @szBuffer[0], len);
  end;
  IOCTL_SET:begin
    DbgPrint('IOCTL_SET', []);
    len:= psk^.Parameters.DeviceIoControl.InputBufferLength;
    memcpy(@szBuffer[0], pIrp^.AssociatedIrp.SystemBuffer, len);
    DbgPrint('Buffer: %s, Length: %d', [szBuffer, len]);
  end;
  end;
  
  Result:= STATUS_SUCCESS;
  pIrp^.IoStatus.Information:= len;
  pIrp^.IoStatus.Status:= Result;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
end;

procedure Unload(pOurDriver:PDriverObject); stdcall;
var
  szSymName: TUnicodeString;

begin
  RtlInitUnicodeString(@szSymName, SYM_NAME);
  IoDeleteSymbolicLink(@szSymName);
  IoDeleteDevice(pOurDriver^.DeviceObject);
end;

function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall;
var
  suDevName: TUnicodeString;
  szSymName: TUnicodeString;
  pOurDevice: PDeviceObject;
  
begin
  RtlInitUnicodeString(@suDevName, DEV_NAME);
  RtlInitUnicodeString(@szSymName, SYM_NAME);
  Result:= IoCreateDevice(pOurDriver, 0, @suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, pOurDevice);

  if NT_SUCCESS(Result) then
  begin
    pOurDriver^.MajorFunction[IRP_MJ_CREATE]:= @IrpOpen;
    pOurDriver^.MajorFunction[IRP_MJ_CLOSE]  := @IrpClose;
    pOurDriver^.MajorFunction[IRP_MJ_DEVICE_CONTROL] := @IrpIOCTL;
    pOurDriver^.DriverUnload := @Unload;
    pOurDevice^.Flags:= pOurDevice^.Flags or DO_BUFFERED_IO;
    pOurDevice^.Flags:= pOurDevice^.Flags and not DO_DEVICE_INITIALIZING;
    Result:= IoCreateSymbolicLink(@szSymName, @suDevName);
  end;
end;
end.

IrpIOCTL()收到IOCTL_SET時，Driver複製User Buffer的內容到szBuffer，而收到IOCTL_GET時，將szBuffer內容又複製回User Buffer，完成暫存的功能，IoStatus.Information的數值就是OutBufferSize回傳的長度。

app.pas

program main;

{$APPTYPE CONSOLE}

uses
  Windows,
  Messages,
  SysUtils,
  Variants,
  Classes,
  Graphics,
  Controls,
  Forms,
  DIALOGS;

const
  METHOD_BUFFERED = 0;
  METHOD_IN_DIRECT = 1;
  METHOD_OUT_DIRECT = 2;
  FILE_ANY_ACCESS = 0;
  FILE_DEVICE_UNKNOWN = $22;

var
  fd: DWORD;
  ret: DWORD;
  len: DWORD;
  buf: array[0..255] of char;
  set_code: DWORD;
  get_code: DWORD;

begin
  fd:= CreateFile('\\.\MyDriver', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, Nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if (fd <> INVALID_HANDLE_VALUE) then
  begin
    StrCopy(buf, 'I am error');
    len:= strlen(buf)+1;
    set_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($800 shl 2) or (METHOD_IN_DIRECT);
    get_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($801 shl 2) or (METHOD_OUT_DIRECT);
    DeviceIoControl(fd, set_code, @buf, len, Nil, 0, ret, Nil);
    WriteLn(Output, Format('SET: %s, %d', [buf, len]));

    FillChar(buf, sizeof(buf), #0);
    DeviceIoControl(fd, get_code, Nil, 0, @buf, len, ret, Nil);
    WriteLn(Output, Format('GET: %s, %d', [buf, ret]));
    
    CloseHandle(fd);
  end else
  begin
    WriteLn(Output, 'failed to open mydriver');
  end;
end.

結果

返回上一頁