參考資訊:
https://wasm.in/
http://four-f.narod.ru/
https://github.com/steward-fu/ddk
main.pas
unit main; interface uses DDDK; const DEV_NAME = '\Device\MyDriver'; SYM_NAME = '\DosDevices\MyDriver'; function _DriverEntry(pMyDriver : PDRIVER_OBJECT; pMyRegistry : PUNICODE_STRING) : NTSTATUS; stdcall; implementation var pNextDevice : PDEVICE_OBJECT; szBuf : array[0..255] of char; procedure Unload(pMyDriver : PDRIVER_OBJECT); stdcall; begin end; function IrpFile(pMyDevice : PDEVICE_OBJECT; pIrp : PIRP) : NTSTATUS; stdcall; var dwLen : ULONG; pStack : PIO_STACK_LOCATION; begin dwLen := 0; pStack := IoGetCurrentIrpStackLocation(pIrp); case pStack^.MajorFunction of IRP_MJ_CREATE: DbgPrint('IRP_MJ_CREATE', []); IRP_MJ_READ: begin DbgPrint('IRP_MJ_READ', []); dwLen := strlen(@szBuf[0]); memcpy(MmGetSystemAddressForMdlSafe(pIrp^.MdlAddress, LowPagePriority), @szBuf[0], dwLen); end; IRP_MJ_WRITE: begin DbgPrint('IRP_MJ_WRITE', []); dwLen := MmGetMdlByteCount(pIrp^.MdlAddress); memcpy(@szBuf[0], MmGetSystemAddressForMdlSafe(pIrp^.MdlAddress, LowPagePriority), dwLen); DbgPrint('Buffer: %s, Length: %d', [szBuf, dwLen]); end; IRP_MJ_CLOSE: DbgPrint('IRP_MJ_CLOSE', []); end; Result := STATUS_SUCCESS; pIrp^.IoStatus.Status := Result; pIrp^.IoStatus.Information := dwLen; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; function IrpPnp(pMyDevice : PDEVICE_OBJECT; pIrp : PIRP) : NTSTATUS; stdcall; var pStack : PIO_STACK_LOCATION; suSymName : UNICODE_STRING; begin pStack := IoGetCurrentIrpStackLocation(pIrp); if pStack^.MinorFunction = IRP_MN_REMOVE_DEVICE then begin RtlInitUnicodeString(@suSymName, SYM_NAME); IoDetachDevice(pNextDevice); IoDeleteDevice(pMyDevice); IoDeleteSymbolicLink(@suSymName); IoCompleteRequest(pIrp, IO_NO_INCREMENT); Result := STATUS_SUCCESS; end else begin IoSkipCurrentIrpStackLocation(pIrp); Result := IoCallDriver(pNextDevice, pIrp); end; end; function AddDevice(pMyDriver : PDRIVER_OBJECT; pPhyDevice : PDEVICE_OBJECT) : NTSTATUS; stdcall; var suDevName : UNICODE_STRING; suSymName : UNICODE_STRING; pMyDevice : PDEVICE_OBJECT; begin RtlInitUnicodeString(@suDevName, DEV_NAME); RtlInitUnicodeString(@suSymName, SYM_NAME); IoCreateDevice(pMyDriver, 0, @suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, pMyDevice); pNextDevice := IoAttachDeviceToDeviceStack(pMyDevice, pPhyDevice); pMyDevice^.Flags := pMyDevice^.Flags or DO_DIRECT_IO; pMyDevice^.Flags := pMyDevice^.Flags and not DO_DEVICE_INITIALIZING; Result := IoCreateSymbolicLink(@suSymName, @suDevName); end; function _DriverEntry(pMyDriver : PDRIVER_OBJECT; pMyRegistry : PUNICODE_STRING) : NTSTATUS; stdcall; begin pMyDriver^.MajorFunction[IRP_MJ_PNP] := @IrpPnp; pMyDriver^.MajorFunction[IRP_MJ_CREATE] := @IrpFile; pMyDriver^.MajorFunction[IRP_MJ_READ] := @IrpFile; pMyDriver^.MajorFunction[IRP_MJ_WRITE] := @IrpFile; pMyDriver^.MajorFunction[IRP_MJ_CLOSE] := @IrpFile; pMyDriver^.DriverExtension^.AddDevice := @AddDevice; pMyDriver^.DriverUnload := @Unload; Result := STATUS_SUCCESS; end; end.
完成