hello.c

驱动程序开发的简单例子：在debugview下查看调试信息可以看到程序输出的hello 字符串。

#include "ntddk.h"

UNICODE_STRING usLinkDeviceNameString;

VOID UnloadDriver(IN PDRIVER_OBJECT pDriverObject)
{
	PDEVICE_OBJECT pDeviceObject;
	pDeviceObject= pDriverObject->DeviceObject;
	IoDeleteSymbolicLink(&usLinkDeviceNameString);
	ASSERT(!pDeviceObject->AttachedDevice);
	if ( pDeviceObject != NULL )
	{
		IoDeleteDevice(pDeviceObject);
	}
}

NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING theRegistryPath )
{
	NTSTATUS ntStatus=1;
	PDEVICE_OBJECT pDeviceObject;
	UNICODE_STRING usDeviceNameString;
	RtlInitUnicodeString(&usDeviceNameString, L"\\Device\\SSDTHOOK" );
	RtlInitUnicodeString(&usLinkDeviceNameString, L"\\DosDevices\\SSDTHOOK" );
	ntStatus = IoCreateDevice(
				 pDriverObject,
				 0,
				 &usDeviceNameString,
				 FILE_DEVICE_DISK_FILE_SYSTEM,
				 FILE_DEVICE_SECURE_OPEN,
				 FALSE,
				 &pDeviceObject);
	if (!NT_SUCCESS(ntStatus))
	{
		return ntStatus;
	}
	ntStatus = IoCreateSymbolicLink(&usLinkDeviceNameString,&usDeviceNameString);
	if (!NT_SUCCESS(ntStatus))
	{
		IoDeleteDevice(pDeviceObject);
		return ntStatus;
	}
	pDriverObject->DriverUnload=UnloadDriver;

	DbgPrint("Hello, world!\n");

	return ntStatus;
}