entry.c

在驱动下读取SSDT的例子

//////////////////////////////////////////////////////////////////////////
// SSDTDump by 李马
// http://www.titilima.cn
//////////////////////////////////////////////////////////////////////////

#include <ntddk.h>
#include "ioctl.h"
#include "SSDTDump.h"

NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObject,
                    PUNICODE_STRING pRegistryPath );

#pragma alloc_text( INIT, DriverEntry )

NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObject,
                    PUNICODE_STRING pRegistryPath )
{
    NTSTATUS s         = STATUS_SUCCESS;
    ULONG ulIndex      = 0;
    PDEVICE_OBJECT pdo = NULL;
    UNICODE_STRING sDriverName, sDosDeviceName;

    KdPrint(( "DriverEntry called.\r\n" ));

    RtlInitUnicodeString( &sDriverName, L"\\Device\\SSDTDump" );
    RtlInitUnicodeString( &sDosDeviceName, L"\\DosDevices\\SSDTDump" );

    s = IoCreateDevice( pDriverObject, 0, &sDriverName, FILE_DRIVER_SSDTDUMP,
        FILE_DEVICE_SECURE_OPEN, FALSE, &pdo );
    if ( STATUS_SUCCESS == s )
    {
        for ( ulIndex = 0; ulIndex < IRP_MJ_MAXIMUM_FUNCTION; ++ulIndex )
        {
            pDriverObject->MajorFunction[ulIndex] = SSDT_Unimplmented;
        }
        pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]
            = SSDT_DeviceIoControl;
        pDriverObject->DriverUnload = SSDT_Unload;

        IoCreateSymbolicLink( &sDosDeviceName, &sDriverName );
    }

    return s;
}