wdm.h

将exe等可执行文件转化成c程序的反编译程序,先到汇编再到c

    BOOLEAN AtDiskPrimaryAddressClaimed;    // 0x1F0 - 0x1FF
    BOOLEAN AtDiskSecondaryAddressClaimed;  // 0x170 - 0x17F

    //
    // Indicates the structure version, as anything value belong this will have been added.
    // Use the structure size as the version.
    //

    ULONG Version;

    //
    // Indicates the total number of medium changer devices in the system.
    // This field will be updated by the drivers as it determines that
    // new devices have been found and will be supported.
    //

    ULONG MediumChangerCount;

} CONFIGURATION_INFORMATION, *PCONFIGURATION_INFORMATION;

PCONFIGURATION_INFORMATION __stdcall IoGetConfigurationInformation();



NTSTATUS __stdcall PoCallDriver ( PDEVICE_OBJECT DeviceObject, PIRP Irp);

void __stdcall PoStartNextPowerIrp( PIRP    Irp);

PDEVICE_OBJECT __stdcall IoAttachDeviceToDeviceStack( PDEVICE_OBJECT SourceDevice, PDEVICE_OBJECT TargetDevice);

void __stdcall IoInitializeRemoveLockEx( PIO_REMOVE_LOCK Lock, ULONG AllocateTag, ULONG MaxLockedMinutes, ULONG HighWatermark, ULONG RemlockSize );

UCHAR __stdcall READ_REGISTER_UCHAR(PUCHAR  Register);

USHORT __stdcall READ_REGISTER_USHORT(PUSHORT Register);

ULONG __stdcall READ_REGISTER_ULONG(PULONG  Register);

void __stdcall WRITE_REGISTER_UCHAR(PUCHAR  Register,UCHAR   Value);

void __stdcall WRITE_REGISTER_USHORT(PUSHORT Register,USHORT  Value);

void __stdcall WRITE_REGISTER_ULONG(PULONG  Register,ULONG   Value);

void __stdcall WRITE_PORT_UCHAR(PUCHAR  Port,UCHAR   Value);

void __stdcall WRITE_PORT_USHORT(PUSHORT Port,USHORT  Value);

void __stdcall WRITE_PORT_ULONG(PULONG  Port,ULONG   Value);

UCHAR __stdcall READ_PORT_UCHAR(PUCHAR  Port);

USHORT __stdcall READ_PORT_USHORT(PUSHORT Port);

ULONG __stdcall READ_PORT_ULONG(PULONG  Port);

enum MEMORY_CACHING_TYPE {
    MmNonCached = 0,
    MmCached = 1,
    MmWriteCombined = MmFrameBufferCached,
    MmHardwareCoherentCached,
    MmCachingTypeDoNotUse1,
    MmCachingTypeDoNotUse2,
    MmMaximumCacheType
};

//#define PHYSICAL_ADDRESS LARGE_INTEGER
//PVOID __stdcall MmMapIoSpace (PHYSICAL_ADDRESS PhysicalAddress, SIZE_T NumberOfBytes, MEMORY_CACHING_TYPE CacheType);
PVOID __stdcall MmMapIoSpace (LARGE_INTEGER PhysicalAddress, SIZE_T NumberOfBytes, MEMORY_CACHING_TYPE CacheType);


NTSTATUS
__stdcall
DriverEntry(
    IN PDRIVER_OBJECT  DriverObject,
    IN PUNICODE_STRING RegistryPath
    );

ULONG __cdecl DbgPrint(char * Format, ...);

void __stdcall ObOpenObjectByPointer(DWORD d1,DWORD d2,DWORD d3,DWORD d4,DWORD d5,DWORD d6,DWORD d7);

long __fastcall InterlockedExchange(PLONG Target,LONG Value);


typedef struct _SECURITY_QUALITY_OF_SERVICE *PSECURITY_QUALITY_OF_SERVICE;
typedef struct _ACCESS_STATE *PACCESS_STATE;

typedef struct _IO_SECURITY_CONTEXT {
    PSECURITY_QUALITY_OF_SERVICE SecurityQos;
    PACCESS_STATE AccessState;
    ACCESS_MASK DesiredAccess;
    ULONG FullCreateOptions;
} IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;

enum FILE_INFORMATION_CLASS {
    FileBasicInformation = 4,
    FileStandardInformation = 5,
    FilePositionInformation = 14,
    FileEndOfFileInformation = 20,
} ;
enum FS_INFORMATION_CLASS {
    FileFsVolumeInformation       = 1,
    FileFsLabelInformation,      // 2
    FileFsSizeInformation,       // 3
    FileFsDeviceInformation,     // 4
    FileFsAttributeInformation,  // 5
    FileFsControlInformation,    // 6
    FileFsFullSizeInformation,   // 7
    FileFsObjectIdInformation,   // 8
    FileFsMaximumInformation
} ;

enum DEVICE_RELATION_TYPE {
    BusRelations,
    EjectionRelations,
    PowerRelations,
    RemovalRelations,
    TargetDeviceRelation
} ;
typedef VOID (__stdcall *PINTERFACE_REFERENCE)(PVOID Context);
typedef VOID (__stdcall *PINTERFACE_DEREFERENCE)(PVOID Context);

typedef struct _INTERFACE {
    USHORT Size;
    USHORT Version;
    PVOID Context;
    PINTERFACE_REFERENCE InterfaceReference;
    PINTERFACE_DEREFERENCE InterfaceDereference;
    // interface specific entries go here
} INTERFACE, *PINTERFACE;

typedef
NTSTATUS
(__stdcall *PIO_COMPLETION_ROUTINE) (
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp,
    IN PVOID Context
    );

typedef struct _GUID {
	ULONG   Data1;
	USHORT  Data2;
	USHORT  Data3;
	UCHAR   Data4[8];
} GUID;

typedef struct _IO_STACK_LOCATION {
    UCHAR MajorFunction;
    UCHAR MinorFunction;
    UCHAR Flags;
    UCHAR Control;

    //
    // The following user parameters are based on the service that is being
    // invoked.  Drivers and file systems can determine which set to use based
    // on the above major and minor function codes.
    //

    union {

        //
        // System service parameters for:  NtCreateFile
        //

        struct {
            PIO_SECURITY_CONTEXT SecurityContext;
            ULONG Options;
            USHORT  FileAttributes;
            USHORT ShareAccess;
            ULONG  EaLength;
        } Create;


        //
        // System service parameters for:  NtReadFile
        //

        struct {
            ULONG Length;
            ULONG  Key;
            LARGE_INTEGER ByteOffset;
        } Read;

        //
        // System service parameters for:  NtWriteFile
        //

        struct {
            ULONG Length;
            ULONG  Key;
            LARGE_INTEGER ByteOffset;
        } Write;


        //
        // System service parameters for:  NtQueryInformationFile
        //

        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS FileInformationClass;
        } QueryFile;

        //
        // System service parameters for:  NtSetInformationFile
        //

        struct {
            ULONG Length;
            FILE_INFORMATION_CLASS FileInformationClass;
            PFILE_OBJECT FileObject;
            union {
                struct {
                    BOOLEAN ReplaceIfExists;
                    BOOLEAN AdvanceOnly;
                };
                ULONG ClusterCount;
                HANDLE DeleteHandle;
            };
        } SetFile;


        //
        // System service parameters for:  NtQueryVolumeInformationFile
        //

        struct {
            ULONG Length;
            FS_INFORMATION_CLASS FsInformationClass;
        } QueryVolume;


        //
        // System service parameters for:  NtFlushBuffersFile
        //
        // No extra user-supplied parameters.
        //


        //
        // System service parameters for:  NtDeviceIoControlFile
        //
        // Note that the user's output buffer is stored in the UserBuffer field
        // and the user's input buffer is stored in the SystemBuffer field.
        //

        struct {
            ULONG OutputBufferLength;
            ULONG InputBufferLength;
            ULONG IoControlCode;
            PVOID Type3InputBuffer;
        } DeviceIoControl;

        //
        // Non-system service parameters.
        //
        // Parameters for MountVolume
        //

        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } MountVolume;

        //
        // Parameters for VerifyVolume
        //

        struct {
            PVOID DoNotUse1;
            PDEVICE_OBJECT DeviceObject;
        } VerifyVolume;

        //
        // Parameters for Scsi with internal device contorl.
        //

        struct {
            struct _SCSI_REQUEST_BLOCK *Srb;
        } Scsi;


        //
        // Parameters for IRP_MN_QUERY_DEVICE_RELATIONS
        //

        struct {
            DEVICE_RELATION_TYPE Type;
        } QueryDeviceRelations;

        //
        // Parameters for IRP_MN_QUERY_INTERFACE
        //

        struct {
            CONST GUID *InterfaceType;
            USHORT Size;
            USHORT Version;
            PINTERFACE Interface;
            PVOID InterfaceSpecificData;
        } QueryInterface;



        //
        // Parameters for IRP_MN_QUERY_CAPABILITIES
        //

        //struct {
        //    PDEVICE_CAPABILITIES Capabilities;
        //} DeviceCapabilities;

        //
        // Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS
        //

        //struct {
        //    PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
        //} FilterResourceRequirements;

        //
        // Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG
        //

        struct {
            ULONG WhichSpace;
            PVOID Buffer;
            ULONG Offset;
            ULONG Length;
        } ReadWriteConfig;

        //
        // Parameters for IRP_MN_SET_LOCK
        //

        struct {
            BOOLEAN Lock;
        } SetLock;

        //
        // Parameters for IRP_MN_QUERY_ID
        //

        //struct {
        //    BUS_QUERY_ID_TYPE IdType;
        //} QueryId;

        //
        // Parameters for IRP_MN_QUERY_DEVICE_TEXT
        //

        //struct {
        //    DEVICE_TEXT_TYPE DeviceTextType;
        //    LCID POINTER_ALIGNMENT LocaleId;
        //} QueryDeviceText;

        //
        // Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION
        //

        //struct {
        //    BOOLEAN InPath;
        //    BOOLEAN Reserved[3];
        //    DEVICE_USAGE_NOTIFICATION_TYPE  Type;
        //} UsageNotification;

        //
        // Parameters for IRP_MN_WAIT_WAKE
        //

        //struct {
        //    SYSTEM_POWER_STATE PowerState;
        //} WaitWake;

        //
        // Parameter for IRP_MN_POWER_SEQUENCE
        //

        //struct {
        //    PPOWER_SEQUENCE PowerSequence;
        //} PowerSequence;

        //
        // Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER
        //

        //struct {
        //    ULONG SystemContext;
        //    POWER_STATE_TYPE POINTER_ALIGNMENT Type;
        //    POWER_STATE POINTER_ALIGNMENT State;
        //    POWER_ACTION POINTER_ALIGNMENT ShutdownType;
        //} Power;

        //
        // Parameters for StartDevice
        //

        //struct {
        //    PCM_RESOURCE_LIST AllocatedResources;
        //    PCM_RESOURCE_LIST AllocatedResourcesTranslated;
        //} StartDevice;


        //
        // Parameters for Cleanup
        //
        // No extra parameters supplied
        //

        //
        // WMI Irps
        //

        //struct {
        //    ULONG_PTR ProviderId;
        //    PVOID DataPath;
        //    ULONG BufferSize;
        //    PVOID Buffer;
        //} WMI;

        //
        // Others - driver-specific
        //

        struct {
            PVOID Argument1;
            PVOID Argument2;
            PVOID Argument3;
            PVOID Argument4;
        } Others;

    } Parameters;

    //
    // Save a pointer to this device driver's device object for this request
    // so it can be passed to the completion routine if needed.
    //

    PDEVICE_OBJECT DeviceObject;

    //
    // The following location contains a pointer to the file object for this
    //

    PFILE_OBJECT FileObject;

    //
    // The following routine is invoked depending on the flags in the above
    // flags field.
    //

    PIO_COMPLETION_ROUTINE CompletionRoutine;

    //
    // The following is used to store the address of the context parameter
    // that should be passed to the CompletionRoutine.
    //

    PVOID Context;

} IO_STACK_LOCATION, *PIO_STACK_LOCATION;