驱动对象,设备对象,IRP之间的关系?
- 类似于程序,窗口,消息三者之间的关系;
- 每个驱动程序只有一个驱动对象(程序实例句柄),一个驱动对象对应若干个(大于等于1个)设备对象(窗口),每个设备对象可以处理不同的IRP(I/O请求包,I/O Request Package)
IRP栈：
IRP其实本质上是由IRP头部和IRP栈组成,一般所说的IRP只是"I/O请求包"IRP的头部,在IRP数据结构的后面还有一个IO_STACK_LOCATION结构体数组
typedef struct _IO_STACK_LOCATION {<br />
UCHAR MajorFunction;<br />
UCHAR MinorFunction;<br />
UCHAR Flags;<br />
UCHAR Control;<br />
//<br />
// The following user parameters are based on the service that is being<br />
// invoked. Drivers and file systems can determine which set to use based<br />
// on the above major and minor function codes.<br />
//<br />
union {<br />
//<br />
// System service parameters for: NtCreateFile<br />
//<br />
struct {<br />
PIO_SECURITY_CONTEXT SecurityContext;<br />
ULONG Options;<br />
USHORT POINTER_ALIGNMENT FileAttributes;<br />
USHORT ShareAccess;<br />
ULONG POINTER_ALIGNMENT EaLength;<br />
} Create;</p>
<p> //<br />
// System service parameters for: NtReadFile<br />
//<br />
struct {<br />
ULONG Length;<br />
ULONG POINTER_ALIGNMENT Key;<br />
LARGE_INTEGER ByteOffset;<br />
} Read;<br />
//<br />
// System service parameters for: NtWriteFile<br />
//<br />
struct {<br />
ULONG Length;<br />
ULONG POINTER_ALIGNMENT Key;<br />
LARGE_INTEGER ByteOffset;<br />
} Write;</p>
<p> //<br />
// System service parameters for: NtQueryInformationFile<br />
//<br />
struct {<br />
ULONG Length;<br />
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;<br />
} QueryFile;<br />
//<br />
// System service parameters for: NtSetInformationFile<br />
//<br />
struct {<br />
ULONG Length;<br />
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;<br />
PFILE_OBJECT FileObject;<br />
union {<br />
struct {<br />
BOOLEAN ReplaceIfExists;<br />
BOOLEAN AdvanceOnly;<br />
};<br />
ULONG ClusterCount;<br />
HANDLE DeleteHandle;<br />
};<br />
} SetFile;</p>
<p> //<br />
// System service parameters for: NtQueryVolumeInformationFile<br />
//<br />
struct {<br />
ULONG Length;<br />
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;<br />
} QueryVolume;</p>
<p> //<br />
// System service parameters for: NtFlushBuffersFile<br />
//<br />
// No extra user-supplied parameters.<br />
//</p>
<p> //<br />
// System service parameters for: NtDeviceIoControlFile<br />
//<br />
// Note that the user's output buffer is stored in the UserBuffer field<br />
// and the user's input buffer is stored in the SystemBuffer field.<br />
//<br />
struct {<br />
ULONG OutputBufferLength;<br />
ULONG POINTER_ALIGNMENT InputBufferLength;<br />
ULONG POINTER_ALIGNMENT IoControlCode;<br />
PVOID Type3InputBuffer;<br />
} DeviceIoControl;<br />
// end_wdm<br />
//<br />
// System service parameters for: NtQuerySecurityObject<br />
//<br />
struct {<br />
SECURITY_INFORMATION SecurityInformation;<br />
ULONG POINTER_ALIGNMENT Length;<br />
} QuerySecurity;<br />
//<br />
// System service parameters for: NtSetSecurityObject<br />
//<br />
struct {<br />
SECURITY_INFORMATION SecurityInformation;<br />
PSECURITY_DESCRIPTOR SecurityDescriptor;<br />
} SetSecurity;<br />
// begin_wdm<br />
//<br />
// Non-system service parameters.<br />
//<br />
// Parameters for MountVolume<br />
//<br />
struct {<br />
PVPB Vpb;<br />
PDEVICE_OBJECT DeviceObject;<br />
} MountVolume;<br />
//<br />
// Parameters for VerifyVolume<br />
//<br />
struct {<br />
PVPB Vpb;<br />
PDEVICE_OBJECT DeviceObject;<br />
} VerifyVolume;<br />
//<br />
// Parameters for Scsi with internal device contorl.<br />
//<br />
struct {<br />
struct _SCSI_REQUEST_BLOCK *Srb;<br />
} Scsi;</p>
<p> //<br />
// Parameters for IRP_MN_QUERY_DEVICE_RELATIONS<br />
//<br />
struct {<br />
DEVICE_RELATION_TYPE Type;<br />
} QueryDeviceRelations;<br />
//<br />
// Parameters for IRP_MN_QUERY_INTERFACE<br />
//<br />
struct {<br />
CONST GUID *InterfaceType;<br />
USHORT Size;<br />
USHORT Version;<br />
PINTERFACE Interface;<br />
PVOID InterfaceSpecificData;<br />
} QueryInterface;<br />
// end_ntifs<br />
//<br />
// Parameters for IRP_MN_QUERY_CAPABILITIES<br />
//<br />
struct {<br />
PDEVICE_CAPABILITIES Capabilities;<br />
} DeviceCapabilities;<br />
//<br />
// Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS<br />
//<br />
struct {<br />
PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;<br />
} FilterResourceRequirements;<br />
//<br />
// Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG<br />
//<br />
struct {<br />
ULONG WhichSpace;<br />
PVOID Buffer;<br />
ULONG Offset;<br />
ULONG POINTER_ALIGNMENT Length;<br />
} ReadWriteConfig;<br />
//<br />
// Parameters for IRP_MN_SET_LOCK<br />
//<br />
struct {<br />
BOOLEAN Lock;<br />
} SetLock;<br />
//<br />
// Parameters for IRP_MN_QUERY_ID<br />
//<br />
struct {<br />
BUS_QUERY_ID_TYPE IdType;<br />
} QueryId;<br />
//<br />
// Parameters for IRP_MN_QUERY_DEVICE_TEXT<br />
//<br />
struct {<br />
DEVICE_TEXT_TYPE DeviceTextType;<br />
LCID POINTER_ALIGNMENT LocaleId;<br />
} QueryDeviceText;<br />
//<br />
// Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION<br />
//<br />
struct {<br />
BOOLEAN InPath;<br />
BOOLEAN Reserved[3];<br />
DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;<br />
} UsageNotification;<br />
//<br />
// Parameters for IRP_MN_WAIT_WAKE<br />
//<br />
struct {<br />
SYSTEM_POWER_STATE PowerState;<br />
} WaitWake;<br />
//<br />
// Parameter for IRP_MN_POWER_SEQUENCE<br />
//<br />
struct {<br />
PPOWER_SEQUENCE PowerSequence;<br />
} PowerSequence;<br />
//<br />
// Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER<br />
//<br />
struct {<br />
ULONG SystemContext;<br />
POWER_STATE_TYPE POINTER_ALIGNMENT Type;<br />
POWER_STATE POINTER_ALIGNMENT State;<br />
POWER_ACTION POINTER_ALIGNMENT ShutdownType;<br />
} Power;<br />
//<br />
// Parameters for StartDevice<br />
//<br />
struct {<br />
PCM_RESOURCE_LIST AllocatedResources;<br />
PCM_RESOURCE_LIST AllocatedResourcesTranslated;<br />
} StartDevice;<br />
// begin_ntifs<br />
//<br />
// Parameters for Cleanup<br />
//<br />
// No extra parameters supplied<br />
//<br />
//<br />
// WMI Irps<br />
//<br />
struct {<br />
ULONG_PTR ProviderId;<br />
PVOID DataPath;<br />
ULONG BufferSize;<br />
PVOID Buffer;<br />
} WMI;<br />
//<br />
// Others - driver-specific<br />
//<br />
struct {<br />
PVOID Argument1;<br />
PVOID Argument2;<br />
PVOID Argument3;<br />
PVOID Argument4;<br />
} Others;<br />
} Parameters;<br />
//<br />
// Save a pointer to this device driver's device object for this request<br />
// so it can be passed to the completion routine if needed.<br />
//<br />
PDEVICE_OBJECT DeviceObject;<br />
//<br />
// The following location contains a pointer to the file object for this<br />
//<br />
PFILE_OBJECT FileObject;<br />
//<br />
// The following routine is invoked depending on the flags in the above<br />
// flags field.<br />
//<br />
PIO_COMPLETION_ROUTINE CompletionRoutine;<br />
//<br />
// The following is used to store the address of the context parameter<br />
// that should be passed to the CompletionRoutine.<br />
//<br />
PVOID Context;<br />
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;
IRP会一层一层的传递,每一层都对应着一个IO_STACK_LOCATION
- 上面那个结构体,最为重要的是一个大联合体,其中对应着不同类型IRP所携带的参数
请简述IRP与IRP栈之间的关系
- 任何内核模式程序在创建一个IRP时,同时还创建了一个与之相关联的IO_STACK_LOCATION结构数组;
- 数组中的每个堆栈单元都对应一个将处理该IRP的驱动程序,堆栈单元中包含该IRP类型代码(1)和参数信息(2)以及完成函数的地址(3)
上面一句话的总结:每个堆栈单元都对应一个驱动程序;堆栈单元中IRP包含类型、参数信息、完成函数地址.
- IO_STACK_LOCATION内有两个重要成员,他们分别是MajorFunction和MinorFunction,分别记录了IRP的主类型与子类型，通过MajorFunction可以知道是什么IRP,通过MinorFunction可以知道一些子消息.
还有一个重要的联合体,根据不同的IRP,它会传递不同的消息.
IRP的处理:
- 驱动中的请求处理都是通过I/O请求包(IRP)与派遣函数完成的
- 当我们在用户层调用CreateFile,ReadFile,CloseHandle等系统API的时候,操作系统则会产生与之对应的IRP_MJ_CREATE,IRP_MJ_READ,IRP_MJ_CLOSE,并发送到相应的设备
-
Windows中的设备有：
image.png
MDL(内存描述表)
- 内存描述符表(Memory Descriptor List)是Windows未公开的一个结构,可以通过Windows提供的函数使用此结构将内存重新映射,并指定我们自己的内存属性.
小结:MDL功能->将内存重新映射,并指定我们自己的内存属性.
- 当需要对其他模块的内存空间进行操作时,微软可以确保MDL的读写操作不会引发其他问题
设备通讯有三种方式,哪三种,有什么区别?
- 缓冲区设备读写方式:将用户态缓冲区拷贝至内核态,在内核态使用完毕之后会再拷贝至用户态
- 直接读取方式(MDL):对用户态内存地址进程重新映射,映射到内核空间
- 其他方式:取决于创建完设备对象之后,映射到内核空间
常见的IRP结构体中的字段有哪些,以及他们的作用?
PMDL MdlAddress:MDLAddress域指向一个内存描述符(MDL),描述了一个与该IO请求相关联的用户模式缓冲区;AssociateIrp:我们WDM驱动会用到AssociatedIrp.SystemBuffer,这是一个指向系统空间的缓冲区.当使用直接IO的时候,,这个缓冲区的用途由与IRP相关的Majorfunction决定;IRP_MJ_DEVICE_CONTROL或者IRP_MJ_INTERNAL_DEVICE_CONTROL这两类IRP,该缓冲区被作为DeviceConTrol函数的输入缓冲区;该缓冲区的长度由IO_STACK_LOCATION结构中的Paramters.DeviceIoControl.InputBufferLehgth成员确定.IOStatus(IO_STATUS_BLOCK):是一个仅包含两个域的结构,驱动程序在最终完成请求的时候设置这个结构(这里没有写全。。。。。。)
目前学习了IO_STACK_LOCATION中的哪些字段,有什么作用?
MajorFunction:I/O操作的类型
MinorFunction：MajorFunction的附属码
Paramters:不同MajorFunction携带的附加信息.
