DRIVER_OBJECT

DRIVER_OBJECT

(2011-08-08 10:17:43)


转载▼

标签： it

typedef struct _DRIVER_OBJECT {

CSHORT Type;

CSHORT Size;

PDEVICE_OBJECT DeviceObject; // 指向设备对象，所有的设备对象构成一个链表

ULONG Flags; // 驱动程序标志

PVOID DriverStart; // 驱动程序映像起始地址

ULONG DriverSize; // 驱动程序映像大小

PVOID DriverSection; // 指向驱动程序映像的内存区对象

PDRIVER_EXTENSION DriverExtension; // 指向驱动程序对象的扩展部分

UNICODE_STRING DriverName; // 驱动程序名称

PUNICODE_STRING HardwareDatabase; // 指向注册表中包含硬件信息的路径

PFAST_IO_DISPATCH FastIoDispatch; // 指向快速I/O的分发结构

PDRIVER_INITIALIZE DriverInit; // 驱动程序的初始化例程

PDRIVER_STARTIO DriverStartIo; // 驱动程序的启动I/O例程

PDRIVER_UNLOAD DriverUnload; // 驱动程序的卸载例程

PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];

} DRIVER_OBJECT;



DRIVER_OBJECT STRUCT ; sizeof= 0A8h

_Type SWORD ? ; 0000h (IO_TYPE_DRIVER = 4) (original field name Type)

_Size SWORD ? ; 0004h (original name Size)



; The following links all of the devices created by a single driver

; together on a list, and the Flags word provides an extensible flag

; location for driver objects.



DeviceObject PVOID ? ; 0004h PTR DEVICE_OBJECT

Flags DWORD ? ; 0008h



; The following section describes where the driver is loaded. The count

; field is used to count the number of times the driver has had its

; registered reinitialization routine invoked.



DriverStart PVOID ? ; 000Ch

DriverSize DWORD ? ; 0010h

DriverSection PVOID ? ; 0014h

DriverExtension PVOID ? ; 0018h PTR DRIVER_EXTENSION



; The driver name field is used by the error log thread

; determine the name of the driver that an I/O request is/was bound.



DriverName UNICODE_STRING <> ; 001Ch

; The following section is for registry support. Thise is a pointer

; to the path to the hardware information in the registry



HardwareDatabase PVOID ? ; 0024h PTR UNICODE_STRING



; The following section contains the optional pointer to an array of

; alternate entry points to a driver for "fast I/O" support. Fast I/O

; is performed by invoking the driver routine directly with separate

; parameters, rather than using the standard IRP call mechanism. Note

; that these functions may only be used for synchronous I/O, and when

; the file is cached.



FastIoDispatch PVOID ? ; 0028h PTR FAST_IO_DISPATCH



; The following section describes the entry points to this particular

; driver. Note that the major function dispatch table must be the last

; field in the object so that it remains extensible.



DriverInit PVOID ? ; 002Ch

DriverStartIo PVOID ? ; 0030h

DriverUnload PVOID ? ; 0034h

MajorFunction PVOID (IRP_MJ_MAXIMUM_FUNCTION + 1) dup(?) ; 0038h



DRIVER_OBJECT ENDS

PDRIVER_OBJECT typedef PTR DRIVER_OBJECT

分享：

分享到新浪Qing

0


喜欢

阅读(9)┊ 评论 (0)┊
收藏(0) ┊转载(1)

┊ 喜欢▼ ┊打印┊举报

已投稿到：	排行榜 圈子

前一篇：DEVICE_OBJECT
后一篇：__try,__except,__finally