本程序来自<寒江独钓>Windows内核安全编程和<windows内核安全与驱动开发>中串口过滤一章
书中的程序绑定了串口设备0到31,而且只写了过滤发送而没有写过滤接收
程序被我修改为只过滤串口设备\Device\Serial2,而且过滤发送和接收
一般串口助手看到串口名称为COM*,但是在内核中串口设备的路径为"\Device\Serial*"
程序如下
#include "DriverEntry.h"
#define DEBUG
#ifdef DEBUG
#define __asm_3 __asm int 3
#define _asm_3 __asm int 3
#else
#define __asm_3
#define _asm_3
#endif
#endif
PDEVICE_OBJECT fltobj = NULL;
PDEVICE_OBJECT nextobj = NULL;
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath)
{
_asm_3;
NTSTATUS status = 0;
UNICODE_STRING Name;
pDriverObject->DriverUnload = DriverUnload;
for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
{
pDriverObject->MajorFunction = Device_General;
}
pDriverObject->MajorFunction[IRP_MJ_READ] = Device_Read;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = Device_Write;
pDriverObject->MajorFunction[IRP_MJ_POWER] = Device_Power;
PFILE_OBJECT fileobj = NULL;
PDEVICE_OBJECT devobj = NULL;
RtlInitUnicodeString(&Name, L"\\Device\\Serial2");
status = IoGetDeviceObjectPointer(&Name,
FILE_ALL_ACCESS,
&fileobj,
&devobj);
if (!NT_SUCCESS(status))
{
_asm_3;
return status;
}
ObDereferenceObject(fileobj);
ccpAttachDevice(
pDriverObject,
devobj,
&fltobj,
&nextobj);
return STATUS_SUCCESS;
}
NTSTATUS
ccpAttachDevice(
PDRIVER_OBJECT Driver,
PDEVICE_OBJECT oldobj,
PDEVICE_OBJECT *fltobj,
PDEVICE_OBJECT *next)
{
NTSTATUS status = 0;
PDRIVER_OBJECT topDev = NULL;
status = IoCreateDevice(
Driver,
0,
NULL,
oldobj->DeviceType,
0,
FALSE,
fltobj
);
if (!NT_SUCCESS(status))
{
fltobj = NULL;
DbgPrint("%s第%s行发生错误",__FILE__,__LINE__);
return status;
}
if (oldobj->Flags & DO_BUFFERED_IO) (*fltobj)->Flags |= DO_BUFFERED_IO;
if (oldobj->Flags & DO_DIRECT_IO) (*fltobj)->Flags |= DO_DIRECT_IO;
if (oldobj->Flags & DO_BUFFERED_IO) (*fltobj)->Flags |= DO_BUFFERED_IO;
if (oldobj->Characteristics & FILE_DEVICE_SECURE_OPEN)
(*fltobj)->Characteristics |= FILE_DEVICE_SECURE_OPEN;
(*fltobj)->Flags |= DO_POWER_PAGABLE;
status = IoAttachDeviceToDeviceStackSafe(*fltobj, oldobj, &topDev);
if ((!NT_SUCCESS(status)) || (topDev == NULL))
{
IoDeleteDevice(*fltobj);
*fltobj = NULL;
return status;
}
*next = topDev;
(*fltobj)->Flags = (*fltobj)->Flags & ~DO_DEVICE_INITIALIZING;
return status;
}
NTSTATUS Device_Read(
_In_ struct _DEVICE_OBJECT *DeviceObject,
_Inout_ struct _IRP *Irp)
{
_asm_3
PIO_STACK_LOCATION Irpsp = IoGetCurrentIrpStackLocation(Irp);
NTSTATUS stayus = Device_General(DeviceObject, Irp);
return stayus;
}
NTSTATUS Device_Write(
_In_ struct _DEVICE_OBJECT *DeviceObject,
_Inout_ struct _IRP *Irp)
{
PIO_STACK_LOCATION Irpsp = IoGetCurrentIrpStackLocation(Irp);
_asm_3
return Device_General(DeviceObject, Irp);
}
NTSTATUS Device_General(
_In_ struct _DEVICE_OBJECT *DeviceObject,
_Inout_ struct _IRP *Irp)
{
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(nextobj, Irp);
}
NTSTATUS Device_Power(
_In_ struct _DEVICE_OBJECT *DeviceObject,
_Inout_ struct _IRP *Irp)
{
PoStartNextPowerIrp(Irp);
IoSkipCurrentIrpStackLocation(Irp);
return PoCallDriver(nextobj, Irp);
}
VOID DriverUnload(PDRIVER_OBJECT driver)
{
if (nextobj != NULL)
IoDetachDevice(nextobj);
if (fltobj != NULL)
IoDeleteDevice(fltobj);
DbgPrint("%s%d卸载完毕", __FILE__, __LINE__);
}
NTSTATUS Device_Conteol(
_In_ struct _DEVICE_OBJECT *DeviceObject,
_Inout_ struct _IRP *Irp)
{
return 0;
}
200字以内,仅用于支线交流,主线讨论请采用回复功能。