Hardware & Devices

#include "ntddk.h"

VOID DriverUnload(PDRIVER_OBJECT driver) //  提供一个Unload 函数只是为了让这个程序能动态卸载，方便调试。 
{ 
	DbgPrint("first: ===Our driver is unloading…"); //  但是实际上我们什么都不做，只打印一句话: 
} 


NTSTATUS DriverEntry(
	IN PDRIVER_OBJECT driver, 
	IN PUNICODE_STRING reg_path
	) // DriverEntry，入口函数。相当于 main。
{ 
	DbgPrint("first:===Hello, my salary!"); 
	driver->DriverUnload = DriverUnload;  //  设置一个卸载函数便于这个函数能退出。 
	return STATUS_SUCCESS; 
} 

//
// drMain.h
//
#ifndef _DRMAIN_H_
#define _DRMAIN_H_
NTSTATUS DriverEntry(
	PDRIVER_OBJECT DriverObject,
	PUNICODE_STRING RegistryPath
	);

NTSTATUS MyDriverUnload(PDRIVER_OBJECT DriverObject);

FLT_PREOP_CALLBACK_STATUS DriverPreCreate(
	PFLT_CALLBACK_DATA data,
	PCFLT_RELATED_OBJECTS FltObjects,
	PVOID *CompletionContext
	);

FLT_POSTOP_CALLBACK_STATUS DriverPostCreate(
	PFLT_CALLBACK_DATA data,
	PCFLT_RELATED_OBJECTS FltObjects,
	PVOID *CompletionContext,
	FLT_POST_OPERATION_FLAGS flags
	);
#endif //_DRMAIN_H_

//
// drMain.c
//
#include"Fltkernel.h"
#include"drMain.h"

//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>CallBacks
CONST FLT_OPERATION_REGISTRATION CallBacks[]={
	{
		IRP_MJ_CREATE,
			0,
			(PFLT_PRE_OPERATION_CALLBACK)DriverPreCreate,
			(PFLT_POST_OPERATION_CALLBACK)DriverPostCreate
	},
	
	{ IRP_MJ_OPERATION_END}
};
//<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<




//-------------------------------------------------
CONST FLT_REGISTRATION FilterRegistration ={
	sizeof(FLT_REGISTRATION),
	FLT_REGISTRATION_VERSION,
	0,
	NULL,
	CallBacks,
	(PFLT_FILTER_UNLOAD_CALLBACK)MyDriverUnload,
	NULL,
	NULL,
	NULL,
	NULL,
	NULL,
	NULL,
	NULL
};
//-------------------------------------------------
NTSTATUS status;
UNICODE_STRING string;
PFLT_FILTER theFilter;
//=================================================


NTSTATUS DriverEntry(
	PDRIVER_OBJECT DriverObject,
	PUNICODE_STRING RegistryPath
	)
{

	UNREFERENCED_PARAMETER(RegistryPath);
	DbgPrint("FIRST==driver begin!");

	//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>RegisterFilter
	status= FltRegisterFilter(
		DriverObject,
		&FilterRegistration,
		&theFilter
		);
	DbgPrint("FIRST==FltRegisterFilter begin!");

	ASSERT(status);

	if (NT_SUCCESS( status )) {

			DbgPrint("FIRST==SomeThing wrong happend before FltStartFiltering!");
		status=FltStartFiltering(theFilter);
		if(!NT_SUCCESS( status ))
		{
			DbgPrint("FIRST==SomeThing wrong happend after FltStartFiltering!");
			FltUnregisterFilter(theFilter);
		}

	}  
	//<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

	return status;
}

NTSTATUS MyDriverUnload(PDRIVER_OBJECT DriverObject)
{

	PAGED_CODE();
	UNREFERENCED_PARAMETER(DriverObject);

	FltUnregisterFilter(theFilter);

	return STATUS_SUCCESS;

}
FLT_PREOP_CALLBACK_STATUS DriverPreCreate(
	PFLT_CALLBACK_DATA data,
	PCFLT_RELATED_OBJECTS FltObjects,
	PVOID *CompletionContext
	)
{
	DbgPrint("FIRST==DriverPreCreate dealing!");
	return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}
FLT_POSTOP_CALLBACK_STATUS DriverPostCreate(
	PFLT_CALLBACK_DATA data,
	PCFLT_RELATED_OBJECTS FltObjects,
	PVOID *CompletionContext,
	FLT_POST_OPERATION_FLAGS flags
	)
{

	DbgPrint("FIRST==DriverPostCreate dealing!");
	return FLT_POSTOP_FINISHED_PROCESSING;
}