#include <ntifs.h>

// 卸載驅(qū)動(dòng)執(zhí)行
VOID UnDriver(PDRIVER_OBJECT pDriver)
{
	PDEVICE_OBJECT pDev;                                        // 用來(lái)取得要?jiǎng)h除設(shè)備對(duì)象
	UNICODE_STRING SymLinkName;                                 // 局部變量symLinkName
	pDev = pDriver->DeviceObject;
	IoDeleteDevice(pDev);                                           // 調(diào)用IoDeleteDevice用于刪除設(shè)備
	RtlInitUnicodeString(&SymLinkName, L"\\??\\LySharkDriver");     // 初始化字符串將symLinkName定義成需要?jiǎng)h除的符號(hào)鏈接名稱
	IoDeleteSymbolicLink(&SymLinkName);                             // 調(diào)用IoDeleteSymbolicLink刪除符號(hào)鏈接
	DbgPrint("驅(qū)動(dòng)卸載完畢...");
}

// 創(chuàng)建設(shè)備連接
// LyShark.com
NTSTATUS CreateDriverObject(IN PDRIVER_OBJECT pDriver)
{
	NTSTATUS Status;
	PDEVICE_OBJECT pDevObj;
	UNICODE_STRING DriverName;
	UNICODE_STRING SymLinkName;

	// 創(chuàng)建設(shè)備名稱字符串
	RtlInitUnicodeString(&DriverName, L"\\Device\\LySharkDriver");
	Status = IoCreateDevice(pDriver, 0, &DriverName, FILE_DEVICE_UNKNOWN, 0, TRUE, &pDevObj);

	// 指定通信方式為緩沖區(qū)
	pDevObj->Flags |= DO_BUFFERED_IO;

	// 創(chuàng)建符號(hào)鏈接
	RtlInitUnicodeString(&SymLinkName, L"\\??\\LySharkDriver");
	Status = IoCreateSymbolicLink(&SymLinkName, &DriverName);
	return STATUS_SUCCESS;
}

// 創(chuàng)建回調(diào)函數(shù)
NTSTATUS DispatchCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;          // 返回成功
	DbgPrint("派遣函數(shù) IRP_MJ_CREATE 執(zhí)行 \n");
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);        // 指示完成此IRP
	return STATUS_SUCCESS;                           // 返回成功
}

// 關(guān)閉回調(diào)函數(shù)
NTSTATUS DispatchClose(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	pIrp->IoStatus.Status = STATUS_SUCCESS;          // 返回成功
	DbgPrint("派遣函數(shù) IRP_MJ_CLOSE 執(zhí)行 \n");
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);        // 指示完成此IRP
	return STATUS_SUCCESS;                           // 返回成功
}

// 默認(rèn)派遣函數(shù)
NTSTATUS DriverDefaultHandle(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	NTSTATUS status = STATUS_SUCCESS;
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return status;
}

// 入口函數(shù)
// By: LyShark
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	// 調(diào)用創(chuàng)建設(shè)備
	CreateDriverObject(pDriver);

	pDriver->DriverUnload = UnDriver;                          // 卸載函數(shù)
	pDriver->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;    // 創(chuàng)建派遣函數(shù)
	pDriver->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;      // 關(guān)閉派遣函數(shù)

	// 初始化其他派遣
	for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		DbgPrint("初始化派遣: %d \n", i);
		pDriver->MajorFunction[i] = DriverDefaultHandle;
	}

	DbgPrint("驅(qū)動(dòng)加載完成...");

	return STATUS_SUCCESS;
}

// 入口函數(shù)
// By: LyShark
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	// 調(diào)用創(chuàng)建設(shè)備
	CreateDriverObject(pDriver);

	// 初始化其他派遣
	for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		DbgPrint("初始化派遣: %d \n", i);
		pDriver->MajorFunction[i] = DriverDefaultHandle;
	}

	pDriver->DriverUnload = UnDriver;                          // 卸載函數(shù)
	pDriver->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;    // 創(chuàng)建派遣函數(shù)
	pDriver->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;      // 關(guān)閉派遣函數(shù)

	// 增加派遣處理
	pDriver->MajorFunction[IRP_MJ_READ] = DispatchRead;        // 讀取派遣函數(shù)
	pDriver->MajorFunction[IRP_MJ_WRITE] = DispatchWrite;      // 寫入派遣函數(shù)

	DbgPrint("驅(qū)動(dòng)加載完成...");

	return STATUS_SUCCESS;
}

// 讀取回調(diào)函數(shù)
NTSTATUS DispatchRead(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	NTSTATUS Status = STATUS_SUCCESS;
	PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(pIrp);
	ULONG ulReadLength = Stack->Parameters.Read.Length;

	char szBuf[128] = "hello lyshark";

	pIrp->IoStatus.Status = Status;
	pIrp->IoStatus.Information = ulReadLength;
	DbgPrint("讀取長(zhǎng)度：%d \n", ulReadLength);

	// 取出字符串前5個(gè)字節(jié)返回給R3層
	memcpy(pIrp->AssociatedIrp.SystemBuffer, szBuf, ulReadLength);

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return Status;
}

// 接收傳入回調(diào)函數(shù)
// By: LyShark
NTSTATUS DispatchWrite(struct _DEVICE_OBJECT *DeviceObject, struct _IRP *Irp)
{
	NTSTATUS Status = STATUS_SUCCESS;
	PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp);
	ULONG ulWriteLength = Stack->Parameters.Write.Length;
	PVOID ulWriteData = Irp->AssociatedIrp.SystemBuffer;

	// 輸出傳入字符串
	DbgPrint("傳入長(zhǎng)度: %d 傳入數(shù)據(jù): %s \n", ulWriteLength, ulWriteData);

	IoCompleteRequest(Irp, IO_NO_INCREMENT);
	return Status;
}

#include <iostream>
#include <Windows.h>
#include <winioctl.h>

int main(int argc, char *argv[])
{
  HANDLE hDevice = CreateFileA("\\\\.\\LySharkDriver", GENERIC_READ | GENERIC_WRITE, 0,
    NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  if (hDevice == INVALID_HANDLE_VALUE)
  {
    CloseHandle(hDevice);
    return 0;
  }

  // 從內(nèi)核讀取數(shù)據(jù)到本地
  char buffer[128] = { 0 };
  ULONG length;

  // 讀入到buffer長(zhǎng)度為5
  // By:lyshark.com
  ReadFile(hDevice, buffer, 5, &length, 0);
  for (int i = 0; i < (int)length; i++)
  {
    printf("讀取字節(jié): %c", buffer[i]);
  }

  // 寫入數(shù)據(jù)到內(nèi)核
  char write_buffer[128] = "hello lyshark";
  ULONG write_length;
  WriteFile(hDevice, write_buffer, strlen(write_buffer), &write_length, 0);

  system("pause");
  CloseHandle(hDevice);
  return 0;
}