我正在嘗試撰寫一個簡單的 Windows 過濾平臺內核驅動程式來添加一些過濾器。我使用了 VS2019 Kernel Driver 專案模板并添加了代碼來創建驅動程式和設備。這作業正常，我能夠看到 WPP 日志并且 devcon 狀態回傳成功。但是，只要我將任何 WFP 代碼添加到驅動程式，devcon 就會說安裝成功，但 devcon status 命令回傳 39。我在 google 中搜索，但并沒有真正想出解決方案。添加 WFP 代碼后，WPP 跟蹤似乎也不起作用。
與 WFP 相關的唯一代碼行是驅動程式卸載中的 CloseEngine 呼叫。如果我洗掉該行，驅動程式安裝成功，并且在 devcon status 命令中看不到任何錯誤。
驅動程式.c =>
/*
Module Name:
driver.c
Abstract:
This file contains the driver entry points and callbacks.
Environment:
Kernel-mode Driver Framework
--*/
#include "driver.h"
#include "driver.tmh"
#include <fwpmk.h>
PDEVICE_OBJECT gDeviceObject;
HANDLE gEngineHandle;
VOID
MyCalloutUnload(
IN WDFDRIVER DriverObject
)
{
// TODO : Memory cleanups
// - Unregister callouts?
// - Free any allocated memory
UNREFERENCED_PARAMETER(DriverObject);
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "%!FUNC! Entry");
if (gEngineHandle != NULL)
{
FwpmEngineClose(gEngineHandle); // If I comment this line, there are no problems with the driver
gEngineHandle = NULL;
}
}
//NTSTATUS
//FilterByApplication()
//{
// NTSTATUS status = STATUS_SUCCESS;
// FWPM_SESSION session = { 0 };
//
// TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "%!FUNC! Entry");
//
// do
// {
// session.flags = FWPM_SESSION_FLAG_DYNAMIC;
// status = FwpmEngineOpen(
// L"MyCalloutDriver",
// RPC_C_AUTHN_WINNT,
// NULL,
// &session,
// &gEngineHandle
// );
//
// if (!NT_SUCCESS(status))
// {
// TraceEvents(TRACE_LEVEL_ERROR, TRACE_DRIVER, "FwpmEngineOpen failed %!STATUS!", status);
// break;
// }
//
// } while (FALSE);
//
// return status;
//}
NTSTATUS
DriverEntry(
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
WDF_DRIVER_CONFIG config;
NTSTATUS status;
WDF_OBJECT_ATTRIBUTES attributes;
WDFDRIVER driver;
WDFDEVICE device;
PWDFDEVICE_INIT pInit = NULL;
//
// Initialize WPP Tracing
//
WPP_INIT_TRACING(DriverObject, RegistryPath);
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "%!FUNC! Entry");
//
// Register a cleanup callback so that we can call WPP_CLEANUP when
// the framework driver object is deleted during driver unload.
//
WDF_OBJECT_ATTRIBUTES_INIT(&attributes);
attributes.EvtCleanupCallback = MyCalloutDriver1EvtDriverContextCleanup;
WDF_DRIVER_CONFIG_INIT(&config, WDF_NO_EVENT_CALLBACK);
config.DriverInitFlags |= WdfDriverInitNonPnpDriver;
config.EvtDriverUnload = MyCalloutUnload;
do
{
status = WdfDriverCreate(DriverObject,
RegistryPath,
&attributes,
&config,
&driver
);
if (!NT_SUCCESS(status)) {
TraceEvents(TRACE_LEVEL_ERROR, TRACE_DRIVER, "WdfDriverCreate failed %!STATUS!", status);
break;
}
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "Driver created successfully!");
pInit = WdfControlDeviceInitAllocate(driver, &SDDL_DEVOBJ_KERNEL_ONLY);
if (!pInit)
{
status = STATUS_INSUFFICIENT_RESOURCES;
TraceEvents(TRACE_LEVEL_ERROR, TRACE_DRIVER, "WdfControlDeviceInitAllocate failed %!STATUS!", status);
break;
}
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "Control Device Initialized Successfully!");
WdfDeviceInitSetDeviceType(pInit, FILE_DEVICE_NETWORK); // Set the device type as a network device
// If a device object's FILE_DEVICE_SECURE_OPEN characteristic is set,
// the system applies the device object's security descriptor to
// all file open requests in the device's namespace.
WdfDeviceInitSetCharacteristics(pInit, FILE_DEVICE_SECURE_OPEN, FALSE);
// The FILE_AUTOGENERATED_DEVICE_NAME is only used for PDOs. What does this do??
WdfDeviceInitSetCharacteristics(pInit, FILE_AUTOGENERATED_DEVICE_NAME, TRUE);
status = WdfDeviceCreate(&pInit, WDF_NO_OBJECT_ATTRIBUTES, &device);
if (!NT_SUCCESS(status))
{
TraceEvents(TRACE_LEVEL_ERROR, TRACE_DRIVER, "WdfDeviceCreate failed %!STATUS!", status);
break;
}
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "Device created successfully!");
// The system will not send I/O requests or Windows Management Instrumentation (WMI)
// requests to a control device object unless the driver has called WdfControlFinishInitializing.
WdfControlFinishInitializing(device);
// Get the Device Object
gDeviceObject = WdfDeviceWdmGetDeviceObject(device);
} while (FALSE);
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "%!FUNC! Exit");
if (!NT_SUCCESS(status))
{
TraceEvents(TRACE_LEVEL_ERROR, TRACE_DRIVER, "Failed %!STATUS!", status);
WPP_CLEANUP(DriverObject);
}
return status;
}
VOID
MyCalloutDriver1EvtDriverContextCleanup(
_In_ WDFOBJECT DriverObject
)
/*
Routine Description:
Free all the resources allocated in DriverEntry.
Arguments:
DriverObject - handle to a WDF Driver object.
Return Value:
VOID.
--*/
{
UNREFERENCED_PARAMETER(DriverObject);
PAGED_CODE();
TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_DRIVER, "%!FUNC! Entry");
//
// Stop WPP Tracing
//
WPP_CLEANUP(WdfDriverWdmGetDriverObject((WDFDRIVER)DriverObject));
}
INF 檔案 =>
;
; MyCalloutDriver1.inf
;
[Version]
Signature="$WINDOWS NT$"
Class=System ; TODO: specify appropriate Class
ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} ; TODO: specify appropriate ClassGuid
Provider=%ManufacturerName%
CatalogFile=MyCalloutDriver1.cat
DriverVer= ; TODO: set DriverVer in stampinf property pages
PnpLockdown=1
[DestinationDirs]
DefaultDestDir = 12
MyCalloutDriver1_Device_CoInstaller_CopyFiles = 11
[SourceDisksNames]
1 = %DiskName%,,,""
[SourceDisksFiles]
MyCalloutDriver1.sys = 1,,
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
;*****************************************
; Install Section
;*****************************************
[Manufacturer]
%ManufacturerName%=Standard,NT$ARCH$
[Standard.NT$ARCH$]
%MyCalloutDriver1.DeviceDesc%=MyCalloutDriver1_Device, Root\MyCalloutDriver1 ; TODO: edit hw-id
[MyCalloutDriver1_Device.NT]
CopyFiles=Drivers_Dir
[Drivers_Dir]
MyCalloutDriver1.sys
;-------------- Service installation
[MyCalloutDriver1_Device.NT.Services]
AddService = MyCalloutDriver1,%SPSVCINST_ASSOCSERVICE%, MyCalloutDriver1_Service_Inst
; -------------- MyCalloutDriver1 driver install sections
[MyCalloutDriver1_Service_Inst]
DisplayName = %MyCalloutDriver1.SVCDESC%
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
StartType = 3 ; SERVICE_DEMAND_START
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
ServiceBinary = %12%\MyCalloutDriver1.sys
;
;--- MyCalloutDriver1_Device Coinstaller installation ------
;
[MyCalloutDriver1_Device.NT.CoInstallers]
AddReg=MyCalloutDriver1_Device_CoInstaller_AddReg
CopyFiles=MyCalloutDriver1_Device_CoInstaller_CopyFiles
[MyCalloutDriver1_Device_CoInstaller_AddReg]
HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
[MyCalloutDriver1_Device_CoInstaller_CopyFiles]
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
[MyCalloutDriver1_Device.NT.Wdf]
KmdfService = MyCalloutDriver1, MyCalloutDriver1_wdfsect
[MyCalloutDriver1_wdfsect]
KmdfLibraryVersion = $KMDFVERSION$
[Strings]
SPSVCINST_ASSOCSERVICE= 0x00000002
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
DiskName = "MyCalloutDriver1 Installation Disk"
MyCalloutDriver1.DeviceDesc = "MyCalloutDriver1 Device"
MyCalloutDriver1.SVCDESC = "MyCalloutDriver1 Service"
不知道我錯過了什么。任何幫助，將不勝感激。
uj5u.com熱心網友回復：
我的代碼中有兩個問題。
1 - 對于標注驅動程式，inf 檔案中的驅動程式類必須是 WFPCALLOUTS，inf 檔案中的類 GUID 必須是 {57465043-616C-6C6F-7574-5F636C617373}。此外，還有一些 INF 檔案部分不適用于標注驅動程式。參考microsoft 檢查標注驅動程式代碼。
2 - 在標注驅動程式中鏈接用戶模式庫不起作用。我試圖在用戶模式庫 Fwpuclnt.lib 中使用一些方法。
轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/483266.html