【舊文章搬運】Windows核心常見資料結構(驅動相關)
原文發表於百度空間，2008-7-24
==========================================================================
這些是驅動中相關的資料結構．
驅動物件，由I/O管理器建立，用於管理裝置(Device):
lkd> dt _DRIVER_OBJECT
ntdll!_DRIVER_OBJECT
+0x000 Type : Int2B
+0x002 Size : Int2B
+0x004 DeviceObject : Ptr32 _DEVICE_OBJECT //裝置物件
+0x008 Flags : Uint4B
+0x00c DriverStart : Ptr32 Void
+0x010 DriverSize : Uint4B
+0x014 DriverSection : Ptr32 Void
+0x018 DriverExtension : Ptr32 _DRIVER_EXTENSION //指向
+0x01c DriverName : _UNICODE_STRING //驅動名稱
+0x024 HardwareDatabase : Ptr32 _UNICODE_STRING //指向一個儲存在登錄檔中的硬體描述
+0x028 FastIoDispatch : Ptr32 _FAST_IO_DISPATCH //快速IO派遣，還不太懂
+0x02c DriverInit : Ptr32 long //初始化例程
+0x030 DriverStartIo : Ptr32 void //
+0x034 DriverUnload : Ptr32 void //解除安裝例程
+0x038 MajorFunction : [28] Ptr32 long //各派遣例程指標，即IRP_MJ_XXX等
關於派遣例程：
[00] IRP_MJ_CREATE
[01] IRP_MJ_CREATE_NAMED_PIPE
[02] IRP_MJ_CLOSE
[03] IRP_MJ_READ
[04] IRP_MJ_WRITE
[05] IRP_MJ_QUERY_INFORMATION
[06] IRP_MJ_SET_INFORMATION
[07] IRP_MJ_QUERY_EA
[08] IRP_MJ_SET_EA
[09] IRP_MJ_FLUSH_BUFFERS
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION
[0b] IRP_MJ_SET_VOLUME_INFORMATION
[0c] IRP_MJ_DIRECTORY_CONTROL
[0d] IRP_MJ_FILE_SYSTEM_CONTROL
[0e] IRP_MJ_DEVICE_CONTROL
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL
[10] IRP_MJ_SHUTDOWN
[11] IRP_MJ_LOCK_CONTROL
[12] IRP_MJ_CLEANUP
[13] IRP_MJ_CREATE_MAILSLOT
[14] IRP_MJ_QUERY_SECURITY
[15] IRP_MJ_SET_SECURITY
[16] IRP_MJ_POWER
[17] IRP_MJ_SYSTEM_CONTROL
[18] IRP_MJ_DEVICE_CHANGE
[19] IRP_MJ_QUERY_QUOTA
[1a] IRP_MJ_SET_QUOTA
[1b] IRP_MJ_PNP
驅動擴充套件:
lkd> dt _DRIVER_EXTENSION
ntdll!_DRIVER_EXTENSION
+0x000 DriverObject : Ptr32 _DRIVER_OBJECT
+0x004 AddDevice : Ptr32 long
+0x008 Count : Uint4B
+0x00c ServiceKeyName : _UNICODE_STRING
+0x014 ClientDriverExtension : Ptr32 _IO_CLIENT_EXTENSION
+0x018 FsFilterCallbacks : Ptr32 _FS_FILTER_CALLBACKS
裝置物件:
lkd> dt _DEVICE_OBJECT
ntdll!_DEVICE_OBJECT
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 ReferenceCount : Int4B
+0x008 DriverObject : Ptr32 _DRIVER_OBJECT
+0x00c NextDevice : Ptr32 _DEVICE_OBJECT //從這兒看裝置物件也是成鏈
+0x010 AttachedDevice : Ptr32 _DEVICE_OBJECT
+0x014 CurrentIrp : Ptr32 _IRP
+0x018 Timer : Ptr32 _IO_TIMER
+0x01c Flags : Uint4B
+0x020 Characteristics : Uint4B
+0x024 Vpb : Ptr32 _VPB
+0x028 DeviceExtension : Ptr32 Void
+0x02c DeviceType : Uint4B
+0x030 StackSize : Char
+0x034 Queue : __unnamed
+0x05c AlignmentRequirement : Uint4B
+0x060 DeviceQueue : _KDEVICE_QUEUE
+0x074 Dpc : _KDPC
+0x094 ActiveThreadCount : Uint4B
+0x098 SecurityDescriptor : Ptr32 Void
+0x09c DeviceLock : _KEVENT
+0x0ac SectorSize : Uint2B
+0x0ae Spare1 : Uint2B
+0x0b0 DeviceObjectExtension : Ptr32 _DEVOBJ_EXTENSION
+0x0b4 Reserved : Ptr32 Void
裝置物件擴充套件：
lkd> dt _DEVOBJ_EXTENSION
ntdll!_DEVOBJ_EXTENSION
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 DeviceObject : Ptr32 _DEVICE_OBJECT
+0x008 PowerFlags : Uint4B
+0x00c Dope : Ptr32 _DEVICE_OBJECT_POWER_EXTENSION
+0x010 ExtensionFlags : Uint4B
+0x014 DeviceNode : Ptr32 Void
+0x018 AttachedTo : Ptr32 _DEVICE_OBJECT
+0x01c StartIoCount : Int4B
+0x020 StartIoKey : Int4B
+0x024 StartIoFlags : Uint4B
+0x028 Vpb : Ptr32 _VPB
IRP(相當重要)：
lkd> dt _IRP
ntdll!_IRP
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 MdlAddress : Ptr32 _MDL
+0x008 Flags : Uint4B
+0x00c AssociatedIrp : __unnamed
+0x010 ThreadListEntry : _LIST_ENTRY
+0x018 IoStatus : _IO_STATUS_BLOCK
+0x020 RequestorMode : Char
+0x021 PendingReturned : UChar
+0x022 StackCount : Char
+0x023 CurrentLocation : Char
+0x024 Cancel : UChar
+0x025 CancelIrql : UChar
+0x026 ApcEnvironment : Char
+0x027 AllocationFlags : UChar
+0x028 UserIosb : Ptr32 _IO_STATUS_BLOCK
+0x02c UserEvent : Ptr32 _KEVENT
+0x030 Overlay : __unnamed
+0x038 CancelRoutine : Ptr32 void
+0x03c UserBuffer : Ptr32 Void //使用者的輸入緩衝區指標
+0x040 Tail : __unnamed
lkd> dt _IO_STATUS_BLOCK
ntdll!_IO_STATUS_BLOCK
+0x000 Status : Int4B
+0x000 Pointer : Ptr32 Void
+0x004 Information : Uint4B