驱动加载和卸载 Minifilter为例（nullFilter）

以你之姓@ 2024-04-17 05:39 76阅读 0赞

安装驱动

// SYS文件跟程序放在同个目录下
    // InstallDriver(DRIVER_NAME,DRIVER_PATH,DRIVER_ALTITUDE);
    // 启动驱动服务 StartDriver(DRIVER_NAME);
    // 停止驱动服务 StopDriver(DRIVER_NAME);
    // 卸载服务 DeleteDriver(DRIVER_NAME);
    
    BOOL InstallDriver(const char* lpszDriverName,const char* lpszDriverPath,const char* lpszAltitude)
    {
        char    szTempStr[MAX_PATH];
        HKEY    hKey;
        DWORD    dwData;
        char    szDriverImagePath[MAX_PATH];    
    
        if( NULL==lpszDriverName || NULL==lpszDriverPath )
        {
            return FALSE;
        }
        //得到完整的驱动路径
        GetFullPathName(lpszDriverPath, MAX_PATH, szDriverImagePath, NULL);
    
        SC_HANDLE hServiceMgr=NULL;// SCM管理器的句柄
        SC_HANDLE hService=NULL;// NT驱动程序的服务句柄
    
        //打开服务控制管理器  
        //Establishes a connection to the service control manager on the specified computer and opens the specified service control manager database.
        hServiceMgr = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
        if( hServiceMgr == NULL ) 
        {
            // OpenSCManager失败
            CloseServiceHandle(hServiceMgr);
            return FALSE;        
        }
    
        // OpenSCManager成功  
    
        //创建驱动所对应的服务  Creates a service object and adds it to the specified service control manager database.
        hService = CreateService( hServiceMgr,
            lpszDriverName,             // 驱动程序的在注册表中的名字
            lpszDriverName,             // 注册表驱动程序的DisplayName 值
            SERVICE_ALL_ACCESS,         // 加载驱动程序的访问权限
            SERVICE_FILE_SYSTEM_DRIVER, // 表示加载的服务是文件系统驱动程序
            SERVICE_DEMAND_START,       // 注册表驱动程序的Start 值
            SERVICE_ERROR_IGNORE,       // 注册表驱动程序的ErrorControl 值
            szDriverImagePath,          // 注册表驱动程序的ImagePath 值
            "FSFilter Activity Monitor",// 注册表驱动程序的Group 值
            NULL, 
            "FltMgr",                   // 注册表驱动程序的DependOnService 值
            NULL, 
            NULL);
    
        if( hService == NULL ) 
        {        
            if( GetLastError() == ERROR_SERVICE_EXISTS ) 
            {
                //服务创建失败，是由于服务已经创立过
                CloseServiceHandle(hService);       // 服务句柄
                CloseServiceHandle(hServiceMgr);    // SCM句柄
                return TRUE; 
            }
            else 
            {
                CloseServiceHandle(hService);       // 服务句柄
                CloseServiceHandle(hServiceMgr);    // SCM句柄
                return FALSE;
            }
        }
        CloseServiceHandle(hService);       // 服务句柄
        CloseServiceHandle(hServiceMgr);    // SCM句柄
    
        //-------------------------------------------------------------------------------------------------------
        // SYSTEM\\CurrentControlSet\\Services\\DriverName\\Instances子健下的键值项 
        //-------------------------------------------------------------------------------------------------------
        strcpy(szTempStr,"SYSTEM\\CurrentControlSet\\Services\\");
        strcat(szTempStr,lpszDriverName);
        strcat(szTempStr,"\\Instances");
    	//Creates the specified registry key. If the key already exists, the function opens it. Note that key names are not case sensitive.
        if(RegCreateKeyEx(HKEY_LOCAL_MACHINE,szTempStr,0,"",REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,(LPDWORD)&dwData)!=ERROR_SUCCESS)
        {
            return FALSE;
        }
        // 注册表驱动程序的DefaultInstance 值 
        strcpy(szTempStr,lpszDriverName);
        strcat(szTempStr," Instance");
        if(RegSetValueEx(hKey,"DefaultInstance",0,REG_SZ,(CONST BYTE*)szTempStr,(DWORD)strlen(szTempStr))!=ERROR_SUCCESS)
        {
            return FALSE;
        }
        RegFlushKey(hKey);//刷新注册表
        RegCloseKey(hKey);
     
    
        //-------------------------------------------------------------------------------------------------------
        // SYSTEM\\CurrentControlSet\\Services\\DriverName\\Instances\\DriverName Instance子健下的键值项 
        //-------------------------------------------------------------------------------------------------------
        strcpy(szTempStr,"SYSTEM\\CurrentControlSet\\Services\\");
        strcat(szTempStr,lpszDriverName);
        strcat(szTempStr,"\\Instances\\");
        strcat(szTempStr,lpszDriverName);
        strcat(szTempStr," Instance");
        if(RegCreateKeyEx(HKEY_LOCAL_MACHINE,szTempStr,0,"",REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,(LPDWORD)&dwData)!=ERROR_SUCCESS)
        {
            return FALSE;
        }
        // 注册表驱动程序的Altitude 值
        strcpy(szTempStr,lpszAltitude);
        if(RegSetValueEx(hKey,"Altitude",0,REG_SZ,(CONST BYTE*)szTempStr,(DWORD)strlen(szTempStr))!=ERROR_SUCCESS)
        {
            return FALSE;
        }
        // 注册表驱动程序的Flags 值
        dwData=0x0;
        if(RegSetValueEx(hKey,"Flags",0,REG_DWORD,(CONST BYTE*)&dwData,sizeof(DWORD))!=ERROR_SUCCESS)
        {
            return FALSE;
        }
        RegFlushKey(hKey);//刷新注册表
        RegCloseKey(hKey);
    
        return TRUE;
    }