VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("DriverB:Enter B DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension;
//删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
KdPrint(("DriverB:Enter B DriverUnload\n"));
}
static
VOID
NTAPI
driver_unload(IN PDRIVER_OBJECT DriverObject)
{
WCHAR deviceLinkBuffer[] = L"\\DosDevices\\"CO_DRIVER_NAME;
UNICODE_STRING deviceLinkUnicodeString;
co_manager_t *manager;
manager = DriverObject->DeviceObject->DeviceExtension;
if (manager) {
co_manager_unload(manager);
}
RtlInitUnicodeString(&deviceLinkUnicodeString, deviceLinkBuffer);
IoDeleteSymbolicLink(&deviceLinkUnicodeString);
IoDeleteDevice(DriverObject->DeviceObject);
}
VOID BBUnload( IN PDRIVER_OBJECT DriverObject )
{
UNICODE_STRING deviceLinkUnicodeString;
// Unregister notification
PsSetCreateProcessNotifyRoutine( BBProcessNotify, TRUE );
// Cleanup physical regions
BBCleanupProcessPhysList();
// Cleanup process mapping info
BBCleanupProcessTable();
RtlUnicodeStringInit( &deviceLinkUnicodeString, DOS_DEVICE_NAME );
IoDeleteSymbolicLink( &deviceLinkUnicodeString );
IoDeleteDevice( DriverObject->DeviceObject );
return;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DrvObj, PUNICODE_STRING RegPath)
{
PDEVICE_OBJECT DevObj;
NTSTATUS status;
status = IoCreateDevice(DrvObj, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN,
FALSE, &DevObj);
if(NT_SUCCESS(status)) {
status = IoCreateSymbolicLink (&deviceLink, &deviceName);
DrvObj->MajorFunction[IRP_MJ_CREATE] = DtraceOpen;
DrvObj->MajorFunction[IRP_MJ_CLOSE] = DtraceClose;
DrvObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DtraceIoctl;
DrvObj->DriverUnload = DtraceUnload;
}
if (!NT_SUCCESS(status)) {
IoDeleteSymbolicLink(&deviceLink);
if(DevObj)
IoDeleteDevice( DevObj);
return status;
}
status = IoCreateSymbolicLink(&deviceHelperLink, &deviceName);
if (!NT_SUCCESS(status))
dprintf("DriverEntry: dtrace helper creation failed\n");
DtraceGetSystemHertz();
DtraceWinOSKernelModuleInfo();
DtraceWinOSInitFunctions();
if (DtraceWinOSHackData() == 0)
dprintf("DriverEntry: DtraceWinOSPortData() hack data failure\n");
if (PsSetLoadImageNotifyRoutine(ProcKernelModuleLoaded) != STATUS_SUCCESS)
dprintf("DriverEntry: failed to register PsSetLoadImageNotifyRoutine\n");
WorkItem1 = IoAllocateWorkItem(DevObj);
WorkItem2 = IoAllocateWorkItem(DevObj);
int_morecore();
(void) dtrace_load((void *) RegPath);
return status;
}
VOID
ParUnload(
IN PDRIVER_OBJECT DriverObject
)
/*++
Routine Description:
This routine loops through the device list and cleans up after
each of the devices.
Arguments:
DriverObject - Supplies the driver object.
Return Value:
None.
--*/
{
PDEVICE_OBJECT currentDevice;
PDEVICE_EXTENSION extension;
KEVENT event;
PARALLEL_INTERRUPT_SERVICE_ROUTINE interruptService;
PIRP irp;
IO_STATUS_BLOCK ioStatus;
while (currentDevice = DriverObject->DeviceObject) {
extension = currentDevice->DeviceExtension;
if (extension->CreatedSymbolicLink) {
IoDeleteSymbolicLink(&extension->SymbolicLinkName);
ExFreePool(extension->SymbolicLinkName.Buffer);
}
IoDeleteDevice(currentDevice);
}
}
NTSTATUS
DestroySoundDevice(
IN PDEVICE_OBJECT DeviceObject,
IN PCWSTR WideDosDeviceName,
IN UCHAR Index)
{
NTSTATUS Status;
UNICODE_STRING DosDeviceName;
/* Check for NULL parameters */
if ( ( ! WideDosDeviceName ) || ( ! DeviceObject ) )
{
DPRINT("Unexpected NULL parameter");
return STATUS_INVALID_PARAMETER;
}
/* Range-check */
if ( Index >= SOUND_MAX_DEVICES )
{
DPRINT("Device %d exceeds maximum", Index);
return STATUS_INVALID_PARAMETER;
}
Status = ConstructDeviceName(WideDosDeviceName, Index, &DosDeviceName);
if ( ! NT_SUCCESS(Status) )
{
return Status;
}
DPRINT("Deleting symlink %ws\n", DosDeviceName.Buffer);
Status = IoDeleteSymbolicLink(&DosDeviceName);
DPRINT("Status of symlink deletion is 0x%08x\n", Status);
/*
ASSERT(NT_SUCCESS(Status));
*/
IoDeleteDevice(DeviceObject);
return STATUS_SUCCESS;
}
int XMountDrive(char driveLetter, char *directoryName)
{
#ifdef DEBUG
debugPrint("XMountDrive driveLetter=%c directoryName=%s\n", driveLetter, directoryName);
#endif
ANSI_STRING drive, device;
char driveBuffer[10];
sprintf(driveBuffer, "\\??\\%c:", driveLetter);
char *deviceBuffer;
// we allocate some memory here that never gets deallocated. Hopefully
// that won't be a problem because it only small and shouldn't happen often
deviceBuffer = (char *)malloc(200);
int rc = XConvertDOSFilenameToXBOX(directoryName, deviceBuffer);
if (rc != STATUS_SUCCESS)
return rc;
// we need to make sure it has a trailing slash
int len = strlen(deviceBuffer);
if (deviceBuffer[len-1] != '\\')
{
deviceBuffer[len] = '\\';
deviceBuffer[len+1] = 0;
}
RtlInitAnsiString(&drive, driveBuffer);
RtlInitAnsiString(&device, deviceBuffer);
IoDeleteSymbolicLink(&drive);
NTSTATUS status = IoCreateSymbolicLink(&drive, &device);
if (!NT_SUCCESS(status))
return RtlNtStatusToDosError(status);
else
{
setPartitionString(driveLetter, deviceBuffer);
return STATUS_SUCCESS;
}
}
//-------------------------------------------------------------------------------------------------------------------
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING deviceLinkUnicodeString;
PDEVICE_EXTENSION extension;
PIRP pNewIrp = NULL;
ULONG m_size;
NTSTATUS ntStatus;
extension = DriverObject->DeviceObject->DeviceExtension;
// Create counted string version of our Win32 device name.
RtlInitUnicodeString(&deviceLinkUnicodeString, DOS_DEVICE_NAME);
// Delete the link from our device name to a name in the Win32 namespace.
IoDeleteSymbolicLink(&deviceLinkUnicodeString);
// Finally delete our device object
IoDeleteDevice(DriverObject->DeviceObject);
}
//
// 删除一个设备
//
VOID
XFilter_Delete(
IN PDEVICE_OBJECT pDeviceObject
)
{
PXPACKET_DEVICE_EXTENSION pDeviceExtension;
UNICODE_STRING SymbolicLinkName;
pDeviceExtension = (PXPACKET_DEVICE_EXTENSION)pDeviceObject->DeviceExtension;
RtlInitUnicodeString(&SymbolicLinkName, XPACKET_XFILTER_DOS_DEVICE_NAME);
IoDeleteSymbolicLink( &SymbolicLinkName );
pDeviceExtension->ulNodeType = 0;
pDeviceExtension->ulNodeSize = 0;
IoDeleteDevice( pDeviceObject );
dprintf(("XFilter_Delete Success\n"));
}
//
// Delete the associated device and return
//
static STDCALL void RwPortsUnload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING DeviceLinkUnicodeString;
NTSTATUS ntStatus=STATUS_SUCCESS;
OutputDebugString ("rwports: entering RwPortsUnload");
OutputDebugString ("rwports: unmapping remaining memory");
RtlInitUnicodeString (&DeviceLinkUnicodeString, L"\\DosDevices\\rwports");
ntStatus = IoDeleteSymbolicLink (&DeviceLinkUnicodeString);
if (NT_SUCCESS(ntStatus))
{
IoDeleteDevice (DriverObject->DeviceObject);
}
else
{
OutputDebugString ("rwports: IoDeleteSymbolicLink failed");
}
OutputDebugString ("rwports: leaving RwPortsUnload");
}
/*
* @implemented
*/
NTSTATUS
GlobalDeleteSymbolicLink(IN PUNICODE_STRING DosName)
{
NTSTATUS Status;
UNICODE_STRING GlobalName;
/* Recreate the string (to find the link) */
Status = CreateStringWithGlobal(DosName, &GlobalName);
if (!NT_SUCCESS(Status))
{
return Status;
}
/* And delete the link */
Status = IoDeleteSymbolicLink(&GlobalName);
FreePool(GlobalName.Buffer);
return Status;
}
VOID UnloadDriver(PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING uniLinkName;
PDEVICE_OBJECT CurrentDeviceObject;
PDEVICE_OBJECT NextDeviceObject;
RtlInitUnicodeString(&uniLinkName,LINK_NAME);
IoDeleteSymbolicLink(&uniLinkName);
if (DriverObject->DeviceObject!=NULL)
{
CurrentDeviceObject = DriverObject->DeviceObject;
while(CurrentDeviceObject!=NULL)
{
NextDeviceObject = CurrentDeviceObject->NextDevice;
IoDeleteDevice(CurrentDeviceObject);
CurrentDeviceObject = NextDeviceObject;
}
}
DbgPrint("UnloadDriver\r\n");
}
/******************************************************************************
* Driver unload handler *
******************************************************************************/
static VOID DDKAPI
my_unload(PDRIVER_OBJECT DriverObject)
{
ANSI_STRING SymbolicLinkNameA;
UNICODE_STRING SymbolicLinkNameW;
DbgPrint("DriverUnload called\r\n");
PsSetCreateProcessNotifyRoutine(create_process_watcher, TRUE);
PsRemoveLoadImageNotifyRoutine(load_image_watcher);
RtlInitString(&SymbolicLinkNameA, MY_DOSDEVICE_NAME);
RtlAnsiStringToUnicodeString(&SymbolicLinkNameW, &SymbolicLinkNameA, TRUE);
IoDeleteSymbolicLink(&SymbolicLinkNameW);
IoDeleteDevice(DriverObject->DeviceObject);
for (int i = 0; i < ENT_CNT; ++i)
if(g_proc_table[i].pid)
DbgPrint("Registered process stays: %d\r\n", g_proc_table[i].pid);
}
VOID
AWEAllocUnload(IN PDRIVER_OBJECT DriverObject)
{
PDEVICE_OBJECT device_object = DriverObject->DeviceObject;
UNICODE_STRING sym_link;
KdPrint(("AWEAlloc: Unload.\n"));
PAGED_CODE();
RtlInitUnicodeString(&sym_link, AWEALLOC_SYMLINK_NAME);
IoDeleteSymbolicLink(&sym_link);
while (device_object != NULL)
{
PDEVICE_OBJECT next_device = device_object->NextDevice;
IoDeleteDevice(device_object);
device_object = next_device;
}
}
VOID DDK_Unload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pDev;//用来取得要删除设备对象
UNICODE_STRING symLinkName; //
UnHook();
if (ishook)
{//unhook
__asm //去掉页面保护
{
cli
mov eax,cr0
and eax,not 10000h //and eax,0FFFEFFFFh
mov cr0,eax
}
pcur->E9= oldCode.E9;//1字节
pcur->JMPADDR= oldCode.JMPADDR;//4字节
__asm //恢复页保护
{
mov eax,cr0
or eax,10000h //or eax,not 0FFFEFFFFh
mov cr0,eax
sti
}
} //end unhook
pDev=pDriverObject->DeviceObject;
IoDeleteDevice(pDev); //删除设备
//取符号链接名字
RtlInitUnicodeString(&symLinkName,L"\\??\\My_DriverLinkName");
//删除符号链接
IoDeleteSymbolicLink(&symLinkName);
KdPrint(("驱动成功被卸载...OK-----------")); //sprintf,printf
//取得要删除设备对象
//删掉所有设备
DbgPrint("卸载成功");
}
VOID
DokanUnload(
__in PDRIVER_OBJECT DriverObject
)
/*++
Routine Description:
This routine gets called to remove the driver from the system.
Arguments:
DriverObject - the system supplied driver object.
Return Value:
NTSTATUS
--*/
{
PDEVICE_OBJECT deviceObject = DriverObject->DeviceObject;
WCHAR symbolicLinkBuf[] = DOKAN_GLOBAL_SYMBOLIC_LINK_NAME;
UNICODE_STRING symbolicLinkName;
PAGED_CODE();
DDbgPrint("==> DokanUnload\n");
if (GetIdentifierType(deviceObject->DeviceExtension) == DGL) {
DDbgPrint(" Delete Global DeviceObject\n");
RtlInitUnicodeString(&symbolicLinkName, symbolicLinkBuf);
IoDeleteSymbolicLink(&symbolicLinkName);
IoDeleteDevice(deviceObject);
}
ExDeleteNPagedLookasideList(&DokanIrpEntryLookasideList);
DDbgPrint("<== DokanUnload\n");
return;
}
VOID
ioctlUnloadDriver(__in PDRIVER_OBJECT DriverObject)
{
PDEVICE_OBJECT deviceObject = DriverObject->DeviceObject;
UNICODE_STRING uniWin32NameString;
UNREFERENCED_PARAMETER(deviceObject);
netmap_fini();
keexit_GST();
RtlInitUnicodeString(&uniWin32NameString, NETMAP_DOS_DEVICE_NAME);
// Delete the link from our device name to a name in the Win32 namespace.
IoDeleteSymbolicLink(&uniWin32NameString);
if (deviceObject != NULL) {
IoDeleteDevice(deviceObject);
}
return;
}
VOID CRARKSYS_DriverUnload(
IN PDRIVER_OBJECT DriverObject
)
{
PDEVICE_OBJECT pdoNextDeviceObj = pdoGlobalDrvObj->DeviceObject;
//为安全考虑
UnhookFunction(KeInsertQueueApc, KeInsertQueueApcJumpBack);
ProtectCleanup();
IoDeleteSymbolicLink(&usSymlinkName);
// Delete all the device objects
while(pdoNextDeviceObj)
{
PDEVICE_OBJECT pdoThisDeviceObj = pdoNextDeviceObj;
pdoNextDeviceObj = pdoThisDeviceObj->NextDevice;
IoDeleteDevice(pdoThisDeviceObj);
}
KdPrint(("CrArkSys Unload.\n"));
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Description :
// Driver unload callback. Removes hooks, callbacks, and communication stuff.
// Parameters :
// Process :
// Removes hooks, callbacks, device driver symbolic link / device, and cleans the monitored
// processes linked list.
//////////////////////////////////////////////////////////////////////////////////////////////////////////////
VOID Unload(PDRIVER_OBJECT pDriverObject)
{
if(is_xp)
unhook_ssdt_entries();
else
unhook_ssdt_entries_7();
CmUnRegisterCallback(cookie);
PsRemoveLoadImageNotifyRoutine(imageCallback);
IoDeleteSymbolicLink(&usDosDeviceName);
IoDeleteDevice(pDriverObject->DeviceObject);
cleanMonitoredProcessList();
cleanHiddenProcessList();
if (cuckooPath)
{
ExFreePool(cuckooPath);
}
}
VOID USBPcapDeleteRootHubControlDevice(IN PDEVICE_OBJECT controlDevice)
{
UNICODE_STRING symbolicLinkName;
PWCHAR symbolicNameBuffer[MAX_SYMBOLIC_LEN];
USHORT id;
PDEVICE_EXTENSION pDevExt;
NTSTATUS status;
pDevExt = ((PDEVICE_EXTENSION)controlDevice->DeviceExtension);
ASSERT(pDevExt->deviceMagic == USBPCAP_MAGIC_CONTROL);
id = pDevExt->context.control.id;
symbolicLinkName.Length = 0;
symbolicLinkName.MaximumLength = MAX_SYMBOLIC_LEN;
symbolicLinkName.Buffer = (PWSTR)symbolicNameBuffer;
status = RtlUnicodeStringPrintf(&symbolicLinkName,
SYMBOLIC_PREFIX L"%hu", id);
IoAcquireRemoveLock(&pDevExt->removeLock, NULL);
IoReleaseRemoveLockAndWait(&pDevExt->removeLock, NULL);
IoReleaseRemoveLock(pDevExt->parentRemoveLock, NULL);
ASSERT(NT_SUCCESS(status));
if (NT_SUCCESS(status))
{
IoDeleteSymbolicLink(&symbolicLinkName);
IoDeleteDevice(controlDevice);
}
else
{
/* Very bad */
KdPrint(("Failed to init symbolic link name\n"));
pDevExt->context.control.pRootHubObject = NULL;
}
}
///////////////////////////////////////////////////////////////////////////////
///
/// Handle driver unloading. All this driver needs to do
/// is to delete the device object and the symbolic link between our
/// device name and the Win32 visible name.
///
///////////////////////////////////////////////////////////////////////////////
VOID
TdDeviceUnload(
_In_ PDRIVER_OBJECT DriverObject
)
{
NTSTATUS Status = STATUS_SUCCESS;
UNICODE_STRING DosDevicesLinkName = RTL_CONSTANT_STRING(QD_DOS_DEVICES_LINK_NAME);
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "QuietDragon: TdDeviceUnload\n");
// Unregister process notify routines.
if (gProcessNotifyRoutine_isSet == TRUE)
{
Status = PsSetCreateProcessNotifyRoutineEx(
MyCreateProcessNotifyRoutine,
TRUE
);
TD_ASSERT(Status == STATUS_SUCCESS);
gProcessNotifyRoutine_isSet = FALSE;
}
// TODO Need to clean up lists and locks
// Free allocated mem
PQD_COMM_CONTROL_DEVICE_EXTENSION controlExt = (PQD_COMM_CONTROL_DEVICE_EXTENSION)g_CommDeviceObject->DeviceExtension;
ExFreePoolWithTag(controlExt->DecisionData, 'SRdd');
// Delete the link from our device name to a name in the Win32 namespace.
Status = IoDeleteSymbolicLink(&DosDevicesLinkName);
if (Status != STATUS_INSUFFICIENT_RESOURCES)
{
// IoDeleteSymbolicLink can fail with STATUS_INSUFFICIENT_RESOURCES.
TD_ASSERT(NT_SUCCESS(Status));
}
// Delete our device object.
IoDeleteDevice(DriverObject->DeviceObject);
}
void SSDTUnload( PDRIVER_OBJECT pDriverObject )
{
UNICODE_STRING usDosDeviceName;
if (Prot)
CmUnRegisterCallback(Cookie);
if (EventKernelSet)
{
ObDereferenceObject(EventKernelSet);
EventKernelSet=NULL;
}
if (EventKernelWait)
{
ObDereferenceObject(EventKernelWait);
EventKernelWait=NULL;
}
RtlInitUnicodeString( &usDosDeviceName, DEVICE_NAME );
IoDeleteSymbolicLink( &usDosDeviceName );
IoDeleteDevice( pDriverObject->DeviceObject );
FreeLog();
DbgPrint( "SSDT: Unload Success!" );
}
// cDriveLetter e.g. 'D'
HRESULT CIoSupport::UnmapDriveLetter(char cDriveLetter)
{
#ifdef _XBOX
char szDestinationDrive[16];
ANSI_STRING LinkName;
NTSTATUS status;
sprintf(szDestinationDrive, "\\??\\%c:", cDriveLetter);
RtlInitAnsiString(&LinkName, szDestinationDrive);
status = IoDeleteSymbolicLink(&LinkName);
if (NT_SUCCESS(status))
CLog::Log(LOGNOTICE, "Unmapped drive %c", cDriveLetter);
else if(status != NT_STATUS_OBJECT_NAME_NOT_FOUND)
CLog::Log(LOGERROR, "Failed to delete symbolic link! (status=0x%08x)", status);
return status;
#else
return S_OK;
#endif
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextDevObj = pDriverObject->DeviceObject;
while(0 != pNextDevObj)
{
PMYDEVICE_EXTENSION pDevExtend = (PMYDEVICE_EXTENSION)pNextDevObj->DeviceExtension;
if(pNextDevObj == g_MasterDeviceObj)
{
PDEVICE_OBJECT pTempDevObj = pNextDevObj->NextDevice;
UNICODE_STRING tMasterDevObjSymbol;
RtlInitUnicodeString(&tMasterDevObjSymbol,__T(DEVICE_NAME_KBDFILTER_SYMBOL));
IoDeleteSymbolicLink(&tMasterDevObjSymbol);
IoDeleteDevice(pNextDevObj);
pNextDevObj = pTempDevObj;
continue;
}
PIRP tCurIrp = pDevExtend->CurIrp;
BOOLEAN tCancelRet = FALSE;
if(0 != tCurIrp)
{
tCancelRet = IoCancelIrp(tCurIrp);
}
if(0 != pDevExtend->LowDeviceObj)
{
IoDetachDevice(pDevExtend->LowDeviceObj);
}
LARGE_INTEGER tDelay;
tDelay.QuadPart = 1000*10000*(-1);
KeDelayExecutionThread(KernelMode,FALSE,&tDelay);
PDEVICE_OBJECT pTempDevObj = pNextDevObj->NextDevice;
IoDeleteDevice(pNextDevObj);
pNextDevObj = pTempDevObj;
}
}
VOID IoDriverUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter IoDriverUnload\n"));
//_asm int 3
FreeAllPageLookasideLists();
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName, SYMLINK_NAME);
pNextObj = pDriverObject->DeviceObject;
IoDeleteSymbolicLink(&symLinkName);
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension;
//删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
}
static
VOID
_cleanup
(
PDEVICE_OBJECT devObj
)
{
UNICODE_STRING dosDevName;
RtlInitUnicodeString(&dosDevName, DOS_DEVICE_NAME);
(void)IoDeleteSymbolicLink(&dosDevName);
if (NULL != g_driverKey)
{
ExFreePool(g_driverKey);
g_driverKey = NULL;
}
if (devObj != NULL)
{
IoDeleteDevice(devObj);
}
}
void WinIoUnload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING DeviceLinkUnicodeString;
NTSTATUS ntStatus;
OutputDebugString ("Entering WinIoUnload");
RtlInitUnicodeString (&DeviceLinkUnicodeString, L"\\DosDevices\\WinIo");
ntStatus = IoDeleteSymbolicLink (&DeviceLinkUnicodeString);
if (NT_SUCCESS(ntStatus))
{
IoDeleteDevice (DriverObject->DeviceObject);
}
else
{
OutputDebugString ("ERROR: IoDeleteSymbolicLink");
}
OutputDebugString ("Leaving WinIoUnload");
}
NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDeviceObject;
UNICODE_STRING usDeviceName;
UNICODE_STRING usSymbolicName;
RtlInitUnicodeString(&usDeviceName, L"\\Device\\_RegistryMonitor");
status = IoCreateDevice(
pDriverObject,
0,
&usDeviceName,
FILE_DEVICE_UNKNOWN,
FILE_DEVICE_SECURE_OPEN,
TRUE,
&pDeviceObject);
if (!NT_SUCCESS(status))
{
KdPrint(("Failed to Create device.."));
return status;
}
pDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
RtlInitUnicodeString(&usSymbolicName, L"\\??\\_RegistryMonitor");
status = IoCreateSymbolicLink(&usSymbolicName, &usDeviceName);
if (!NT_SUCCESS(status))
{
KdPrint(("Failed to create usSymbolicName."));
IoDeleteSymbolicLink(&usSymbolicName);
IoDeleteDevice(pDeviceObject);
return status;
}
KdPrint(("Create device success."));
return STATUS_SUCCESS;
}
///////////////////////////////////////////////////////////////////////////////////////////////////
// testdrvUnload
// Driver unload callback.
//
// Arguments:
// IN DriverObject
// pointer to the driver object
//
// Return Value:
// none
//
VOID testdrvUnload(
IN PDRIVER_OBJECT DriverObject
)
{
UNICODE_STRING win32Name;
testdrvDebugPrint(DBG_UNLOAD, DBG_TRACE, __FUNCTION__"++");
RtlInitUnicodeString(&win32Name, L"\\??\\testdrvDevice");
IoDeleteSymbolicLink(&win32Name);
IoUnregisterShutdownNotification(DriverObject->DeviceObject);
IoDeleteDevice(DriverObject->DeviceObject);
// The device object(s) should be NULL now
// (since we unload, all the devices objects associated with this
// driver must be deleted.
ASSERT(DriverObject->DeviceObject == NULL);
// We should not be unloaded until all the devices we control
// have been removed from our queue.
// release memory block allocated for registry path
if (g_Data.RegistryPath.Buffer != NULL)
{
ExFreePool(g_Data.RegistryPath.Buffer);
g_Data.RegistryPath.Buffer = NULL;
}
testdrvDebugPrint(DBG_UNLOAD, DBG_TRACE, __FUNCTION__"--");
#ifdef TESTDRV_WMI_TRACE
WPP_CLEANUP(DriverObject);
#endif
return;
}
NTSTATUS HelloWDMAddDevice(IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT PhysicalDeviceObject)
{
PAGED_CODE();
KdPrint(("Enter HelloWDMAddDevice\n"));
NTSTATUS status;
PDEVICE_OBJECT fdo;
UNICODE_STRING devName;
RtlInitUnicodeString(&devName, L"\\Device\\MyWDMDevice");
status = IoCreateDevice(DriverObject, sizeof(DEVICE_EXTENSION), &(UNICODE_STRING)devName, FILE_DEVICE_UNKNOWN, 0, FALSE, &fdo);
if (!NT_SUCCESS(status))
return status;
PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)fdo->DeviceExtension;
pdx->fdo = fdo;
pdx->NextStatckDevice = IoAttachDeviceToDeviceStack(fdo, PhysicalDeviceObject);
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName, L"\\DosDevices\\HelloWDM");
pdx->ustrDeviceName = devName;
pdx->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink(&(UNICODE_STRING)symLinkName, &(UNICODE_STRING)devName);
if (!NT_SUCCESS(status))
{
IoDeleteSymbolicLink(&pdx->ustrSymLinkName);
status = IoCreateSymbolicLink(&symLinkName, &devName);
if (!NT_SUCCESS(status))
{
return status;
}
}
fdo->Flags |= DO_BUFFERED_IO | DO_POWER_PAGABLE;
fdo->Flags &= ~DO_DEVICE_INITIALIZING;
KdPrint(("Leave HelloWDMAddDevice\n"));
return STATUS_SUCCESS;
}
