NT驱动主要工作在Windows 2000下

NT驱动主要工作在Windows 2000下，不支持即插即用和电源管理，大概包括三部分：入口函数(DriverEntry)、卸载历程(DriverUnload)、分发例程(Dispatch Function)。

下面分别讲述这三个部分。

入口函数(DriverEntry)驱动的入口函数主要是对驱动程序进行初始化工作，它是由系统进程所调用。

在驱动程序初始化的时候，入口函数被加载进内存，进行初始化，完成之后，就要退出内存。

一般入口函数的前边都要有这么一个标记#pragma code_seg("INIT")标记驱动入口函数在内存中的位置。

NT驱动的入口函数一般完成的工作也很简单，就是注册分发例程，下面是一个简单的代码示例：view plaincopy to clipboardprint?#pragma code_seg("INIT")extern"C"NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath){NTSTATUS status;KdPrint(("Hello!welcome to the driver entry!\n"));pDriverObject->DriverUnload = DriverUnload;pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreateClose;pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchCreateClose;pDriverObject->MajorFunction[IRP_MJ_READ] = DispatchReadWrite;pDriverObject->MajorFunction[IRP_MJ_WRITE] = DispatchReadWrite;status = CreateDevice(pDriverObject); //创建设备对象，这个要另外实现return status;}#pragma code_seg("INIT")extern"C"NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath){NTSTATUS status;KdPrint(("Hello!welcome to the driver entry!\n"));pDriverObject->DriverUnload = DriverUnload;pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreateClose;pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchCreateClose;pDriverObject->MajorFunction[IRP_MJ_READ] = DispatchReadWrite;pDriverObject->MajorFunction[IRP_MJ_WRITE] = DispatchReadWrite;status = CreateDevice(pDriverObject); //创建设备对象，这个要另外实现return status;}卸载例程(DriverUnload)卸载例程，顾名思义，就是负责驱动程序的卸载的。

完成清扫的工作，删除符号链接，删除设备对象等等，下面是示例代码：view plaincopy to clipboardprint?#pragma CodeSeg("PAGED")VOID DriverUnload (IN PDRIVER_OBJECT pDriverObject){PDEVICE_OBJECT pNextObj;KdPrint(("Enter DriverUnload\n"));pNextObj = pDriverObject->DeviceObject;while (pNextObj != NULL){PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;//删除符号链接UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;IoDeleteSymbolicLink(&pLinkName);pNextObj = pNextObj->NextDevice;IoDeleteDevice( pDevExt->pDevice );}}#pragma CodeSeg("PAGED")VOID DriverUnload (IN PDRIVER_OBJECT pDriverObject){PDEVICE_OBJECT pNextObj;KdPrint(("Enter DriverUnload\n"));pNextObj = pDriverObject->DeviceObject;while (pNextObj != NULL){PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;//删除符号链接UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;IoDeleteSymbolicLink(&pLinkName);pNextObj = pNextObj->NextDevice;IoDeleteDevice( pDevExt->pDevice );}}分发例程Dispatch分发例程是驱动中真正进行功能实现的部分，系统产生的IRP都是由该部分进行处理，并且在执行的时候，分发函数运行在不同的进程中，存在于分页内存中，最最简单的处理函数可以参考上一篇文章中的示例代码，只是实现了转交的作用，具体想实现的功能，就要看用户的不同需求了，这里就不再赘述。

创建设备对象的函数代码：view plaincopy to clipboardprint?#pragma code_seg("INIT")NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject){NTSTATUS status;PDEVICE_OBJECT pDevObj;PDEVICE_EXTENSION pDevExt;//创建设备名称UNICODE_STRING devName;RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");//创建设备status = IoCreateDevice( pDriverObject,sizeof(DEVICE_EXTENSION),&(UNICODE_STRING)devName,FILE_DEVICE_UNKNOWN,0, TRUE,&pDevObj );if (!NT_SUCCESS(status))return status;pDevObj->Flags |= DO_BUFFERED_IO;pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;pDevExt->pDevice = pDevObj;pDevExt->ustrDeviceName = devName;//创建符号链接UNICODE_STRING symLinkName;RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");pDevExt->ustrSymLinkName = symLinkName;status = IoCreateSymbolicLink( &symLinkName,&devName );if (!NT_SUCCESS(status)){IoDeleteDevice( pDevObj );return status;}return STATUS_SUCCESS;}#pragma code_seg("INIT")NTSTATUS CreateDevice (IN PDRIVER_OBJECT pDriverObject){NTSTATUS status;PDEVICE_OBJECT pDevObj;PDEVICE_EXTENSION pDevExt;//创建设备名称UNICODE_STRING devName;RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");//创建设备status = IoCreateDevice( pDriverObject,sizeof(DEVICE_EXTENSION),&(UNICODE_STRING)devName,FILE_DEVICE_UNKNOWN,0, TRUE,&pDevObj );if (!NT_SUCCESS(status))return status;pDevObj->Flags |= DO_BUFFERED_IO;pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;pDevExt->pDevice = pDevObj;pDevExt->ustrDeviceName = devName;//创建符号链接UNICODE_STRING symLinkName;RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");pDevExt->ustrSymLinkName = symLinkName;status = IoCreateSymbolicLink( &symLinkName,&devName );if (!NT_SUCCESS(status)){IoDeleteDevice( pDevObj );return status;}return STATUS_SUCCESS;}在Windows 2000出现之后，微软又加入了新的驱动模型--WDM驱动模型，主要添加了对即插即用和电源管理的支持。