暑假刚开始的时候，参照《寒江独钓》这本书，用VS2015写过的一个minifilter的框架，今天在博客上分享出来。
VS2015已经有了minifilter的框架模板，直接生成了minifilter的基本结构，使用非常方便：
另外需要一提的是，直接生成的inf文件中，需要把inf文件中的 Instance1.Altitude = "370030" 注释去掉——否则的话驱动起不了作用，就这一点可是参悟了几天呐~
好了，进入正题。
0x01 minifilter简单认识
1.需求：要求得到文件操作消息。
2.传统的文件过滤驱动（过滤管理器）提供接口，来接受注册过的内核模块
3.优点：
1.minifilter不再参与IRP的处理工作，而是交由过滤管理器处理
2.过滤管理器统一管理，提高软件兼容性
缺点：
只通过接口编程的话，一些数据结构的域无法访问，部分功能难以实现
4.注册微过滤器，就是向微过滤器注册它的回调函数，不必再花精力绑定各种设备
0x02 关键代码
一。向过滤管理器注册微过滤器 NTSTATUS
DriverEntry (
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
NTSTATUS Status;
UNICODE_STRING MiniFilterPortName;
PSECURITY_DESCRIPTOR SecurityDescriptor;
OBJECT_ATTRIBUTES ObjectAttributes;
UNREFERENCED_PARAMETER( RegistryPath ); //不用该参数 //向过滤管理器注册微过滤器
Status = FltRegisterFilter( DriverObject, //DriverEntry参数DriverObject
&FilterRegistration, //微过滤器注册结构
&__FilterHandle); //微过滤器句柄，全局保存 if (NT_SUCCESS(Status))
{
//开启过滤
Status = FltStartFiltering(__FilterHandle); if (!NT_SUCCESS(Status))
{
//开启失败注销微过滤器
goto Exit;
}
}
else
{
goto Exit;
}
Status = FltBuildDefaultSecurityDescriptor(&SecurityDescriptor, FLT_PORT_ALL_ACCESS); if (!NT_SUCCESS(Status))
{
goto Exit;
} RtlInitUnicodeString(&MiniFilterPortName, MINI_FILTER_PORT_NAME);
//初始化ObjectAttributes，包含端口名MiniFilterPortName，方便Ring3应用层使用
InitializeObjectAttributes(&ObjectAttributes,
&MiniFilterPortName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, //OBJ_KERNEL_HANDLE 必需？？？
NULL,
SecurityDescriptor);
//创建通信端口
Status = FltCreateCommunicationPort(__FilterHandle,
&__FilterServerPort, //监听连接请求的端口
&ObjectAttributes, //
NULL,
MiniFilterConnect, //用户态连接后的回调函数
MiniFilterDisconnect,
MiniFilterDeviceIoControl, //MessageNotifyCallback 接受消息的回调函数
1); FltFreeSecurityDescriptor(SecurityDescriptor); if (!NT_SUCCESS(Status)) {
goto Exit;
} Exit :
if (!NT_SUCCESS(Status)) { if (NULL != __FilterServerPort) {
FltCloseCommunicationPort(__FilterServerPort);
} if (NULL != __FilterHandle) {
FltUnregisterFilter(__FilterHandle);
}
}
return Status;
} //注册微过滤器时的结构填充： //微过滤器注册结构
CONST FLT_REGISTRATION FilterRegistration = { sizeof( FLT_REGISTRATION ), // Size 大小
FLT_REGISTRATION_VERSION, // Version 版本
0, // Flags 标志位传0 NULL, // Context
Callbacks, //回调函数数组 // Operation callbacks 操作回调函数集注册，最重点！！！ MiniFilterUnload, // MiniFilterUnload 卸载回调函数
//安装 回调函数
MiniFilterInstanceSetup, // InstanceSetup
MiniFilterInstanceQueryTeardown, // InstanceQueryTeardown
MiniFilterInstanceTeardownStart, // InstanceTeardownStart
MiniFilterInstanceTeardownComplete, // InstanceTeardownComplete NULL, // GenerateFileName 生成文件名回调
NULL, // GenerateDestinationFileName
NULL // NormalizeNameComponent }; 结构中的回调函数数组： //过滤函数数组
//声明过后，通过注册，IRP包就会顺利地通过这里指定的函数被处理
CONST FLT_OPERATION_REGISTRATION Callbacks[] = { { IRP_MJ_CREATE, //主功能号 系统接收到标志为IRP_MJ_CREATE的IRP包，自动调用预处理函数和后处理函数
0, //标志位，传0表示操作读写回调
MiniFilterPreOperation, //生成（设置）预操作回调函数
MiniFilterPostOperation }, //生成后操作回调函数
{ IRP_MJ_OPERATION_END } //最后一个元素IRP_MJ_OPERATION_END，告诉过滤管理元素个数
}; 数组中的预操作回调函数
系统接收到标志为IRP_MJ_CREATE的IRP包，自动调用预处理函数和后处理函数 FLT_PREOP_CALLBACK_STATUS
MiniFilterPreOperation (
_Inout_ PFLT_CALLBACK_DATA Data, //回调数据包，代表一个IO操作
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *CompletionContext
) {
NTSTATUS Status;
//存放文件名的缓冲区
char FileNameData[MAX_PATH] = {0};
PFLT_FILE_NAME_INFORMATION FileNameInfo = NULL;
//用宏掩盖不使用的参数，编译不警告
UNREFERENCED_PARAMETER( FltObjects );
UNREFERENCED_PARAMETER( CompletionContext ); DbgPrint("MiniFilterPreOperation\r\n"); __try
{
Status = FltGetFileNameInformation(Data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT,
&FileNameInfo); if (NT_SUCCESS(Status))
{
//客户端命令：阻塞还是放行
if (__UserCommand==USER_BLOCK)
{
FltParseFileNameInformation(FileNameInfo);
if (UnicodeStringToChar(FileNameData,&FileNameInfo->Name)) //字符串转化为char大写，便于比较
{ if (strstr(FileNameData, "NOTEPAD.EXE") > 0) { Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
FltReleaseFileNameInformation(FileNameInfo);
return FLT_PREOP_COMPLETE;
}
} }
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{ }
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
} 二.minifilter与应用程序通信（从端口这一点来看，minifilter应该是封装的LPC或者ALPC） 1.创建通信端口 PSECURITY_DESCRIPTOR SecurityDescriptor;
OBJECT_ATTRIBUTES ObjectAttributes;
Status = FltBuildDefaultSecurityDescriptor(&SecurityDescriptor, FLT_PORT_ALL_ACCESS); if (!NT_SUCCESS(Status))
{
goto Exit;
} RtlInitUnicodeString(&MiniFilterPortName, MINI_FILTER_PORT_NAME);
//初始化ObjectAttributes，包含端口名MiniFilterPortName，方便Ring3应用层使用
InitializeObjectAttributes(&ObjectAttributes,
&MiniFilterPortName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, //OBJ_KERNEL_HANDLE 必需？？？
NULL,
SecurityDescriptor);
//创建通信端口
Status = FltCreateCommunicationPort(__FilterHandle,
&__FilterServerPort, //监听连接请求的端口
&ObjectAttributes, //
NULL,
MiniFilterConnect, //用户态连接后的回调函数
MiniFilterDisconnect,
MiniFilterDeviceIoControl, //MessageNotifyCallback 接受消息的回调函数
1); 2.用户层连接通信端口，返回句柄 int InitialCommunicationPort(void)
{
//MiniFilter 的通信机制 封装的LPC和ALPC？？？？
//端口连接
DWORD Status = FilterConnectCommunicationPort(
MINI_FILTER_PORT_NAME, //(通信端口名称)用于连接
0,
NULL,
0,
NULL,
&__PortHandle); //通过Ring3应用层返回的端口句柄__PortHandle与驱动通信 if (Status != S_OK) {
return Status;
}
return 0;
} 3.触发minifilter连接回调函数 NTSTATUS
MiniFilterConnect(
__in PFLT_PORT ClientPort,
__in PVOID ServerPortCookie,
__in_bcount(SizeOfContext) PVOID ConnectionContext,
__in ULONG SizeOfContext,
__deref_out_opt PVOID *ConnectionCookie
)
{
DbgPrint("MiniFilterConnect()\r\n");
PAGED_CODE(); UNREFERENCED_PARAMETER(ServerPortCookie);
UNREFERENCED_PARAMETER(ConnectionContext);
UNREFERENCED_PARAMETER(SizeOfContext);
UNREFERENCED_PARAMETER(ConnectionCookie); __FilterClientPort = ClientPort; //通信端口句柄
return STATUS_SUCCESS;
} 4.应用层向minifilter发送消息
int MiniFilterDeviceIoControl(USER_COMMAND UserCommand)
{
DWORD ReturnLength = 0;
DWORD Status = 0;
//同步还是异步 ?? ---> 同步机制
//同步操作，直到消息被传递并受到驱动的reply
//发送消息到内核层
Status = FilterSendMessage(
__PortHandle, //通信端口句柄
&UserCommand,
sizeof(USER_COMMAND),
NULL, //驱动的reply，传的NULL
NULL,
&ReturnLength); if (Status != S_OK)
{
return Status;
}
return 0;
} 5.minifilter注册的MessageNotifyCallback 接受消息的回调函数 NTSTATUS
MiniFilterDeviceIoControl(
__in PVOID ConnectionCookie,
__in_bcount_opt(InputBufferSize) PVOID InputBuffer,
__in ULONG InputBufferSize,
__out_bcount_part_opt(OutputBufferSize, *ReturnOutputBufferLength) PVOID OutputBuffer,
__in ULONG OutputBufferSize,
__out PULONG ReturnOutputBufferLength
)
{ enum _USER_COMMAND_ UserCommand;
NTSTATUS Status; PAGED_CODE(); UNREFERENCED_PARAMETER(ConnectionCookie);
UNREFERENCED_PARAMETER(OutputBufferSize);
UNREFERENCED_PARAMETER(OutputBuffer); DbgPrint("MiniFilterDeviceIoControl()\r\n"); if ((InputBuffer != NULL) &&
(InputBufferSize == sizeof(USER_COMMAND)))
{ try { UserCommand = *((USER_COMMAND*)InputBuffer); } except(EXCEPTION_EXECUTE_HANDLER)
{ return GetExceptionCode();
} switch (UserCommand)
{
case USER_PASS:
{ __UserCommand = USER_PASS;
Status = STATUS_SUCCESS;
break;
}
case USER_BLOCK:
{ __UserCommand = USER_BLOCK; //__UserCommand 传给预操作函数或者后操作函数的值
Status = STATUS_SUCCESS;
break;
} default:
Status = STATUS_INVALID_PARAMETER;
break;
}
}
else { Status = STATUS_INVALID_PARAMETER;
} return Status;
}
0x03 功能实现
程序实现的功能是拦截关于Notepad.exe的一切主功能码为IRP_MJ_CREATE的IRP包，使得Notepad.exe无法创建，存在的Notepad文件无法打开。
如图所示，双击一个txt文档将无法打开：
源代码：
#include "MiniFilter.h"
#include "__String.h" //注意把inf文件中的 Instance1.Altitude = "370030" 注释去掉 PFLT_FILTER __FilterHandle = NULL;
USER_COMMAND __UserCommand = USER_BLOCK;
PFLT_PORT __FilterServerPort = NULL; //监听
PFLT_PORT __FilterClientPort = NULL; //通信 //过滤函数数组
//声明过后，通过注册，IRP包就会顺利地通过这里指定的函数被处理
CONST FLT_OPERATION_REGISTRATION Callbacks[] = { { IRP_MJ_CREATE, //主功能号 系统接收到标志为IRP_MJ_CREATE的IRP包，自动调用预处理函数和后处理函数
, //标志位，传0表示操作读写回调
MiniFilterPreOperation, //生成（设置）预操作回调函数
MiniFilterPostOperation }, //生成后操作回调函数 { IRP_MJ_OPERATION_END } //最后一个元素IRP_MJ_OPERATION_END，告诉过滤管理元素个数
}; //微过滤器注册结构
CONST FLT_REGISTRATION FilterRegistration = { sizeof( FLT_REGISTRATION ), // Size 大小
FLT_REGISTRATION_VERSION, // Version 版本
, // Flags 标志位传0 NULL, // Context
Callbacks, //回调函数数组 // Operation callbacks 操作回调函数集注册，最重点！！！ MiniFilterUnload, // MiniFilterUnload 卸载回调函数
//安装 回调函数
MiniFilterInstanceSetup, // InstanceSetup
MiniFilterInstanceQueryTeardown, // InstanceQueryTeardown
MiniFilterInstanceTeardownStart, // InstanceTeardownStart
MiniFilterInstanceTeardownComplete, // InstanceTeardownComplete NULL, // GenerateFileName 生成文件名回调
NULL, // GenerateDestinationFileName
NULL // NormalizeNameComponent }; NTSTATUS
DriverEntry (
_In_ PDRIVER_OBJECT DriverObject,
_In_ PUNICODE_STRING RegistryPath
)
{
NTSTATUS Status;
UNICODE_STRING MiniFilterPortName;
PSECURITY_DESCRIPTOR SecurityDescriptor;
OBJECT_ATTRIBUTES ObjectAttributes;
UNREFERENCED_PARAMETER( RegistryPath ); //不用该参数 //向过滤管理器注册微过滤器
Status = FltRegisterFilter( DriverObject, //DriverEntry参数DriverObject
&FilterRegistration, //微过滤器注册结构
&__FilterHandle); //微过滤器句柄，全局保存 if (NT_SUCCESS(Status))
{
//开启过滤
Status = FltStartFiltering(__FilterHandle); if (!NT_SUCCESS(Status))
{
//开启失败注销微过滤器
goto Exit;
}
}
else
{
goto Exit;
}
Status = FltBuildDefaultSecurityDescriptor(&SecurityDescriptor, FLT_PORT_ALL_ACCESS); if (!NT_SUCCESS(Status))
{
goto Exit;
} RtlInitUnicodeString(&MiniFilterPortName, MINI_FILTER_PORT_NAME);
//初始化ObjectAttributes，包含端口名MiniFilterPortName，方便Ring3应用层使用
InitializeObjectAttributes(&ObjectAttributes,
&MiniFilterPortName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, //OBJ_KERNEL_HANDLE 必需？？？
NULL,
SecurityDescriptor);
//创建通信端口
Status = FltCreateCommunicationPort(__FilterHandle,
&__FilterServerPort, //监听连接请求的端口
&ObjectAttributes, //
NULL,
MiniFilterConnect, //用户态连接后的回调函数
MiniFilterDisconnect,
MiniFilterDeviceIoControl, //MessageNotifyCallback 接受消息的回调函数
); FltFreeSecurityDescriptor(SecurityDescriptor); if (!NT_SUCCESS(Status)) {
goto Exit;
} Exit :
if (!NT_SUCCESS(Status)) { if (NULL != __FilterServerPort) {
FltCloseCommunicationPort(__FilterServerPort);
} if (NULL != __FilterHandle) {
FltUnregisterFilter(__FilterHandle);
}
}
return Status;
} NTSTATUS
MiniFilterConnect(
__in PFLT_PORT ClientPort,
__in PVOID ServerPortCookie,
__in_bcount(SizeOfContext) PVOID ConnectionContext,
__in ULONG SizeOfContext,
__deref_out_opt PVOID *ConnectionCookie
)
{
DbgPrint("MiniFilterConnect()\r\n");
PAGED_CODE(); UNREFERENCED_PARAMETER(ServerPortCookie);
UNREFERENCED_PARAMETER(ConnectionContext);
UNREFERENCED_PARAMETER(SizeOfContext);
UNREFERENCED_PARAMETER(ConnectionCookie); __FilterClientPort = ClientPort;
return STATUS_SUCCESS;
} VOID
MiniFilterDisconnect(
__in_opt PVOID ConnectionCookie
)
{
PAGED_CODE();
UNREFERENCED_PARAMETER(ConnectionCookie);
DbgPrint("MiniFilterDisconnect()\r\n"); // Close our handle
FltCloseClientPort(__FilterHandle, &__FilterClientPort);
} NTSTATUS
MiniFilterDeviceIoControl(
__in PVOID ConnectionCookie,
__in_bcount_opt(InputBufferSize) PVOID InputBuffer,
__in ULONG InputBufferSize,
__out_bcount_part_opt(OutputBufferSize, *ReturnOutputBufferLength) PVOID OutputBuffer,
__in ULONG OutputBufferSize,
__out PULONG ReturnOutputBufferLength
)
{ enum _USER_COMMAND_ UserCommand;
NTSTATUS Status; PAGED_CODE(); UNREFERENCED_PARAMETER(ConnectionCookie);
UNREFERENCED_PARAMETER(OutputBufferSize);
UNREFERENCED_PARAMETER(OutputBuffer); DbgPrint("MiniFilterDeviceIoControl()\r\n"); if ((InputBuffer != NULL) &&
(InputBufferSize == sizeof(USER_COMMAND)))
{ try { UserCommand = *((USER_COMMAND*)InputBuffer); } except(EXCEPTION_EXECUTE_HANDLER)
{ return GetExceptionCode();
} switch (UserCommand)
{
case USER_PASS:
{ __UserCommand = USER_PASS;
Status = STATUS_SUCCESS;
break;
}
case USER_BLOCK:
{ __UserCommand = USER_BLOCK;
Status = STATUS_SUCCESS;
break;
} default:
Status = STATUS_INVALID_PARAMETER;
break;
}
}
else { Status = STATUS_INVALID_PARAMETER;
} return Status;
}
NTSTATUS
MiniFilterUnload (
_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
{
UNREFERENCED_PARAMETER(Flags);
PAGED_CODE(); DbgPrint("MiniFilter!MiniFilterUnload: Entered\n"); //用来释放已注册的微过滤器在Windows内核内部所使用的资源
//关闭通信端口
FltCloseCommunicationPort(__FilterServerPort); FltUnregisterFilter(__FilterHandle); return STATUS_SUCCESS;
} FLT_PREOP_CALLBACK_STATUS
MiniFilterPreOperation (
_Inout_ PFLT_CALLBACK_DATA Data, //回调数据包，代表一个IO操作
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_Flt_CompletionContext_Outptr_ PVOID *CompletionContext
) {
NTSTATUS Status;
//存放文件名的缓冲区
char FileNameData[MAX_PATH] = {};
PFLT_FILE_NAME_INFORMATION FileNameInfo = NULL;
//用宏掩盖不使用的参数，编译不警告
UNREFERENCED_PARAMETER( FltObjects );
UNREFERENCED_PARAMETER( CompletionContext ); DbgPrint("MiniFilterPreOperation\r\n"); __try
{
Status = FltGetFileNameInformation(Data,
FLT_FILE_NAME_NORMALIZED |
FLT_FILE_NAME_QUERY_DEFAULT,
&FileNameInfo); if (NT_SUCCESS(Status))
{
//客户端命令：阻塞还是放行
if (__UserCommand==USER_BLOCK)
{
FltParseFileNameInformation(FileNameInfo);
if (UnicodeStringToChar(FileNameData,&FileNameInfo->Name)) //字符串转化为char大写，便于比较
{ if (strstr(FileNameData, "NOTEPAD.EXE") > ) { Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = ;
FltReleaseFileNameInformation(FileNameInfo);
return FLT_PREOP_COMPLETE;
}
} }
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{ }
return FLT_PREOP_SUCCESS_WITH_CALLBACK;
} FLT_POSTOP_CALLBACK_STATUS
MiniFilterPostOperation (
_Inout_ PFLT_CALLBACK_DATA Data,
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_opt_ PVOID CompletionContext,
_In_ FLT_POST_OPERATION_FLAGS Flags
)
{
UNREFERENCED_PARAMETER( Data );
UNREFERENCED_PARAMETER( FltObjects );
UNREFERENCED_PARAMETER( CompletionContext );
UNREFERENCED_PARAMETER( Flags ); return FLT_POSTOP_FINISHED_PROCESSING;
} NTSTATUS
MiniFilterInstanceSetup(
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_ FLT_INSTANCE_SETUP_FLAGS Flags,
_In_ DEVICE_TYPE VolumeDeviceType,
_In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
) {
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(Flags);
UNREFERENCED_PARAMETER(VolumeDeviceType);
UNREFERENCED_PARAMETER(VolumeFilesystemType); PAGED_CODE(); return STATUS_SUCCESS;
} NTSTATUS
MiniFilterInstanceQueryTeardown(
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
) {
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(Flags); PAGED_CODE(); return STATUS_SUCCESS;
} VOID
MiniFilterInstanceTeardownStart(
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
) {
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(Flags);
PAGED_CODE(); } VOID
MiniFilterInstanceTeardownComplete(
_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
) {
UNREFERENCED_PARAMETER(FltObjects);
UNREFERENCED_PARAMETER(Flags); PAGED_CODE();
}
MiniFilter.c
// MiniFilter(User).cpp : 定义控制台应用程序的入口点。
// #include "stdafx.h"
#include <windows.h> typedef enum _USER_COMMAND_
{
USER_PASS = ,
USER_BLOCK
}USER_COMMAND; typedef
int(*LPFN_MINIFILTERDEVICEIOCONTROL)(USER_COMMAND UserCommand); int main()
{ HMODULE ModuleBase = LoadLibrary(L"MiniFilter-Dll.dll");
if (ModuleBase==NULL)
{
return ;
}
//向驱动发送消息
LPFN_MINIFILTERDEVICEIOCONTROL MiniFilterDeviceIoControl =
(LPFN_MINIFILTERDEVICEIOCONTROL)GetProcAddress(ModuleBase, "MiniFilterDeviceIoControl"); if (MiniFilterDeviceIoControl==NULL)
{ goto Exit;
} printf("0..放行\r\n");
printf("1..拦截\r\n"); ULONG i;
scanf("%d", &i);
switch (i)
{
case :
{
MiniFilterDeviceIoControl(USER_PASS);
break;
}
case :
{
MiniFilterDeviceIoControl(USER_BLOCK);
break;
}
default:
break;
}
Exit:
FreeLibrary(ModuleBase);
ModuleBase = NULL;
return ;
}
MiniFilter(User).cpp
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include <FltUser.h>
#pragma comment(lib, "fltLib.lib")
typedef enum _USER_COMMAND_
{
USER_PASS = ,
USER_BLOCK
}USER_COMMAND; #define MINI_FILTER_PORT_NAME L"\\MiniFilterPort"
HANDLE __PortHandle = INVALID_HANDLE_VALUE; int InitialCommunicationPort(void);
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH: //载入Dll成功时呼叫此功能码
{ InitialCommunicationPort();
break;
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH: //卸载Dll成功时呼叫此功能码
{ if (__PortHandle!=NULL)
{
CloseHandle(__PortHandle);
__PortHandle = NULL;
}
}
break;
}
return TRUE;
}
int InitialCommunicationPort(void)
{
//MiniFilter 的通信机制 封装的LPC和ALPC？？？？
//端口连接
DWORD Status = FilterConnectCommunicationPort(
MINI_FILTER_PORT_NAME, //(通信端口名称)用于连接
,
NULL,
,
NULL,
&__PortHandle); //通过Ring3应用层返回的端口句柄__PortHandle与驱动通信 if (Status != S_OK) {
return Status;
}
return ;
} int MiniFilterDeviceIoControl(USER_COMMAND UserCommand)
{
DWORD ReturnLength = ;
DWORD Status = ;
//同步还是异步 ?? ---> 同步机制
//同步操作，直到消息被传递并受到驱动的reply
//发送消息到内核层
Status = FilterSendMessage(
__PortHandle,
&UserCommand,
sizeof(USER_COMMAND),
NULL, //驱动的reply，传的NULL
NULL,
&ReturnLength); if (Status != S_OK)
{
return Status;
}
return ;
}
dllmain.cpp