Sunday, May 12, 2013
DriverEntry
NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath):
_DRIVER_OBJECT:
DriverName: 一般为\Driver\<驱动名称>(与设备命名规则类似:\Device\<设备名称>)
PUNICODE_STRING HardwareDatabase:指向注册表中硬件配置信息的路径,用Unicode字符串表示。该字符串内容一般为\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM。
RegistryPath:
8660f008 5c 00 52 00 45 00 47 00-49 00 53 00 54 00 52 00 \.R.E.G.I.S.T.R.
8660f018 59 00 5c 00 4d 00 41 00-43 00 48 00 49 00 4e 00 Y.\.M.A.C.H.I.N.
8660f028 45 00 5c 00 53 00 59 00-53 00 54 00 45 00 4d 00 E.\.S.Y.S.T.E.M.
8660f038 5c 00 43 00 6f 00 6e 00-74 00 72 00 6f 00 6c 00 \.C.o.n.t.r.o.l.
8660f048 53 00 65 00 74 00 30 00-30 00 31 00 5c 00 53 00 S.e.t.0.0.1.\.S.
8660f058 65 00 72 00 76 00 69 00-63 00 65 00 73 00 5c 00 e.r.v.i.c.e.s.\.
8660f068 48 00 65 00 6c 00 6c 00-6f 00 57 00 44 00 4d 00 H.e.l.l.o.W.D.M.
节选自<<张帆>>:驱动加载的时候,系统进程启动新的线程,利用对象管理器创建_DRIVER_OBJECT,利用配置管理器获取RegistryPath(如果以后想用这个字符串,需要复制到安全的地方)
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment