參考資訊:
https://wasm.in/
http://four-f.narod.ru/
https://github.com/steward-fu/ddk
main.asm
.386p
.model flat, stdcall
option casemap:none
include c:\masm32\include\w2k\hal.inc
include c:\masm32\include\w2k\ntstatus.inc
include c:\masm32\include\w2k\ntddk.inc
include c:\masm32\include\w2k\ntoskrnl.inc
include c:\masm32\include\w2k\ntddkbd.inc
include c:\masm32\Macros\Strings.mac
includelib c:\masm32\lib\wxp\i386\hal.lib
includelib c:\masm32\lib\wxp\i386\ntoskrnl.lib
public DriverEntry
MAX_THREAD equ 3
.data
myMutex KMUTEX <>
pNextDev PDEVICE_OBJECT 0
.const
MSG_ACQUIRING byte "Thread%d, Acquiring Mutex",0
MSG_ACQUIRED byte "Thread%d, Acquired Mutex",0
MSG_SLEEPING byte "Thread%d, Sleeping", 0
MSG_RELEASING byte "Thread%d, Releasing Mutex",0
MSG_RELEASED byte "Thread%d, Released Mutex",0
.code
MyThread proc pParam : DWORD
local stTime : LARGE_INTEGER
or stTime.HighPart, -1
mov stTime.LowPart, -10000000
invoke DbgPrint, offset MSG_ACQUIRING, pParam
invoke KeWaitForSingleObject, offset myMutex, Executive, KernelMode, FALSE, NULL
invoke DbgPrint, offset MSG_ACQUIRED, pParam
invoke DbgPrint, offset MSG_SLEEPING, pParam
invoke KeDelayExecutionThread, KernelMode, FALSE, addr stTime
invoke DbgPrint, offset MSG_RELEASING, pParam
invoke KeReleaseMutex, offset myMutex, FALSE
invoke DbgPrint, offset MSG_RELEASED, pParam
invoke PsTerminateSystemThread, STATUS_SUCCESS
ret
MyThread endp
IrpPnp proc pMyDevice : PDEVICE_OBJECT, pIrp : PIRP
local szSymName : UNICODE_STRING
IoGetCurrentIrpStackLocation pIrp
movzx eax, (IO_STACK_LOCATION ptr [eax]).MinorFunction
.if eax == IRP_MN_START_DEVICE
mov eax, pIrp
mov (_IRP ptr [eax]).IoStatus.Status, STATUS_SUCCESS
.elseif eax == IRP_MN_REMOVE_DEVICE
invoke RtlInitUnicodeString, addr szSymName, $CTW0("\\DosDevices\\MyDriver")
invoke IoDeleteSymbolicLink, addr szSymName
mov eax, pIrp
mov (_IRP ptr [eax]).IoStatus.Status, STATUS_SUCCESS
invoke IoDetachDevice, pNextDev
invoke IoDeleteDevice, pMyDevice
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
ret
.endif
IoSkipCurrentIrpStackLocation pIrp
invoke IoCallDriver, pNextDev, pIrp
ret
IrpPnp endp
AddDevice proc pMyDriver : PDRIVER_OBJECT, pPhyDevice : PDEVICE_OBJECT
local pMyDevice : PDEVICE_OBJECT
local szDevName : UNICODE_STRING
local szSymName : UNICODE_STRING
invoke RtlInitUnicodeString, addr szDevName, $CTW0("\\Device\\MyDriver")
invoke RtlInitUnicodeString, addr szSymName, $CTW0("\\DosDevices\\MyDriver")
invoke IoCreateDevice, pMyDriver, 0, addr szDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, addr pMyDevice
.if eax == STATUS_SUCCESS
invoke IoAttachDeviceToDeviceStack, pMyDevice, pPhyDevice
.if eax != NULL
push eax
pop pNextDev
mov eax, pMyDevice
or (DEVICE_OBJECT ptr [eax]).Flags, DO_BUFFERED_IO
and (DEVICE_OBJECT ptr [eax]).Flags, not DO_DEVICE_INITIALIZING
invoke IoCreateSymbolicLink, addr szSymName, addr szDevName
.endif
.endif
ret
AddDevice endp
Unload proc pMyDriver : PDRIVER_OBJECT
ret
Unload endp
DriverEntry proc pMyDriver : PDRIVER_OBJECT, pMyRegistry : PUNICODE_STRING
local cnt : DWORD
local hThread : DWORD
mov eax, pMyDriver
mov (DRIVER_OBJECT ptr [eax]).MajorFunction[IRP_MJ_PNP * (sizeof PVOID)], offset IrpPnp
mov (DRIVER_OBJECT ptr [eax]).DriverUnload, offset Unload
mov eax, (DRIVER_OBJECT ptr [eax]).DriverExtension
mov (DRIVER_EXTENSION ptr [eax]).AddDevice, AddDevice
invoke KeInitializeMutex, offset myMutex, 0
mov cnt, 0
th:
invoke PsCreateSystemThread, addr hThread, THREAD_ALL_ACCESS, NULL, -1, NULL, offset MyThread, cnt
.if eax == STATUS_SUCCESS
invoke ZwClose, hThread
.endif
inc cnt
cmp cnt, MAX_THREAD
jnz th
mov eax, STATUS_SUCCESS
ret
DriverEntry endp
end
完成