原文发表于百度空间，2008-7-24
==========================================================================
这些是驱动中相关的数据结构．
驱动对象，由I/O管理器创建，用于管理设备(Device):
lkd> dt _DRIVER_OBJECT
ntdll!_DRIVER_OBJECT
+0x000 Type : Int2B
+0x002 Size : Int2B
+0x004 DeviceObject : Ptr32 _DEVICE_OBJECT //设备对象
+0x008 Flags : Uint4B
+0x00c DriverStart : Ptr32 Void
+0x010 DriverSize : Uint4B
+0x014 DriverSection : Ptr32 Void
+0x018 DriverExtension : Ptr32 _DRIVER_EXTENSION //指向
+0x01c DriverName : _UNICODE_STRING //驱动名称
+0x024 HardwareDatabase : Ptr32 _UNICODE_STRING //指向一个存储在注册表中的硬件描述
+0x028 FastIodispatch : Ptr32 _FAST_IO_disPATCH //快速IO派遣，还不太懂
+0x02c DriverInit : Ptr32 long //初始化例程
+0x030 DriverStartIo : Ptr32 void //
+0x034 DriverUnload : Ptr32 void //卸载例程
+0x038 MajorFunction : [28] Ptr32 long //各派遣例程指针，即IRP_MJ_XXX等
关于派遣例程：
[00] IRP_MJ_CREATE
[01] IRP_MJ_CREATE_NAMED_PIPE
[02] IRP_MJ_CLOSE
[03] IRP_MJ_READ
[04] IRP_MJ_WRITE
[05] IRP_MJ_QUERY_informatION
[06] IRP_MJ_SET_informatION
[07] IRP_MJ_QUERY_EA
[08] IRP_MJ_SET_EA
[09] IRP_MJ_FLUSH_BUFFERS
[0a] IRP_MJ_QUERY_VOLUME_informatION
[0b] IRP_MJ_SET_VOLUME_informatION
[0c] IRP_MJ_DIRECTORY_CONTROL
[0d] IRP_MJ_FILE_SYstem_CONTROL
[0e] IRP_MJ_DEVICE_CONTROL
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL
[10] IRP_MJ_SHUTDOWN
[11] IRP_MJ_LOCK_CONTROL
[12] IRP_MJ_CLEANUP
[13] IRP_MJ_CREATE_mailslot
[14] IRP_MJ_QUERY_Security
[15] IRP_MJ_SET_Security
[16] IRP_MJ_POWER
[17] IRP_MJ_SYstem_CONTROL
[18] IRP_MJ_DEVICE_CHANGE
[19] IRP_MJ_QUERY_QUOTA
[1a] IRP_MJ_SET_QUOTA
[1b] IRP_MJ_PNP
驱动扩展:
lkd> dt _DRIVER_EXTENSION
ntdll!_DRIVER_EXTENSION
+0x000 DriverObject : Ptr32 _DRIVER_OBJECT
+0x004 AddDevice : Ptr32 long
+0x008 Count : Uint4B
+0x00c ServiceKeyName : _UNICODE_STRING
+0x014 ClientDriverExtension : Ptr32 _IO_CLIENT_EXTENSION
+0x018 FsFilterCallbacks : Ptr32 _FS_FILTER_CALLBACKS
设备对象:
lkd> dt _DEVICE_OBJECT
ntdll!_DEVICE_OBJECT
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 ReferenceCount : Int4B
+0x008 DriverObject : Ptr32 _DRIVER_OBJECT
+0x00c NextDevice : Ptr32 _DEVICE_OBJECT //从这儿看设备对象也是成链
+0x010 AttachedDevice : Ptr32 _DEVICE_OBJECT
+0x014 CurrentIrp : Ptr32 _IRP
+0x018 Timer : Ptr32 _IO_TIMER
+0x01c Flags : Uint4B
+0x020 characteristics : Uint4B
+0x024 Vpb : Ptr32 _VPB
+0x028 DeviceExtension : Ptr32 Void
+0x02c DeviceType : Uint4B
+0x030 StackSize : Char
+0x034 Queue : __unnamed
+0x05c AlignmentRequirement : Uint4B
+0x060 DeviceQueue : _KDEVICE_QUEUE
+0x074 Dpc : _KDPC
+0x094 ActiveThreadCount : Uint4B
+0x098 SecurityDescriptor : Ptr32 Void
+0x09c DeviceLock : _KEVENT
+0x0ac SectorSize : Uint2B
+0x0ae Spare1 : Uint2B
+0x0b0 DeviceObjectExtension : Ptr32 _DEVOBJ_EXTENSION
+0x0b4 Reserved : Ptr32 Void
设备对象扩展：
lkd> dt _DEVOBJ_EXTENSION
ntdll!_DEVOBJ_EXTENSION
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 DeviceObject : Ptr32 _DEVICE_OBJECT
+0x008 PowerFlags : Uint4B
+0x00c Dope : Ptr32 _DEVICE_OBJECT_POWER_EXTENSION
+0x010 ExtensionFlags : Uint4B
+0x014 DeviceNode : Ptr32 Void
+0x018 AttachedTo : Ptr32 _DEVICE_OBJECT
+0x01c StartIoCount : Int4B
+0x020 StartIoKey : Int4B
+0x024 StartIoFlags : Uint4B
+0x028 Vpb : Ptr32 _VPB
IRP(相当重要)：
lkd> dt _IRP
ntdll!_IRP
+0x000 Type : Int2B
+0x002 Size : Uint2B
+0x004 MdlAddress : Ptr32 _MDL
+0x008 Flags : Uint4B
+0x00c AssociatedIrp : __unnamed
+0x010 ThreadListEntry : _LIST_ENTRY
+0x018 IoStatus : _IO_STATUS_BLOCK
+0x020 RequestorMode : Char
+0x021 PendingReturned : UChar
+0x022 StackCount : Char
+0x023 CurrentLocation : Char
+0x024 Cancel : UChar
+0x025 CancelIrql : UChar
+0x026 ApcEnvironment : Char
+0x027 AllocationFlags : UChar
+0x028 UserIosb : Ptr32 _IO_STATUS_BLOCK
+0x02c UserEvent : Ptr32 _KEVENT
+0x030 Overlay : __unnamed
+0x038 CancelRoutine : Ptr32 void
+0x03c UserBuffer : Ptr32 Void //用户的输入缓冲区指针
+0x040 Tail : __unnamed
lkd> dt _IO_STATUS_BLOCKntdll!_IO_STATUS_BLOCK +0x000 Status : Int4B +0x000 Pointer : Ptr32 Void +0x004 information : Uint4B
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。
