Writing Kernel-Mode Drivers

#include <ntddk.h>

// Define a unique identifier for your driver.
// This should be generated using Guidgen.exe or similar tools.
DEFINE_GUID(GUID_MY_DRIVER_DEVICE, 0x12345678, 0x9abc, 0xdef0, 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0);

// Function prototypes
VOID DriverUnload(PDRIVER_OBJECT DriverObject);
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);
NTSTATUS CreateClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
NTSTATUS Read(PDEVICE_OBJECT DeviceObject, PIRP Irp);
NTSTATUS Write(PDEVICE_OBJECT DeviceObject, PIRP Irp);

// This routine is called by the system when the driver is loaded.
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    NTSTATUS status;
    PDEVICE_OBJECT deviceObject;
    UNICODE_STRING deviceName;
    UNICODE_STRING symbolicLinkName;

    // Set the unload routine.
    DriverObject->DriverUnload = DriverUnload;

    // Set dispatch routines.
    DriverObject->MajorFunction[IRP_MJ_CREATE] = CreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = CreateClose;
    DriverObject->MajorFunction[IRP_MJ_READ] = Read;
    DriverObject->MajorFunction[IRP_MJ_WRITE] = Write;

    // Define the device name.
    RtlInitUnicodeString(&deviceName, L"\\Device\\MyKernelDriver");

    // Create the device object.
    status = IoCreateDevice(
        DriverObject,
        0, // Device extension size (none in this simple example)
        &deviceName,
        FILE_DEVICE_UNKNOWN, // Device type
        0, // Device characteristics
        FALSE, // Not exclusive
        &deviceObject
    );

    if (!NT_SUCCESS(status)) {
        return status;
    }

    // Create a symbolic link so the device can be accessed from user mode.
    RtlInitUnicodeString(&symbolicLinkName, L"\\??\\MyKernelDriver");
    status = IoCreateSymbolicLink(&symbolicLinkName, &deviceName);

    if (!NT_SUCCESS(status)) {
        IoDeleteDevice(deviceObject);
        return status;
    }

    // Set device flags (optional, e.g., to indicate that the device will generate
    // interrupts, or needs special handling).
    // deviceObject->Flags |= DO_BUFFERED_IO;

    DbgPrint("MyKernelDriver: DriverEntry successful.\n");

    return STATUS_SUCCESS;
}

// This routine is called by the system when the driver is unloaded.
VOID DriverUnload(PDRIVER_OBJECT DriverObject) {
    UNICODE_STRING symbolicLinkName;

    DbgPrint("MyKernelDriver: Unloading driver...\n");

    // Delete the symbolic link.
    RtlInitUnicodeString(&symbolicLinkName, L"\\??\\MyKernelDriver");
    IoDeleteSymbolicLink(&symbolicLinkName);

    // Delete the device object.
    IoDeleteDevice(DriverObject->DeviceObject);

    DbgPrint("MyKernelDriver: Driver unloaded.\n");
}

// Handles IRP_MJ_CREATE and IRP_MJ_CLOSE requests.
NTSTATUS CreateClose(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

    switch (irpSp->MajorFunction) {
        case IRP_MJ_CREATE:
            DbgPrint("MyKernelDriver: Create called.\n");
            break;
        case IRP_MJ_CLOSE:
            DbgPrint("MyKernelDriver: Close called.\n");
            break;
        default:
            // Should not happen for this handler
            status = STATUS_INVALID_DEVICE_REQUEST;
            break;
    }

    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

// Handles IRP_MJ_READ requests.
NTSTATUS Read(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

    DbgPrint("MyKernelDriver: Read called.\n");

    // In a real driver, you would read data from hardware here.
    // For this example, we just complete the request successfully.

    Irp->IoStatus.Information = 0; // Number of bytes transferred
    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

// Handles IRP_MJ_WRITE requests.
NTSTATUS Write(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

    DbgPrint("MyKernelDriver: Write called.\n");

    // In a real driver, you would write data to hardware here.
    // For this example, we just complete the request successfully.

    Irp->IoStatus.Information = 0; // Number of bytes transferred
    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}