Windows Kernel I/O Documentation

Introduction to Windows Kernel I/O

The Windows kernel provides a comprehensive I/O subsystem that abstracts hardware devices and file systems through a unified model. This documentation covers the core concepts, structures, and APIs that developers use when building drivers or interacting with low‑level I/O operations.

Key Concepts

Device Objects: Represent logical connections to physical devices.
IRPs (I/O Request Packets): Primary mechanism for communicating I/O requests.
IOCTL (I/O Control Codes): Define custom operations for device drivers.
Buffering Modes: Direct, Buffered, and Neither I/O.

Typical I/O Flow

Stage	Description
1. User‑mode Request	Application calls `ReadFile/WriteFile` or `DeviceIoControl`.
2. I/O Manager	Creates an IRP and routes it to the appropriate driver.
3. Driver Dispatch	Driver handles the IRP in its dispatch routine.
4. Completion	IRP completed, status returned to user mode.

Sample Driver Dispatch Routine

NTSTATUS
DriverDispatch(
    _In_ PDEVICE_OBJECT DeviceObject,
    _Inout_ PIRP Irp
)
{
    UNREFERENCED_PARAMETER(DeviceObject);
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

For a deeper dive, explore the linked sections in the sidebar.