允许驱动程序在Windows中停止？ [英] Allow Driver to Stop in Windows?

问题描述

Windows上的某些驱动程序，例如 Null 和 Beep ，可以通过 ControlService（...，SERVICE_CONTROL_STOP，...）操作。但是，大多数其他驱动程序在系统运行时都无法停止并重新启动。

Some drivers on Windows, like Null and Beep, can be arbitrarily stopped and re-started through the ControlService(..., SERVICE_CONTROL_STOP, ...) operation. Most other drivers, however, cannot be stopped and restarted while the system is running.

我正在制作自己的驱动程序。如何告诉Windows我的驱动程序可以停止？

I'm making my own driver. How can I tell Windows that my driver can be stopped?

推荐答案

事实证明，您需要添加 DriverUnload 函数：

It turns out that you need to add a DriverUnload function:

VOID NTAPI DriverUnload(IN DRIVER_OBJECT *DriverObject) { }

NTSTATUS NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject,
                           IN PUNICODE_STRING RegistryPath)
{
    DriverObject->DriverUnload = DriverUnload; // <--- add this
    return STATUS_SUCCESS;
}

但是，这仅在您与 / DRIVER 。

如果您要链接 / DRIVER：WDM （意味着在 DllCharacteristics 字段中设置了 IMAGE_DLLCHARACTERISTICS_WDM_DRIVER ），这似乎是不够的。我认为您可能需要做更多的事情，例如处理IRP。所以也检查一下。

However, this is only sufficient if you're linking with /DRIVER.
If you're linking with /DRIVER:WDM (meaning that IMAGE_DLLCHARACTERISTICS_WDM_DRIVER is set in the DllCharacteristics field) then it seems like this isn't sufficient. I think you may need to do more things, like handling IRPs as well. So check that too.

这篇关于允许驱动程序在Windows中停止？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！