驱动程序的同步处理

VOID 
  KeRaiseIrql(
    IN KIRQL  NewIrql, //新IRQL
    OUT PKIRQL  OldIrql//当前的IRQL
    );
VOID 
  KeLowerIrql(
    IN KIRQL  NewIrql //新IRQL
    );

VOID 
  KeInitializeSpinLock(
    IN PKSPIN_LOCK  SpinLock
    );

VOID 
  KeAcquireSpinLock(
    IN PKSPIN_LOCK  SpinLock,
    OUT PKIRQL  OldIrql //自旋锁以前所处的IRQL
    );

NTSTATUS 
  PsCreateSystemThread(
    OUT PHANDLE  ThreadHandle, //线程的句柄指针，这个参数作为一个输出参数
    IN ULONG  DesiredAccess,//新线程的权限，在驱动中这个值一般给0
    IN POBJECT_ATTRIBUTES  ObjectAttributes  OPTIONAL,//线程的属性，一般给NULL
    IN HANDLE  ProcessHandle  OPTIONAL,//该线程所属的进程句柄，如果给NULL表示创建一个系统进程的线程
    OUT PCLIENT_ID  ClientId  OPTIONAL,//指向客户结构的一个指针，在驱动中这个值一般给NULL
    IN PKSTART_ROUTINE  StartRoutine,//新线程的函数地址
    IN PVOID  StartContext//线程函数的参数
    );

PEPROCESS pEprocess = IoGetCurrentProcess();
ASSERT(NULL != pEprocess);
DbgPrint("the process name is %S\n", (PTSTR)((ULONG)pEprocess + 0x174));

VOID MyProcessThread(PVOID pContext)
{
    //获取当前发送IRP请求的线程名
    PEPROCESS pCurrProcess = IoGetCurrentProcess();
    PTSTR pProcessName = (PTSTR)((CHAR*)pCurrProcess + 0x174);
//  UNREFERENCED_PARAMETER(pContext);
    DbgPrint("MyProcessThread Current Process %s\n", pProcessName);
    PsTerminateSystemThread(0);
}

VOID SystemThread(PVOID pContext)
{
    //获取系统进程名
    PEPROCESS pCurrProcess = IoGetCurrentProcess();
    PTSTR pProcessName = (PTSTR)((CHAR*)pCurrProcess + 0x174);
//  UNREFERENCED_PARAMETER(pContext);
    DbgPrint("MyProcessThread Current Process %s\n", pProcessName);
    PsTerminateSystemThread(0);
}

VOID CreateThread_Test()
{
    HANDLE hSysThread = NULL;
    HANDLE hMyProcThread = NULL;
    NTSTATUS status;
    //创建系统进程
    status = PsCreateSystemThread(&hSysThread, 0, NULL, NULL, NULL, SystemThread, NULL);
    //创建用户进程
    status = PsCreateSystemThread(&hMyProcThread, 0, NULL, NtCurrentProcess(), NULL, MyProcessThread, NULL);
}

NTSTATUS 
  KeWaitForSingleObject(
    IN PVOID  Object, /第一个参数是一个指向同步对象的指针
    IN KWAIT_REASON  WaitReason,//第二个参数是等待原因，在驱动中这个值应该被设置为Executive
    IN KPROCESSOR_MODE  WaitMode,//等待模式，处在低优先级的驱动应该将这个值设置为KernelMode
    IN BOOLEAN  Alertable,//是否是警惕的
    IN PLARGE_INTEGER  Timeout  OPTIONAL//等待时间，如果是正数则表示从1601年1月1日到现在的时间如果是负数则表示从现在算起的时间，单位是100ns
    );

VOID 
  KeInitializeEvent(
    IN PRKEVENT  Event, //事件对象的指针
    IN EVENT_TYPE  Type, //事件类型，一般分为两种：NotificationEvent 通知事件和同步事件SynchronizationEvent
    IN BOOLEAN  State//是否是激发状态
    );

LONG 
  KeSetEvent(
    IN PRKEVENT  Event, //事件对象的指针
    IN KPRIORITY  Increment,//被唤起的线程将以何种优先级执行，这个参数与IoCompleteRequest的第二个参数含义相同
    IN BOOLEAN  Wait //一般给FALSE
    );

VOID Event_Test()
{
    KEVENT keEvent;
    HANDLE hThread;
    //初始化事件对象，并设置为无信号
    KeInitializeEvent(&keEvent, NotificationEvent, FALSE);
    //创建新线程,将事件对象传入线程函数中，新线程将会设置事件对象为有状态
    PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, EventThread, &keEvent);
    if(NULL == hThread)
    {
        DbgPrint("Create Event Thread Error!\n");
        return;
    }

    KeWaitForSingleObject(&keEvent, Executive, KernelMode, FALSE, NULL);
}

VOID EventThread(PVOID pContext)
{
    PKEVENT pEvent = (PKEVENT)pContext;
    DbgPrint("This is Event Thread\n");
    KeSetEvent(pEvent, IO_NO_INCREMENT, FALSE);
    PsTerminateSystemThread(0);
}

NTSTATUS 
  ObReferenceObjectByHandle(
    IN HANDLE  Handle, //用户层传下来的内核对象句柄
    IN ACCESS_MASK  DesiredAccess, //访问权限对于同步事件一般给EVENT_MODIFY_STATE
    IN POBJECT_TYPE  ObjectType  OPTIONAL,//转化何种类型的内核结构
    IN KPROCESSOR_MODE  AccessMode,//模式，一般有KernelMode和UserMode
    OUT PVOID  *Object,//对应结构的指针
    OUT POBJECT_HANDLE_INFORMATION  HandleInformation  OPTIONAL//这个参数在内核模式下为NULL
    );

else if(IOCTL_TRANS_EVENT == pIrps->Parameters.DeviceIoControl.IoControlCode)
    {
        //接收从应用层下发的下来的事件句柄
        hEvent = *(PHANDLE)(Irp->AssociatedIrp.SystemBuffer);
        if(NULL == hEvent)
        {
            DbgPrint("Invalied Handle\n");
            goto __RET;
        }

        status = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE, *ExEventObjectType, KernelMode, &pkEvent, NULL);
        if(!NT_SUCCESS(status))
        {
            //失败
            DbgPrint("Translate Event Error\n");
            goto __RET;
        }

        //将事件设置为有信号
        KeSetEvent(pkEvent, IO_NO_INCREMENT, FALSE);
        //引用计数 -1 
        ObDereferenceObject(pkEvent);
    }

PKEVENT 
  IoCreateNotificationEvent(
    IN PUNICODE_STRING  EventName,
    OUT PHANDLE  EventHandle
    );

VOID 
  KeInitializeSemaphore(
    IN PRKSEMAPHORE  Semaphore,//将要被初始化的信号量的指针
    IN LONG  Count,//当前信号量中有多少个灯亮
    IN LONG  Limit//总共有多少灯
    );

VOID Semaphore_Test()
{
    KSEMAPHORE keSemaphore;
    HANDLE hThread;
    NTSTATUS status = STATUS_SUCCESS;
    ULONG uCount = 0;//当前有多少盏灯亮着
    //初始化，使其里面有两盏灯，两盏灯全亮
    KeInitializeSemaphore(&keSemaphore, 2, 2);
    if(!NT_SUCCESS(status))
    {
        DbgPrint("Initialize Semaphore Error\n");
        return;
    }
    //当前有多少盏灯亮着
    uCount = KeReadStateSemaphore(&keSemaphore);
    DbgPrint("the  count = %ul", uCount);
    //函数会成功返回并熄灭一盏灯
    KeWaitForSingleObject(&keSemaphore, Executive, KernelMode, FALSE, 0);
    uCount = KeReadStateSemaphore(&keSemaphore);
    DbgPrint("the  count = %ul", uCount);

    //函数会成功返回并熄灭一盏灯
    KeWaitForSingleObject(&keSemaphore, Executive, KernelMode, FALSE, 0);
    uCount = KeReadStateSemaphore(&keSemaphore);
    DbgPrint("the  count = %ul", uCount);
    //创建新线程
    PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, SemaphoreThread, &keSemaphore);
    //这时没有灯亮，函数会陷入等待状态
    KeWaitForSingleObject(&keSemaphore, Executive, KernelMode, FALSE, 0);
}

VOID SemaphoreThread(PVOID pContext)
{
    //线程函数
    PKSEMAPHORE pkeSemaphore = (PKSEMAPHORE)pContext;
    DbgPrint("Entry My Thread\n");
    //点亮其中的一盏灯
    KeReleaseSemaphore(pkeSemaphore, IO_NO_INCREMENT, 1, FALSE);
    //结束线程
    PsTerminateSystemThread(0);
}

VOID 
  KeInitializeMutex(
    IN PRKMUTEX  Mutex,
    IN ULONG  Level//系统保留参数一般给0
    );

LONG 
  KeReleaseMutex(
    IN PRKMUTEX  Mutex,
    IN BOOLEAN  Wait
    );