#include <ntifs.h>
#include <ntddk.h>

//首先自定义链表

#define DELAY_ONE_MICROSECOND (-10)  
#define DELAY_ONE_MILLISECOND (DELAY_ONE_MICROSECOND*1000)  
#define DELAY_ONE_SECOND (DELAY_ONE_MILLISECOND*1000) 

typedef struct _MYDATA 
{

	LIST_ENTRY ListEntry;
	
	ULONG uData;

	ULONG uDelete;

}MYDATA,*PMYDATA;
//////////////////////////////////////////////////////////////////////////
//全局变量

  LIST_ENTRY g_listHead;

  ULONG g_ExitThread;
  HANDLE hWriteThread=NULL;
  HANDLE	  hDeleteThread ;
  HANDLE hReadThread=NULL;
  KSPIN_LOCK  g_SpinLock;
//////////////////////////////////////////////////////////////////////////
//卸载函数
////////////////////////////////////////////////////////////////////////
VOID 
Unload(
	   __in struct _DRIVER_OBJECT  *DriverObject
	   )
{

	PLIST_ENTRY pEntry=NULL;
	PMYDATA pMyData=NULL;
	g_ExitThread=TRUE;
	
ZwWaitForSingleObject(hReadThread,TRUE,NULL);

ZwWaitForSingleObject(hWriteThread,TRUE,NULL);
	ZwWaitForSingleObject(hDeleteThread,TRUE,NULL);
//可能还有漏网之鱼啊
	while (!IsListEmpty(&g_listHead))
	{
		pEntry=RemoveTailList(&g_listHead);
		if (pEntry)
		{
            pMyData=CONTAINING_RECORD(pEntry,MYDATA,ListEntry);
			KdPrint(("Unload-- Find Udata=%d,uDelete=%d\n",pMyData->uData,pMyData->uDelete));
			ExFreePool(pEntry);
		}
	}



}


//////////////////////////////////////////////////////////////////////////
//写线程

VOID 
ThreadWriteStart( 
				 __in PVOID  StartContext
				 )
{

	LARGE_INTEGER interval;  
	KIRQL  OldIrql;
	PMYDATA pMyData=NULL;
	ULONG uid=0;
	while (!g_ExitThread)
	{
		KeAcquireSpinLock(&g_SpinLock,&OldIrql);
      pMyData=ExAllocatePool(NonPagedPool ,sizeof(MYDATA));
	  RtlZeroMemory(pMyData,sizeof(MYDATA));
	  pMyData->uData=uid;
	  if (uid>9999)
	  {
		  uid=0;
	  }
	  else
	  {
		  uid++;
	  }
       InsertHeadList(&g_listHead,&pMyData->ListEntry);
	   KdPrint(("ThreadWriteStart--------WriteData=%d",pMyData->uData));
		KeReleaseSpinLock(&g_SpinLock,&OldIrql);

		//睡眠1秒  
		interval.QuadPart = (1*1000 * DELAY_ONE_MILLISECOND); 
		KeDelayExecutionThread(KernelMode,FALSE,&interval);
	}


	PsTerminateSystemThread(STATUS_SUCCESS);
}

//////////////////////////////////////////////////////////////////////////
//读线程

VOID 
ThreadReadStart( 
				 __in PVOID  StartContext
				 )
{

	LARGE_INTEGER interval;  
	KIRQL  OldIrql;
	PMYDATA pMyData=NULL;
	PLIST_ENTRY pEntry=NULL;
	ULONG uid=0;
	while (!g_ExitThread)
	{
		KeAcquireSpinLock(&g_SpinLock,&OldIrql);
	   pEntry=&g_listHead;
	    pEntry=pEntry->Blink;
	   if (!IsListEmpty(pEntry))
	   {
		   while (pEntry!=&g_listHead)
		   {
			   //从尾部往前面遍历
             pMyData=CONTAINING_RECORD(pEntry,MYDATA,ListEntry);
			 if (pMyData)
			 {
				 if (!pMyData->uDelete)
				 {
					 KdPrint(("ThreadReadStart----find data is :%d\n",pMyData->uData));
					 pMyData->uDelete=1;
				 }
				
			 }
			 pEntry=pEntry->Blink;
		   }
	   }
		KeReleaseSpinLock(&g_SpinLock,&OldIrql);

		//睡眠1秒  
		interval.QuadPart = (5*1000 * DELAY_ONE_MILLISECOND); 
		KeDelayExecutionThread(KernelMode,FALSE,&interval);
	}


	PsTerminateSystemThread(STATUS_SUCCESS);
}

//////////////////////////////////////////////////////////////////////////
//删除线程
VOID 
ThreadDeleteStart( 
				  __in PVOID  StartContext
				  )
{

	LARGE_INTEGER interval;  
	PMYDATA pMyData=NULL;
	PLIST_ENTRY pEntry=NULL;
	PLIST_ENTRY pFrontEntry=NULL;
	PLIST_ENTRY pNextEntry=NULL;
	KIRQL  OldIrql;
	while (!g_ExitThread)
	{
		KeAcquireSpinLock(&g_SpinLock,&OldIrql);

		pEntry=&g_listHead;
		pEntry=pEntry->Blink;
		if (!IsListEmpty(pEntry))
		{
			while (pEntry!=&g_listHead)
			{
				//从尾部往前面遍历
				pMyData=CONTAINING_RECORD(pEntry,MYDATA,ListEntry);
				if (pMyData)
			 {
				 if (pMyData->uDelete)
				 {
					 KdPrint(("ThreadDeleteStart----find data is :%d\n",pMyData->uData));
					 pFrontEntry=pMyData->ListEntry.Blink;
					 pNextEntry=pMyData->ListEntry.Flink;
					 pFrontEntry->Flink=pNextEntry;
					 pNextEntry->Blink=pFrontEntry;
					 ExFreePool(pMyData);
				 }
				 else //因为 不可能跳一个的
				 {
					 break;
				 }


			 }
				pEntry=pEntry->Blink;
			}
		}
		KeReleaseSpinLock(&g_SpinLock,&OldIrql);

		//睡眠5秒  
		interval.QuadPart = (7*1000 * DELAY_ONE_MILLISECOND); 
		KeDelayExecutionThread(KernelMode,FALSE,&interval);
	}

	PsTerminateSystemThread(STATUS_SUCCESS);
}

//////////////////////////////////////////////////////////////////////////

NTSTATUS 
DriverEntry( 
			__in struct _DRIVER_OBJECT  *DriverObject,
			__in PUNICODE_STRING  RegistryPath 
			)
{

	NTSTATUS nstatus=STATUS_UNSUCCESSFUL;

g_ExitThread=NULL;
    DriverObject->DriverUnload=Unload;

 InitializeListHead(&g_listHead);
 KeInitializeSpinLock(&g_SpinLock);
 //创建二个线程 一个负责写 一个负责删除
PsCreateSystemThread(&hWriteThread,NULL,NULL,NULL,NULL,ThreadWriteStart,NULL);
PsCreateSystemThread(&hReadThread,NULL,NULL,NULL,NULL,ThreadReadStart,NULL);
 PsCreateSystemThread(&hDeleteThread,NULL,NULL,NULL,NULL,ThreadDeleteStart,NULL);   

	nstatus=STATUS_SUCCESS;
	return nstatus;

} 

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！