#include<ntddk.h>

#pragma warning(disable:4996 )

#define DEVICE_NAME (L"\\Device\\Beep")

#if 0
DRIVER_INITIALIZE   DriverEntry;
DRIVER_UNLOAD       DriverUnload;
DRIVER_STARTIO      BeepStartIoRoutine;
KDEFERRED_ROUTINE   BeepDpcRoutine;
DRIVER_CANCEL       BeepCancelRoutine;
DRIVER_STARTIO      BeepStartIoRoutine;

__drv_dispatchType(IRP_MJ_CLEANUP)  DRIVER_DISPATCH     BeepDispatchCleanup;
__drv_dispatchType(IRP_MJ_DEVICE_CONTROL) DRIVER_DISPATCH BeepDispatchDeviceControl;
__drv_dispatchType(IRP_MJ_CREATE)   DRIVER_DISPATCH     BeepDispatchCreate;
__drv_dispatchType(IRP_MJ_CLOSE)    DRIVER_DISPATCH     BeepDispatchClose;
#endif

//大小为0x58字节
typedef struct _MYDEVICE_EXTENSION
{
    KTIMER      timer;
    FAST_MUTEX  mutex;
    LONG        count_open;
    LONG        count_timer;
    PVOID       hLockedSection;
}MYDEVICE_EXTENSION,*PMYDEVICE_EXTENSION;

VOID
BeepCancelRoutine(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );

NTSTATUS
BeepDispatchCleanup(
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    );

NTSTATUS
BeepDispatchDeviceControl (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    );

NTSTATUS
BeepDispatchCreate (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    );

NTSTATUS
BeepDispatchClose (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    );

VOID
BeepStartIoRoutine(
    IN OUT  PDEVICE_OBJECT  DeviceObject,
    IN PIRP Irp 
    );

VOID
BeepDpcRoutine(
    IN PKDPC  Dpc,
    OPTIONAL IN PVOID  DeferredContext,
    OPTIONAL IN PVOID  SystemArgument1,
    OPTIONAL IN PVOID  SystemArgument2
    );

VOID
DriverUnload(
    IN  PDRIVER_OBJECT          driverObject
    );

NTSTATUS
DriverEntry(
    IN  PDRIVER_OBJECT          driverObject,
    IN  PUNICODE_STRING         registryPath
    );


//===================================实现===================================
VOID
BeepCancelRoutine(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )
{

    if( Irp == DeviceObject->CurrentIrp || 
        !KeRemoveEntryDeviceQueue( &DeviceObject->DeviceQueue,&Irp->Tail.Overlay.DeviceQueueEntry))
    {
        IoReleaseCancelSpinLock( Irp->CancelIrql );
    }
    else
    {
        IoReleaseCancelSpinLock( Irp->CancelIrql );
        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = 0xc0000120;
        IoCompleteRequest( Irp,IO_NO_INCREMENT );
    }
}

NTSTATUS
BeepDispatchCleanup(
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    )
{
    KIRQL   irql,oldIrql;
    PIRP    currIrp = NULL;

    oldIrql = KeRaiseIrqlToDpcLevel();
    IoAcquireCancelSpinLock( &irql );
    
    currIrp = deviceObject->CurrentIrp;
    deviceObject->CurrentIrp = NULL;
    if( currIrp != NULL )
    {
        PKDEVICE_QUEUE_ENTRY  entry = NULL;
        
        for( entry = KeRemoveDeviceQueue( &deviceObject->DeviceQueue);
             entry != NULL;
             entry = KeRemoveDeviceQueue( &deviceObject->DeviceQueue))
        {
            PIRP    pIrp = (PIRP)CONTAINING_RECORD( entry,IRP,Tail.Overlay.DeviceQueueEntry);
            
            pIrp->CancelRoutine = NULL;
            pIrp->IoStatus.Information = 0;
            pIrp->IoStatus.Status = 0xc0000120;
            IoReleaseCancelSpinLock( irql );
            IoCompleteRequest( pIrp,IO_NO_INCREMENT );

            IoAcquireCancelSpinLock( &irql );
        }//for
    }//if

    IoReleaseCancelSpinLock( irql );
    KeLowerIrql( oldIrql);

    irp->IoStatus.Status = STATUS_SUCCESS;
    irp->IoStatus.Information = 0;
    IoCompleteRequest( irp,IO_NO_INCREMENT );
    HalMakeBeep( 0 );

    return STATUS_SUCCESS;
}

NTSTATUS
BeepDispatchDeviceControl (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    )
{
    PIO_STACK_LOCATION  irpSp = IoGetCurrentIrpStackLocation( irp );
    NTSTATUS            status = STATUS_SUCCESS;
    PULONG              in_buffer = NULL;

    if( irpSp->Parameters.DeviceIoControl.IoControlCode != 0x10000 ||
        irpSp->Parameters.DeviceIoControl.InputBufferLength < 8 )
    {
        status = STATUS_INVALID_PARAMETER;
        goto exit;
    }

    in_buffer = (PULONG)irp->AssociatedIrp.SystemBuffer;
    if( in_buffer[0] != 0 && in_buffer[1] == 0 )
        status = STATUS_SUCCESS;
    else
        status = 0x103;

exit:
    irp->IoStatus.Information = 0;
    irp->IoStatus.Status = status;
    if( status == 0x103 )
    {
        irpSp->Control |= SL_PENDING_RETURNED;
        IoStartPacket( deviceObject,irp,0,(PDRIVER_CANCEL)BeepCancelRoutine );
    }
    else
        IoCompleteRequest( irp,IO_NO_INCREMENT );

    return status;
}

NTSTATUS
BeepDispatchCreate (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    )
{
    PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)deviceObject->DeviceExtension;

    ExAcquireFastMutex( &devExt->mutex );
    if( ++devExt->count_open == 1 )
    {
        devExt->hLockedSection = MmLockPagableDataSection( BeepDispatchCreate );
    }
    ExReleaseFastMutex( &devExt->mutex );

    irp->IoStatus.Status = STATUS_SUCCESS;
    irp->IoStatus.Information = 0;
    IoCompleteRequest( irp,IO_NO_INCREMENT );

    return STATUS_SUCCESS;
}

NTSTATUS
BeepDispatchClose (
    IN PDEVICE_OBJECT deviceObject,
    IN PIRP irp
    )
{
    PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)deviceObject->DeviceExtension;

    ExAcquireFastMutex( &devExt->mutex );
    if( --devExt->count_open == 0 )
    {
        MmUnlockPagableImageSection( &devExt->hLockedSection );
        if( devExt->count_timer != 0 && KeCancelTimer( &devExt->timer ))
            InterlockedDecrement( &devExt->count_timer); 
    }
    ExReleaseFastMutex( &devExt->mutex );

    irp->IoStatus.Status = STATUS_SUCCESS;
    irp->IoStatus.Information = 0;
    IoCompleteRequest( irp,IO_NO_INCREMENT );

    return STATUS_SUCCESS;
}

VOID
BeepStartIoRoutine(
    IN PDEVICE_OBJECT  DeviceObject,
    IN PIRP  Irp 
    )
{
    KIRQL               irql;
    PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)DeviceObject->DeviceExtension;
    PKTIMER             timer = &devExt->timer;
    PIO_STACK_LOCATION  irpSp = NULL;
    NTSTATUS            status = STATUS_SUCCESS;

    IoAcquireCancelSpinLock( &irql );
    if( NULL == Irp )
    {
        IoReleaseCancelSpinLock( irql );
        return;
    }
    Irp->CancelRoutine = NULL;
    IoReleaseCancelSpinLock( irql );

    irpSp = IoGetCurrentIrpStackLocation( Irp );
    if( irpSp->Parameters.DeviceIoControl.IoControlCode != 0x10000 )
        status = STATUS_INVALID_PARAMETER;
    else
    {
        PULONG     in_buffer = Irp->AssociatedIrp.SystemBuffer;

        if( devExt->count_timer != 0 && KeCancelTimer( timer ))
            InterlockedDecrement( &devExt->count_timer );

        if( HalMakeBeep(in_buffer[0]))
        {
            LARGE_INTEGER   dueTime={0};

            status = STATUS_SUCCESS;
            InterlockedIncrement( &devExt->count_timer );
            dueTime.QuadPart = (LONGLONG)-10000 * in_buffer[1];
            if(KeSetTimer( timer,dueTime,&DeviceObject->Dpc ))
                InterlockedDecrement( &devExt->count_timer);
        }
        else
            status = STATUS_INVALID_PARAMETER;
    }

    Irp->IoStatus.Information = 0;
    Irp->IoStatus.Status = status;
    IoStartNextPacket( DeviceObject,TRUE );
    IoCompleteRequest( Irp,IO_NO_INCREMENT );
}


VOID
BeepDpcRoutine(
    IN PKDPC  Dpc,
    OPTIONAL IN PVOID  DeferredContext,
    OPTIONAL IN PVOID  SystemArgument1,
    OPTIONAL IN PVOID  SystemArgument2
    )
{
    PDEVICE_OBJECT  devObj = (PDEVICE_OBJECT)DeferredContext;
    PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;

    HalMakeBeep( 0 );
    InterlockedDecrement( &devExt->count_timer );
}

VOID
DriverUnload(
    IN  PDRIVER_OBJECT          driverObject
    )
{
    PDEVICE_OBJECT  devObj = driverObject->DeviceObject;
    PMYDEVICE_EXTENSION devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;

    if( devExt->count_timer != 0 && KeCancelTimer( &devExt->timer))
        InterlockedDecrement( &devExt->count_timer );
    IoDeleteDevice( devObj );

}


NTSTATUS
DriverEntry(
    IN  PDRIVER_OBJECT          driverObject,
    IN  PUNICODE_STRING         registryPath
    )
/*++
--*/
{
    NTSTATUS        status = STATUS_SUCCESS;
    UNICODE_STRING  devName = {0};
    PDEVICE_OBJECT  devObj = NULL;
    PMYDEVICE_EXTENSION devExt = NULL;

    _asm int 3;
    RtlInitUnicodeString( &devName,DEVICE_NAME );

    status = IoCreateDevice( driverObject,
                            sizeof(MYDEVICE_EXTENSION),
                            &devName,
                            FILE_DEVICE_BEEP,
                            FILE_DEVICE_SECURE_OPEN,
                            FALSE,
                            &devObj);
    if( STATUS_SUCCESS != status )
        goto exit_with_status;

    devObj->Flags |= DO_BUFFERED_IO;

    devExt = (PMYDEVICE_EXTENSION)devObj->DeviceExtension;
    KeInitializeDpc( &devObj->Dpc,(PKDEFERRED_ROUTINE )BeepDpcRoutine,devObj);
    KeInitializeTimer( &devExt->timer );
    ExInitializeFastMutex( &devExt->mutex );
    devExt->count_timer = devExt->count_open = 0;

    driverObject->DriverStartIo = BeepStartIoRoutine;
    driverObject->DriverUnload =  DriverUnload;
    driverObject->MajorFunction[IRP_MJ_CREATE] = BeepDispatchCreate;
    driverObject->MajorFunction[IRP_MJ_CLOSE] =  BeepDispatchClose;
    driverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = BeepDispatchDeviceControl;
    driverObject->MajorFunction[IRP_MJ_CLEANUP] = BeepDispatchCleanup;

    return STATUS_SUCCESS;

exit_with_status:
    return status;
}

[课程]FART 脱壳王！加量不加价！FART作者讲授！