#pragma INITCODE
extern "C" NTSTATUS DriverEntry (IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING RegistryPath)
{
	NTSTATUS status;

	//´´½¨Çý¶¯É豸¶ÔÏó
	status = CreateDevice(pDriverObject);

	pDriverObject->DriverUnload=UnloadDriver;		//жÔØÇý¶¯

	return status ;
}

//´´½¨É豸
#pragma INITCODE
NTSTATUS CreateDevice(IN PDRIVER_OBJECT	pDriverObject) 
{
	NTSTATUS status;
	PDEVICE_OBJECT   deviceObject;	

	RtlInitUnicodeString( &DeviceNameString,    L"\\Device\\HideProcess" );
	RtlInitUnicodeString( &LinkDeviceNameString,L"\\DosDevices\\HideProcess" );

	KdPrint(("pDriverEntry Enter............................\n"));

	status = IoCreateDevice(
		pDriverObject,
		0,                      
		&DeviceNameString,
		FILE_DEVICE_DISK_FILE_SYSTEM,
		FILE_DEVICE_SECURE_OPEN,
		FALSE,
		& deviceObject );

	if (!NT_SUCCESS( status )) 
	{

		KdPrint(( "pDriverEntry: Error creating control device object, status=%08x\n", status ));
		return status;
	}

	status = IoCreateSymbolicLink(
		(PUNICODE_STRING) &LinkDeviceNameString,
		(PUNICODE_STRING) &DeviceNameString
		);

	if (!NT_SUCCESS(status))
	{
		IoDeleteDevice(deviceObject);
		return status;
	}

	return status;
}


#pragma PAGEDCODE
VOID UnloadDriver(IN PDRIVER_OBJECT pDriverObject)//жÔØÇý¶¯³ÌÐòºÍ¹³×Ó
{
	PDEVICE_OBJECT deviceObject;

	deviceObject= pDriverObject->DeviceObject;
	IoDeleteSymbolicLink(&LinkDeviceNameString);
	ASSERT(!deviceObject->AttachedDevice);
	if ( deviceObject != NULL )
	{
		IoDeleteDevice( deviceObject );
	}
	KdPrint(("pDriverObject End............................\n"));
}

pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutine;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKDispatchRoutine;
读写需要这个




NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
								 IN PIRP pIrp) 
{
    //得到当前I0_STACK_LOCATION
	PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
	
	//得到输入缓冲区的大小
	ULONG cbin=stack->Parameters.DeviceIoControl.InputBufferLength;
	//得到输出缓冲区的大小
	ULONG cbout=stack->Parameters.DeviceIoControl.OutputBufferLength;
	
	//得到IOCTL码
    ULONG code=stack->Parameters.DeviceIoControl.IoControlCode;
	
    //获取IO请求类型
	ULONG mf=stack->MajorFunction;
	
	//(pIrp->AssociatedIrp.SystemBuffer)输入缓冲区指针
	
		
	
	//	KdPrint(("Enter HelloDDKDispatchRoutine\n"));
	NTSTATUS status = STATUS_SUCCESS;
	// 完成IRP
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = cbout;	// 设置IRP操作了多少字节
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );
	//	KdPrint(("Leave HelloDDKDispatchRoutine\n"));
	return status;
}

pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
	pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;