_Use_decl_annotations_
NTSTATUS
DriverEntry (
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;
    HANDLE symLinkHandle;
    DECLARE_CONST_UNICODE_STRING(symlinkName, L"\\GLOBAL??\\c:");
    OBJECT_ATTRIBUTES objAttr = RTL_CONSTANT_OBJECT_ATTRIBUTES(&symlinkName,
                                                               OBJ_KERNEL_HANDLE |
                                                               OBJ_CASE_INSENSITIVE);
    UNREFERENCED_PARAMETER(RegistryPath);

    //
    // Make sure our alignment trick worked out
    //确保我们的对齐技巧成功
    if (((ULONG_PTR)SymLinkCallback & 0xFFFF) != 0)
    {
        status = STATUS_CONFLICTING_ADDRESSES;
        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
                   DPFLTR_ERROR_LEVEL,
                   "Callback function not aligned correctly!\n");
        goto Exit;
    }

    //
    // Set an unload routine so we can update during testing
    //设置卸载过程
    DriverObject->DriverUnload = DriverUnload;

    //
    // Open a handle to the symbolic link object for C: directory,
    // so we can hook it
    //打开C盘符号链接对象的句柄，hook它
    status = ZwOpenSymbolicLinkObject(&symLinkHandle,
                                      SYMBOLIC_LINK_ALL_ACCESS,
                                      &objAttr);
    if (!NT_SUCCESS(status))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
                   DPFLTR_ERROR_LEVEL,
                   "Failed opening symbolic link with error: %lx\n",
                   status);
        goto Exit;
    }

    //
    // Get the symbolic link object and close the handle since we
    // no longer need it
    //过去符号链接对象后关闭句柄
    status = ObReferenceObjectByHandle(symLinkHandle,
                                       SYMBOLIC_LINK_ALL_ACCESS,
                                       NULL,
                                       KernelMode,
                                       (PVOID*)&g_SymLinkObject,
                                       NULL);
    ObCloseHandle(symLinkHandle, KernelMode);
    if (!NT_SUCCESS(status))
    {
        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
                   DPFLTR_ERROR_LEVEL,
                   "Failed referencing symbolic link with error: %lx\n",
                   status);
        goto Exit;
    }

    //
    // Create our device object hook
    //创建我们的设备对象hook
    RtlAppendUnicodeToString(&g_DeviceName, L"\\Device\\HarddiskVolume0");
    status = IoCreateDevice(DriverObject,
                            0,
                            &g_DeviceName,
                            FILE_DEVICE_UNKNOWN,
                            0,
                            FALSE,
                            &g_DeviceObject);
    if (!NT_SUCCESS(status))
    {
        //
        // Fail, and drop the symlink object reference
        //失败，释放符号链接对象引用
        ObDereferenceObject(g_SymLinkObject);
        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
                   DPFLTR_ERROR_LEVEL,
                   "Failed create devobj with error: %lx\n",
                   status);
        goto Exit;
    }

    //
    // Attach our create handler
    //附上我们的创建消息处理函数
    DriverObject->MajorFunction[IRP_MJ_CREATE] = SymHookCreate;

    //
    // Save the original string that the symlink points to
    // so we can change the object back when we unload
    //保存符号指向的原始字符串，在卸载时可以改回去
    g_LinkPath = g_SymLinkObject->LinkTarget;

    //
    // Modify the symlink to point to our callback instead of the string
    // and change the flags so the union will be treated as a callback.
    // Set CallbackContext to the original string so we can
    // return it from the callback and allow the system to run normally.
    //修改符号链接指向我们的回调而不是字符串，修改flag使联合结构被当做回调函数。修改CallbackContext为原始字符串，需要在回调函数中返回该字符串使得系统正常运行
    g_SymLinkObject->Callback = SymLinkCallback;
    RtlAppendUnicodeStringToString(&g_DeviceName, &g_TailName);
    g_SymLinkObject->CallbackContext = &g_DeviceName;
    MemoryBarrier();
    g_SymLinkObject->Flags |= OBJECT_SYMBOLIC_LINK_USE_CALLBACK;

Exit:
    //
    // Return the result back to the system
    //将结果返回到系统
    return status;
}

当有人访问该回调函数时，会到达我们的回调函数并收到一个指向我们设备对象（\Device\HarddiskVolume0）的路径，而不是指向\Device\HarddiskVolume<N>的路径，在样例中N为C分区。

//
// Get the FILE_OBJECT from the I/O Stack Location
//从I/O栈特定位置获得文件对象
ioStack = IoGetCurrentIrpStackLocation(Irp);
fileObject = ioStack->FileObject;

//
// Allocate space for the original device name, plus the size of the
// file name, and adding space for the terminating NUL.
//为原始设备名分配设备名，加上文件名大小和末尾空字符
bufferLength = fileObject->FileName.Length +
               g_LinkPath.Length +
               sizeof(UNICODE_NULL);
buffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool, bufferLength, 'maNF');
if (buffer == NULL)
{
    status = STATUS_INSUFFICIENT_RESOURCES;
    goto Exit;
}

//
// Append the original device name first
//先附加上原始设备名
buffer[0] = UNICODE_NULL;
NT_VERIFY(NT_SUCCESS(RtlStringCbCatNW(buffer,
                                      bufferLength,
                                      g_LinkPath.Buffer,
                                      g_LinkPath.Length)));

//
// Then add the name of the file name
//然后加上文件名
NT_VERIFY(NT_SUCCESS(RtlStringCbCatNW(buffer,
                                      bufferLength,
                                      fileObject->FileName.Buffer,
                                      fileObject->FileName.Length)));

//
// Ask the I/O manager to free the original file name and use ours instead
//向请求释放原始文件名字符串并使用我们的
status = IoReplaceFileObjectName(fileObject,
                                 buffer,
                                 bufferLength - sizeof(UNICODE_NULL));
if (!NT_SUCCESS(status))
{
    DbgPrintEx(DPFLTR_IHVDRIVER_ID,
               DPFLTR_ERROR_LEVEL,
               "Failed to swap file object name: %lx\n",
               status);
    ExFreePool(buffer);
    goto Exit;
}

替换文件对象名后任然有个问题，不能返回STATUS_SUCCESS，这会使我们的设备对象变成该文件的拥有者，而不是原始分区的设备对象。之后的所有I/O的IRP都会经过我们的驱动，使我们要为每个操作实现转发。

//
    // Return a reparse operation so that the I/O manager uses the new file
    // object name for its lookup, and starts over
    //返回重解析操作，让I/O管理器解析时使用新文件对象名，重来一次
    Irp->IoStatus.Information = IO_REPARSE;
    status = STATUS_REPARSE;

Exit:
    //
    // Complete the IRP with the relevant status code
    //使用状态码完成IRP
    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;

整体功能机制如下：