研究了传统的以WDM过滤驱动的方法来实现的设备控制原理。通过对这种传统方法的阐述说明了这种方法存在不够安全、不够灵活等缺点,对微软Windows的高中断级别的自旋锁源码进行反汇编分析,然后以NT过滤驱动的方式尝试实现WDM过滤驱动的机制,最后利用内核例程hook的方法,使用对驱动对象的派遣例程函数入口地址替换提出一种新的实现思路。经过仿真实验表明,这种方法能取得较好的效果。
The traditional principle of media device control in Windows Device Model (WDM) filter driver was researched and its unsafe and inflexible shortcomings were illustrated. The source code of high-level spin lock in Microsoft Windows was disassembled and analyzed. The mechanism to realize the WDM architecture with NT filter driver was proposed. A new exchange technology of dispatching routine's entry address of the driver object was advanced and verified.