IoRegisterShutdownNotification.C

/*
文本就命名为：IoRegisterShutdownNotification.C吧！
made by correy
made at 2013.06.28
Email:kouleguan at hotmail dot com
Homepage:http://correy.webs.com
*/

#include <ntifs.h>
//#include <ntddk.h> //这两个次序不能乱，有上面的，这个可以注释掉。

DRIVER_DISPATCH DispatchShutdown;
NTSTATUS DispatchShutdown(__in struct _DEVICE_OBJECT  *DeviceObject, __in struct _IRP  *Irp)
{
    /*
    The IoRegisterShutdownNotification routine registers the driver to receive an IRP_MJ_SHUTDOWN IRP for the specified device when the system shuts down.
    The driver receives one such IRP for each device it registers to receive notification for.
    Drivers handle IRP_MJ_SHUTDOWN IRPs within their DispatchShutdown routines.

    If the driver ceases to require shutdown notification for the device,
    use IoUnregisterShutdownNotification to remove the driver from the shutdown notification queue.

    Only one driver in a device stack should register to receive shutdown notification.

    The system sends the driver the IRP_MJ_SHUTDOWN request before it flushes the file systems.
    Some drivers, such as drivers for mass storage devices, can require shutdown notification after the system flushes the file systems.
    To receive shutdown notification for a device after the file systems are flushed, use the IoRegisterLastChanceShutdownNotification routine instead.

    The registered DispatchShutdown routine is called before the power manager sends an IRP_MN_SET_POWER request for PowerSystemShutdown.
    The DispatchShutdown routine is not called for transitions to any other power states.

    A driver writer can make no assumptions about the order in which the driver's DispatchShutdown routine will be called in relation to other such routines or to other shutdown activities.

    A PnP driver might register a shutdown routine to perform certain tasks before system shutdown starts, such as locking down code.

    一下是IoRegisterLastChanceShutdownNotification特有的性质：  

    For any device that is registered with this routine, the system sends the IRP_MJ_SHUTDOWN IRP after all file systems are flushed.
    Only one driver in a device stack should register to receive shutdown notification, by calling either IoRegisterShutdownNotification or IoRegisterLastChanceShutdownNotification.

    A driver that calls IoRegisterLastChanceShutdownNotification must satisfy the following restrictions in its DispatchShutdown routine:
    The DispatchShutdown routine must not call any pageable routines.
    The DispatchShutdown routine must not access pageable memory.
    The DispatchShutdown routine must not perform any file I/O operations.

    Most drivers that require shutdown notification should call the IoRegisterShutdownNotification routine,
    which does not impose these limitations on the DispatchShutdown routine,
    and which causes the DispatchShutdown routine to be called before the file systems are flushed.
    Only drivers that must do some cleanup after the file systems are flushed,
    such as a driver for a mass storage device, should use IoRegisterLastChanceShutdownNotification.  
    */

    KdBreakPoint();

    return 0;
}

DRIVER_UNLOAD Unload;
VOID Unload(__in PDRIVER_OBJECT DriverObject)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PDEVICE_OBJECT DevObj;
    UNICODE_STRING LinkName;  

    DevObj = DriverObject->DeviceObject;
    RtlInitUnicodeString( &LinkName, L"\\DosDevices\\shutdown" );    
    IoDeleteSymbolicLink( &LinkName );// Remove symbolic link from Object namespace...
    IoDeleteDevice( DevObj ); // Unload the callbacks from the kernel to this driver

    IoUnregisterShutdownNotification(DevObj);
}

#pragma INITCODE
DRIVER_INITIALIZE DriverEntry;
NTSTATUS DriverEntry( __in struct _DRIVER_OBJECT  * DriverObject, __in PUNICODE_STRING  RegistryPath)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    UNICODE_STRING DeviceName;
    UNICODE_STRING LinkName;
    PDEVICE_OBJECT DeviceObject;

    KdBreakPoint();//#define KdBreakPoint() DbgBreakPoint()

    DriverObject->DriverUnload = Unload;  

    /*
    经过测试，如果不注册关机回调，仅仅这一行代码是不起作用的。
                  注册关机回调，没有这一行代码也是不起作用的。
    */
    DriverObject->MajorFunction[ IRP_MJ_SHUTDOWN ] = DispatchShutdown;
       
    RtlInitUnicodeString( &DeviceName, L"\\Device\\shutdown" );  
    status = IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &DeviceObject);
    if (!NT_SUCCESS(status)) {
        return status;
    }

    RtlInitUnicodeString( &LinkName, L"\\DosDevices\\shutdown" );
    status = IoCreateSymbolicLink( &LinkName, &DeviceName );
    if ( !NT_SUCCESS( status )) {
        IoDeleteDevice( DeviceObject );
        return status;
    }
   
    DeviceObject->Flags |= DO_BUFFERED_IO;

    //status = IoRegisterShutdownNotification(DeviceObject);
    status = IoRegisterLastChanceShutdownNotification(DeviceObject);//必须注册设备。方能收到消息。
    if (!NT_SUCCESS(status))
    {
        DbgPrint("IoRegisterShutdownNotification fail!");
        IoDeleteSymbolicLink( &LinkName );// Remove symbolic link from Object namespace...
        IoDeleteDevice( DeviceObject );
    }
   
    return status;//STATUS_SUCCESS
}