2014年9月2日星期二

内核中GUID/UUID/LUID

#include <ntifs.h>
#include <windef.h>
#include <initguid.h> //静态定义UUID用的,否则:error LNK2001。


/*
文件名:ExUuidCreate.C 
功能和目的:示例内核中GUID/UUID/LUID的用法。
起因:Windows系统的有些上述的ID是固定不变的。最好能记住。COM中也可能如此。

ExUuidCreate 

RtlGUIDFromString
RtlStringFromGUID

RtlConvertLongToLuid 有实现代码的函数
RtlConvertUlongToLuid 有实现代码的函数
RtlEqualLuid 这是个宏
RtlIsZeroLuid 这是个宏

ConvertInterfaceGuidToLuid 
ConvertInterfaceLuidToGuid
不过这两个都是:Available in Windows Vista and later versions of the Windows operating systems.

ZwAllocateLocallyUniqueId
这个函数在WDK中没有说:Available in Windows Vista and later versions of Windows.
在下面的连接中都说了:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff566415(v=vs.85).aspx
http://technet.microsoft.com/en-ca/ff566415(v=vs.90).aspx
http://technet.microsoft.com/it-it/subscriptions/ff566415.aspx
经查看,这个函数XP-32的内核下没有导出。
而且WDK只有函数原型,没有实现的代码,LIB里面啥样没有看。

The locally unique identifier (LUID) is a 64-bit value guaranteed to be unique only on the system on which it was generated.
The LUID structure is an opaque structure that specifies an identifier that is guaranteed to be unique on the local machine. 
WDK里面的这两句话矛盾不?

made by correy
made at 2014.08.15
email:kouleguan at hotmail dot com
homepage:http://correy.webs.com
*/


#define tag  'tset' //test


/*
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553426(v=vs.85).aspx
Disk Drives
Class = DiskDrive
ClassGuid = {4d36e967-e325-11ce-bfc1-08002be10318}
This class includes hard disk drives. See also the HDC and SCSIAdapter classes.
在整个WinDDK\7600.16385.1目录中只有两个INF文件包含4d36e967。WRK中也没有搜索到。
所以这个还得自己定义,系统没有定义。

更多的信息:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff547786(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/ff542998(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553428(v=vs.85).aspx
*/
DEFINE_GUID (DiskClassGuid, 0x4d36e967, 0xe325, 0x11ce, 0xbf, 0xc1, 0x08, 0x00, 0x2b, 0xe1, 0x03, 0x18);


BOOL RtlEqualUuid(IN UUID * pu1, IN UUID * pu2)
{
    return RtlEqualMemory(pu1, pu2, sizeof(UUID));  //RtlCompareMemory 
}


DRIVER_UNLOAD Unload;
VOID Unload(__in PDRIVER_OBJECT DriverObject)
{

}


DRIVER_INITIALIZE DriverEntry;
NTSTATUS DriverEntry( __in struct _DRIVER_OBJECT  * DriverObject, __in PUNICODE_STRING  RegistryPath)
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;   
    UUID  Uuid = {0};//typedef GUID UUID;
    UUID  Uuid2 = DiskClassGuid;
    UNICODE_STRING  GuidString = {0};
    BOOL B = FALSE ;
    LUID Luid = {0};//查看结构用的.

    KdBreakPoint();

    DriverObject->DriverUnload = Unload;    

    status = ExUuidCreate(&Uuid);//注意这个是没有前后的大括号的,但是调试器显示的时候可能会显示上.
    if (!NT_SUCCESS(status)) {
        return status;
    }

    GuidString.MaximumLength = MAX_PATH;
    GuidString.Buffer = ExAllocatePoolWithTag( NonPagedPool, GuidString.MaximumLength, tag );
    if (GuidString.Buffer == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }    
    RtlZeroMemory(GuidString.Buffer, GuidString.MaximumLength);

    status = RtlStringFromGUID(&Uuid, &GuidString);//#define REFGUID const GUID &
    if (!NT_SUCCESS(status)) {
        ExFreePool(GuidString.Buffer);
        return status;
    }

    KdPrint(("GuidString %wZ\n", &GuidString));  //这个是有前后的大括号的.

    status = RtlGUIDFromString(&GuidString, &Uuid);//各个变量/参数保持不变.
    if (!NT_SUCCESS(status)) {
        ExFreePool(GuidString.Buffer);
        return status;
    }

    //B = RtlEqualLuid((LUID *)&Uuid, (LUID *)&DiskClassGuid);
    B = RtlEqualUuid(&Uuid, &Uuid2);//肯定不相等.B == 0.

    ExFreePool(GuidString.Buffer);

    return status;    
} 

没有评论:

发表评论