C语言驱动开发之内核使用IO/DPC定时器详解

// 初始化定时器
NTSTATUS IoInitializeTimer(
  [in]           PDEVICE_OBJECT         DeviceObject,  // 设备对象
  [in]           PIO_TIMER_ROUTINE      TimerRoutine,  // 回调例程
  [in, optional] __drv_aliasesMem PVOID Context        // 回调例程参数
);
// 启动定时器
VOID IoStartTimer(
  [in] PDEVICE_OBJECT DeviceObject             // 设备对象
);
// 关闭定时器
VOID IoStopTimer(
  [in] PDEVICE_OBJECT DeviceObject             // 设备对象
);

// 署名权
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: me@lyshark.com

#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>

LONG count = 0;

// 自定义定时器函数
VOID MyTimerProcess( __in struct _DEVICE_OBJECT *DeviceObject, __in_opt PVOID Context)
{
	InterlockedIncrement(&count);
	DbgPrint("定时器计数 = %d", count);
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
	// 关闭定时器
	IoStopTimer(driver->DeviceObject);

	// 删除设备
	IoDeleteDevice(driver->DeviceObject);

	DbgPrint(("Uninstall Driver Is OK \n"));
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	NTSTATUS status = STATUS_UNSUCCESSFUL;

	// 定义设备名以及定时器
	UNICODE_STRING dev_name = RTL_CONSTANT_STRING(L"");
	PDEVICE_OBJECT dev;
	status = IoCreateDevice(Driver, 0, &dev_name, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &dev);
	if (!NT_SUCCESS(status))
	{
		return STATUS_UNSUCCESSFUL;
	}
	else
	{
		// 初始化定时器并开启
		IoInitializeTimer(dev, MyTimerProcess, NULL);
		IoStartTimer(dev);
	}

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

LONG count = 3;

// 自定义定时器函数
VOID MyTimerProcess(__in struct _DEVICE_OBJECT *DeviceObject, __in_opt PVOID Context)
{
	// 递减计数
	InterlockedDecrement(&count);

	// 当计数减到0之后继续变为3
	LONG preCount = InterlockedCompareExchange(&count, 3, 0);

	//每隔3秒计数器一个循环输出如下信息
	if (preCount == 0)
	{
		DbgPrint("[LyShark] 三秒过去了 \n");
	}
}

// 初始化定时器对象 PKTIMER 指向调用方为其提供存储的计时器对象的指针
void KeInitializeTimer(
  [out] PKTIMER Timer    // 定时器指针
);

// 初始化DPC对象
void KeInitializeDpc(
  [out]          __drv_aliasesMem PRKDPC Dpc,
  [in]           PKDEFERRED_ROUTINE      DeferredRoutine,
  [in, optional] __drv_aliasesMem PVOID  DeferredContext
);

// 设置定时器
BOOLEAN KeSetTimer(
  [in, out]      PKTIMER       Timer,     // 定时器对象的指针
  [in]           LARGE_INTEGER DueTime,   // 时间间隔
  [in, optional] PKDPC         Dpc        // DPC对象
);

// 取消定时器
BOOLEAN KeCancelTimer(
  [in, out] PKTIMER unnamedParam1         // 定时器指针
);

// 署名权
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: me@lyshark.com

#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>

LONG count = 0;
KTIMER g_ktimer;
KDPC g_kdpc;

// 自定义定时器函数
VOID MyTimerProcess(__in struct _KDPC *Dpc,__in_opt PVOID DeferredContext,__in_opt PVOID SystemArgument1,__in_opt PVOID SystemArgument2)
{
	LARGE_INTEGER la_dutime = { 0 };
	la_dutime.QuadPart = 1000 * 1000 * -10;

	// 递增计数器
	InterlockedIncrement(&count);

	DbgPrint("DPC 定时执行 = %d", count);

	// 再次设置定时
	KeSetTimer(&g_ktimer, la_dutime, &g_kdpc);
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
	// 取消计数器
	KeCancelTimer(&g_ktimer);

	DbgPrint(("Uninstall Driver Is OK \n"));
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark \n");

	LARGE_INTEGER la_dutime = { 0 };

	// 每隔1秒执行一次
	la_dutime.QuadPart = 1000 * 1000 * -10;

	// 1.初始化定时器对象
	KeInitializeTimer(&g_ktimer);

	// 2.初始化DPC定时器
	KeInitializeDpc(&g_kdpc, MyTimerProcess, NULL);

	// 3.设置定时器,开始计时
	KeSetTimer(&g_ktimer, la_dutime, &g_kdpc);

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

// 署名权
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: me@lyshark.com

#include <ntifs.h>
#include <wdm.h>
#include <ntstrsafe.h>

/*
	typedef struct TIME_FIELDS
	{
	CSHORT Year;
	CSHORT Month;
	CSHORT Day;
	CSHORT Hour;
	CSHORT Minute;
	CSHORT Second;
	CSHORT Milliseconds;
	CSHORT Weekday;
	} TIME_FIELDS;
*/

// 内核中获取时间
VOID MyGetCurrentTime()
{
	LARGE_INTEGER CurrentTime;
	LARGE_INTEGER LocalTime;
	TIME_FIELDS   TimeFiled;
	
	// 得到格林威治时间
	KeQuerySystemTime(&CurrentTime);
	
	// 转成本地时间
	ExSystemTimeToLocalTime(&CurrentTime, &LocalTime);
	
	// 转换为TIME_FIELDS格式
	RtlTimeToTimeFields(&LocalTime, &TimeFiled);

	DbgPrint("[时间与日期] %4d年%2d月%2d日 %2d时%2d分%2d秒",
		TimeFiled.Year, TimeFiled.Month, TimeFiled.Day,
		TimeFiled.Hour, TimeFiled.Minute, TimeFiled.Second);
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
	DbgPrint(("Uninstall Driver Is OK \n"));
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	MyGetCurrentTime();

	DbgPrint("hello lyshark \n");

	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}