編譯driver

一個基本的mini filter項目創建好了以后，就可以編譯，部署和運行了，在部署之前，我們要先確定在什么樣的系統上運行，我有一臺windows 2008 r2擬機，所以我的運行的目標系統就是windows 2008 r2。

這個工程默認已經配置了好幾個build選項，注意的是，選擇的配置選項一定要與目標機器匹配，否則，不能在目標機器上正常運行，由于我的目標機器是windows 2008 r2，所以我選擇“Win7 Debug-X64”配置選項。

直接build，由于我們還沒有寫任何自己的代碼，所以build沒有任何問題，我的項目的名稱叫SSMF，所以在Win7Debug目錄下面生成了SSMF.sys和SSMF.inf文件，SSMF.inf文件我們要必須進行修改才能使用，修改后的結果如下：

————————————————————————————————————————————————————————————————————————————————————

;;;
;;; SSMF
;;;

[Version]
Signature?? = "$Windows NT$"
; TODO - Change the Class and ClassGuid to match the Load Order Group value, see http://msdn.microsoft.com/en-us/windows/hardware/gg462963
Class?????? = "ActivityMonitor"???????????????????????? ;This is determined by the work this filter driver does
ClassGuid?? = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}??? ;This value is determined by the Load Order Group value
Provider??? = %ManufacturerName%
DriverVer=08/10/2014,15.12.25.950
CatalogFile = SSMF.cat

[DestinationDirs]
DefaultDestDir????????? = 12
SSMF.DriverFiles? = 12??????????? ;%windir%\system32\drivers

;;
;; Default install sections
;;

[DefaultInstall]
OptionDesc????????? = %ServiceDescription%
CopyFiles?????????? = SSMF.DriverFiles

[DefaultInstall.Services]
AddService????????? = %ServiceName%,,SSMF.Service

;;
;; Default uninstall sections
;;

[DefaultUninstall]
DelFiles?? = SSMF.DriverFiles

[DefaultUninstall.Services]
DelService = %ServiceName%,0x200????? ;Ensure service is stopped before deleting

;
; Services Section
;

[SSMF.Service]
DisplayName????? = %ServiceName%
Description????? = %ServiceDescription%
ServiceBinary??? = %12%\%DriverName%.sys??????? ;%windir%\system32\drivers\
Dependencies???? = "FltMgr"
ServiceType????? = 2??????????????????????????? ;SERVICE_FILE_SYSTEM_DRIVER
StartType??????? = 3??????????????????????????? ;SERVICE_DEMAND_START
ErrorControl???? = 1??????????????????????????? ;SERVICE_ERROR_NORMAL
; TODO - Change the Load Order Group value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512
LoadOrderGroup = "FSFilter Activity Monitor"
;LoadOrderGroup = "_TODO_Change_LoadOrderGroup_appropriately_"
AddReg?????????? = SSMF.AddRegistry

;
; Registry Modifications
;

[SSMF.AddRegistry]
HKR,,"DebugFlags",0x00010001 ,0x0
HKR,,"SupportedFeatures",0x00010001,0x3
HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance%
HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude%
HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags%

;
; Copy Files
;

[SSMF.DriverFiles]
%DriverName%.sys

[SourceDisksFiles]
SSMF.sys = 1,,

[SourceDisksNames]
1 = %DiskId1%,,,

;;
;; String Section
;;

[Strings]
; TODO - Add your manufacturer
ManufacturerName??????? = "Template"
ServiceDescription????? = "SSMF Mini-Filter Driver"
ServiceName???????????? = "SSMF"
DriverName????????????? = "SSMF"
DiskId1???????????????? = "SSMF Device Installation Disk"

;Instances specific information.
DefaultInstance???????? = "SSMF Instance"
Instance1.Name????????? = "SSMF Instance"
; TODO - Change the altitude value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512
Instance1.Altitude????? = "370030"
;Instance.Altitude?????? = "_TODO_Change_Altitude_appropriately_"
Instance1.Flags???????? = 0x0????????????? ; Allow all attachments

————————————————————————————————————————————————————————————————————————————————

具體的每一項的含義可以查看相關的文檔和msdn等。

部署driver

將SSMF.sys和SSMF.inf拷貝到目標系統，在SSMF.inf文件上點擊右鍵菜單，選擇“Install”，就將SSMF driver部署到了系統中。

如果要卸載driver，可以用下面的這個命令：

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 132 c:\ssmf\ssmf.inf

啟動driver

檢驗SSMF驅動是否安裝成功，在命令行里面執行下面的命令：

sc start ssmf

看一下啟動的狀態會發現時running，就表示已經啟動成功了，如下所示：

C:\Users\Administrator>sc start ssmf

SERVICE_NAME: ssmf
??????? TYPE?????????????? : 2? FILE_SYSTEM_DRIVER
??????? STATE????????????? : 4? RUNNING
??????????????????????????????? (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
??????? WIN32_EXIT_CODE??? : 0? (0x0)
??????? SERVICE_EXIT_CODE? : 0? (0x0)
??????? CHECKPOINT???????? : 0x0
??????? WAIT_HINT????????? : 0x0
??????? PID??????????????? : 0
??????? FLAGS????????????? :

也可以通過命令 fltmc instances去查看里面是否有SSMF。

停止driver

可以執行sc stop ssmf

其他注意事項

1.如果選擇的配置選項與對應的目標機器不匹配，driver將不能正確啟動，可能會出現如下的這個錯誤：

C:\Users\Administrator>sc start ssmf
[SC] StartService FAILED 1275:

This driver has been blocked from loading

也有可能是編譯的32位driver放到了64位系統上運行的結果。

2.由于是我們自己編寫的driver，還沒有進行簽名，所以在windows 2008 等系統上不能直接啟動，所以，要在系統啟動的時候按F8，選擇“ Dlsable Driver Signature Enforcement ”。



總結

以上是生活随笔為你收集整理的Visual Studio 2013开发 mini-filter driver step by step (2) - 编译，部署，运行的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。