关于DPC和workitem的简单用法

这个随笔是记录我半个月左右的时间，从想法到查资料请教，以及到实践的成果。

我想实现的是，隔定时时间写文件，本以为调用写的函数就可以实现了，结果各种BSOD，IRQL_NOT_LESS_OR_EQUAL，这个蓝屏提示，结果是函数的IRQL导致的，内核函数都有IRQL，我是想在DISPATCH_LEVEL中运行低级别的PASSIVE_LEVEL,因为写函数就是在PASSIVE_LEVEL上运行的。解决方法是，使用DPC，IoQueueWorkItem。下面的代码是我简单的测试了我的想法，给文件中只写入了时间和简单的数据结构信息，只适合新手，全部代码如下(注意红色标记代码)：

 #include<stdio.h>
 #include<stdlib.h>
 #include "ntddk.h"

 #define WRITE_FILE_INTERVAL    -10000 * 1000 * 10
 typedef struct my_info{
         int age;
         int weight;
         char* name;
 }myInfo, *PmyInfo;
 VOID ThreadStart(IN PVOID StartContext);

 VOID CustomDpc(IN struct _KDPC *Dpc,
                              IN PVOID DeferredContext,
                              IN PVOID SystemArgument1,
                              IN PVOID SystemArgument2);

 VOID SyncTechUnload(IN PDRIVER_OBJECT DriverObject);
 //VOID workItem();
 NTSTATUS GetLocalTime( OUT PTIME_FIELDS  timeFields );
 VOID TestFile(IN PDEVICE_OBJECT  DeviceObject,
     IN PVOID  Context);

 KTIMER Timer;   //?????????????????
 PDEVICE_OBJECT DeviceObject;
 PIO_WORKITEM pIoWorkItem;
 LARGE_INTEGER DueTime;
 KDPC Dpc;
 HANDLE hThread;

 NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath)
 {

         OBJECT_ATTRIBUTES ObjectAttributes;
         CLIENT_ID  CID;
         NTSTATUS status;
         UNICODE_STRING DeviceName, Win32Device;

         KdPrint(("dpc:DriverEntry Cur Process:%s Cur IRQL:%d\n",
         (char*)((ULONG)PsGetCurrentProcess()+0x174), KeGetCurrentIrql()));

         RtlInitUnicodeString(&DeviceName, L"\\Device\\jay0");
         RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\jay0");
         status = IoCreateDevice(DriverObject,
                                                         ,
                                                         &DeviceName,
                                                         FILE_DEVICE_UNKNOWN,
                                                         ,
                                                         FALSE,
                                                         &DeviceObject);
         if(!NT_SUCCESS(status))
             return status;
         if(!DeviceObject)
             {
                 KdPrint(("dpc:DeviceObject is failure\n"));
                 return STATUS_UNEXPECTED_IO_ERROR;
             }
         //初始化定时器
         KeInitializeTimer(&Timer);
         DriverObject->DriverUnload = SyncTechUnload;
         InitializeObjectAttributes(&ObjectAttributes, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
         //创建一个系统线程
         status = PsCreateSystemThread(
                     &hThread,
                     GENERIC_READ|GENERIC_WRITE,
                     &ObjectAttributes,
                     NtCurrentProcess(),
                     &CID,
                     (PKSTART_ROUTINE)ThreadStart,
                     NULL
         );
         if (!NT_SUCCESS(status))
             {
                 KdPrint(("dpc:PsCreateSystemThread failure！\n"));
                 return ;
             }
         ZwClose(hThread);
         KdPrint(("dpc:Exit\n"));
         return STATUS_SUCCESS;
 }

 VOID ThreadStart(IN PVOID StartContext)
 {

     PmyInfo pmyInfo;
     KdPrint(("dpc:Cur Process: %s IRQL:%d\n",
             (char*)((ULONG)PsGetCurrentProcess()+0x174), KeGetCurrentIrql()));
     pmyInfo = ExAllocatePool(NonPagedPool, sizeof(myInfo));
     pmyInfo->age = ;
     pmyInfo->weight = ;
     pmyInfo->name = "zc";
     //KdPrint(("dpc: my age is %d , my weight is %d \n", context->age, context->weight));
     DueTime = RtlConvertLongToLargeInteger(WRITE_FILE_INTERVAL);
     //初始化一个Dpc
     //这个CustomDpc是自定义的函数，运行在DISPATCH_LEVEL上,后面的参数myInfo是该函数的参数
     KeInitializeDpc(&Dpc, (PKDEFERRED_ROUTINE)CustomDpc, pmyInfo);
     //设置DPC定时器
     KeSetTimer(&Timer, DueTime, &Dpc);
     //等待定时器
     KeWaitForSingleObject(&Timer, Executive, KernelMode, FALSE, NULL);
     KdPrint(("dpc:ThreadStart time expire"));
     return;
 }

 //简单输出进程名和当前的IRQL，注意该函数运行在dispatch级别

 VOID CustomDpc(IN struct _KDPC *Dpc,
                              IN PmyInfo pmyInfo,
                              IN PVOID SystemArgument1,
                              IN PVOID SystemArgument2)
 {

         KdPrint(("dpc:CustomDpc Process: %s IRQL:%d\n",
                 (char*)((ULONG)PsGetCurrentProcess()+0x174), KeGetCurrentIrql()));
      // KdPrint(("dpc: my age is %d , my weight is %d, my name is %s\n",
       //        pmyInfo->age, pmyInfo->weight, pmyInfo->name));

       //使用IoAllocateWorkItem分配一个ioworkitem
       pIoWorkItem = IoAllocateWorkItem(DeviceObject);
      // IoInitializeWorkItem(DeviceObject,pIoWorkItem); 

       if(pIoWorkItem)
       {
           //插入一个workitem， 其中TestFile就是我要写文件的函数，第四个参数也是该函数的参数
           IoQueueWorkItem(pIoWorkItem, (PIO_WORKITEM_ROUTINE)TestFile, DelayedWorkQueue, pmyInfo);
       }
       //由于要定时写，因此再次设置定时器，如果不设置只写一次
         KeSetTimer(&Timer, DueTime, Dpc);
 }

 NTSTATUS
 GetLocalTime( OUT PTIME_FIELDS  timeFields )
 /*++
 --*/
 {
     NTSTATUS        status = STATUS_SUCCESS;
     LARGE_INTEGER   sysTime,locTime;

     KeQuerySystemTime( &sysTime );
     ExSystemTimeToLocalTime( &sysTime,&locTime );
     RtlTimeToTimeFields( &locTime,timeFields );

     return STATUS_SUCCESS;

 }

 VOID TestFile(IN PDEVICE_OBJECT  DeviceObject,
     IN PmyInfo pmyInfo)

 {
          TIME_FIELDS time;
      UNICODE_STRING string;
      HANDLE hFile;
      IO_STATUS_BLOCK iostatus;
      NTSTATUS status;
      WCHAR pBuffer[];
      OBJECT_ATTRIBUTES objattr;
      LARGE_INTEGER  ByteOffset;
      KIRQL irql;

      RtlInitUnicodeString(&string, L"\\??\\C:\\Log\\1.log");
      InitializeObjectAttributes(&objattr, &string, OBJ_CASE_INSENSITIVE, NULL, NULL);
      GetLocalTime(&time);
          irql = KeGetCurrentIrql();
          KdPrint(("dpc: cur irql=%d", irql));
      //打开文件
      status = ZwCreateFile(&hFile, FILE_APPEND_DATA,
                                                     &objattr, &iostatus,
                                                       NULL, FILE_ATTRIBUTE_NORMAL,
                                                         FILE_SHARE_WRITE,
                                                     FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT, NULL, );

            swprintf( pBuffer,L"[%d-%d-%d-%d-%d-%d]",
             time.Year,
             time.Month,
             time.Day,
             time.Hour,
             time.Minute,
             time.Second);
            KdPrint(("dpc: %S", pBuffer));
               KdPrint(("dpc: my age is %d , my weight is %d, my name is %s\n",
                                                  pmyInfo->age, pmyInfo->weight, pmyInfo->name));
          //写文件
          status = ZwWriteFile(hFile, NULL, NULL, NULL, &iostatus,
                                                           pBuffer, wcslen(pBuffer)*sizeof(WCHAR), NULL, NULL);
          //写入换行符
          status = ZwWriteFile(hFile, NULL, NULL, NULL, &iostatus,
                                                                 L"\n", sizeof(WCHAR), NULL, NULL);

          //关闭文件句柄
          ZwClose(hFile);
          //释放内存
         // ExFreePool(pBuffer);

 }

 VOID SyncTechUnload(IN PDRIVER_OBJECT DriverObject)
 {

     KeCancelTimer(&Timer);
     IoFreeWorkItem(pIoWorkItem);
     IoDeleteDevice(DriverObject->DeviceObject);
     KdPrint(("dpc:DpcTest unload！\n"));

 }

代码赋值粘贴，编译后安装.sys,可直接运行。