通过自定义共享内存对象在不同驱动程序间传输数据的方法

typedef struct _DATA_OBJECT
{
  ULONG ReferenceCount; //对象的引用计数
  ULONG ObjSize;        //对象的大小
  ULONG BufSize;        //对象中带传输数据的大小
  PVOID pBuffer;      //存放待传输数据的地址
}DATA_OBJECT, *PDATA_OBJECT;

NTSTATUS keCreateDataObject(PDATA_OBJECT *ppDataObj, ULONG Size)
{
  ULONG dwLength;
  PDATA_OBJECT pDataObj;

  if (Size == 0)
    return STATUS_INVALID_VARIANT;

  dwLength = sizeof(DATA_OBJECT)+Size;
  pDataObj = (PDATA_OBJECT)ExAllocatePoolWithTag(NonPagedPool, dwLength, ‘SHTR‘); //分配共享内存对象

  if (pDataObj == NULL)
    return STATUS_NO_MEMORY;

  pDataObj->ObjSize = dwLength;
  pDataObj->BufSize = Size;
  pDataObj->ReferenceCount = 1;      //初始引用计数为1
  pDataObj->pBuffer = (PVOID)(pDataObj + 1); //用于存储待传输数据的内存地址
  *ppDataObj = pDataObj;

  return STATUS_SUCCESS;
}

NTSTATUS keAddReferDataObject(PDATA_OBJECT pDataObj)
{
  if (pDataObj)
  {
    InterlockedIncrement(&pDataObj->ReferenceCount); //引用计数增加1
    return STATUS_SUCCESS;
  }

  return STATUS_INVALID_VARIANT;
}

PVOID KeGetDataObjectBuffer(PDATA_OBJECT pDataObj)
{
  if (pDataObj)
    return pDataObj->pBuffer;
  else
    return NULL;
}

NTSTATUS keReleaseDataObject(PDATA_OBJECT pDataObj)
{
  ULONG  uRef;

  if (pDataObj)
  {
    uRef = InterlockedDecrement(&pDataObj->ReferenceCount);//引用计数减少1
    if (uRef == 0) //引用计数为0时释放分配的内存
    {
      ExFreePoolWithTag(pDataObj, ‘SHTR‘);
      pDataObj = NULL;
    }
    return STATUS_SUCCESS;
  }

  return  STATUS_INVALID_VARIANT；
}

typedef struct _CallbackContext
{
  PCALLBACK_OBJECT pCallbackObject;
  PVOID pCallbackRegisterHandle;
}CallbackContext, *PCallbackContext;

NTSTATUS CreateCallbackObject(PCallbackContext pCallbackContext)
{
  OBJECT_ATTRIBUTES ObjectAttr;
  UNICODE_STRING    CallBackObjectName;
  NTSTATUS          ntStatus;
  PCALLBACK_OBJECT  pCallbackObject = NULL;
  PVOID             pCallbackRegisterHandle = NULL;
  
  RtlInitUnicodeString(&CallBackObjectName, L”\\Callback\\VenderDefinedCallbackObject”); //回调对象的名称
  InitializeObjectAttributes(&ObjectAttr, &CallBackObjectName, OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, NULL, NULL);

  ntStatus = ExCreateCallback(&pCallbackObject, &ObjectAttr, TRUE, FALSE);
  if (!NT_SUCCESS(ntStatus))
    return ntStatus;

  pCallbackContext->pCallbackObject = pCallbackObject; //保存生成的回调对象

  return ntStatus;
}

VOID CloseCallbackObject(PCallbackContext pCallbackContext)
{
  if (pCallbackContext->pCallbackObject)
  {
    ObDereferenceObject(pCallbackContext->pCallbackObject);
    pCallbackContext->pCallbackObject = NULL;
  }
}

VOID PrepareDataAndNotify(PCallbackContext pCallbackContext)
{
  PVOID pData;

  keAddReferDataObject(pDataObject);
  pData = KeGetDataObjectBuffer(pDataObject)

  {
    copy data waiting to be transferred to pData;
  }

  keReleaseDataObject(pDataObject);

  ExNotifyCallback(pCallbackContext->pCallbackObject, //生成的回调对象 
                  (PVOID)pDataObj; //共享内存对象
                  Argument2); //其他参数
}

NTSTATUS RegisterCallback(PCallbackContext pCallbackContext)
{
  OBJECT_ATTRIBUTES ObjectAttr;
  UNICODE_STRING    CallBackObjectName;
  NTSTATUS          ntStatus;
  PCALLBACK_OBJECT  pCallbackObject = NULL;
  PVOID             pCallbackRegisterHandle = NULL;

  RtlInitUnicodeString(&CallBackObjectName, L”\\Callback\\VenderDefinedCallbackObject”);
  InitializeObjectAttributes(&ObjectAttr, &CallBackObjectName, OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, NULL, NULL);
  
  ntStatus = ExCreateCallback(&pCallbackObject, &ObjectAttr, FALSE, FALSE); //打开指定的回调对象
  if (!NT_SUCCESS(ntStatus))
    retrn ntStatus;

  pCallbackRegisterHandle = ExRegisterCallback(pCallbackObject, CallbackRoutine, pCallbackContext); //注册回调例程
  if (pCallbackRegisterHandle == NULL)
  {
    ObDereferenceObject(pCallbackObject);
    return STATUS_UNSUCCESSFUL;
  }
  else
  {
    pCallbkContext->pCallbackObject = pCallbackObject;
    pCallbkContext->pCallbackRegisterHandle = pCallbackRegisterHandle;
  }
  
  return STATUS_SUCCESS;
}

VOID UnregisterCallback(PCallbackContext pCallbackContext)
{
  if (pCallbackContext->pCallbackRegisterHandle)
  {
    ExUnregisterCallback(pCallbkContext->pCallbackRegisterHandle); //注销已注册的回调例程
    pCallbkContext->pCamCallbackRegisterHandle = NULL;
  }

  if (pCallbackRegisterHandle == NULL)
  {
    ObDereferenceObject(pCallbackContext->pCallbackObject);
    pCallbackContext->pCallbackObject = NULL;
  }
}

VOID CallbackRoutine(PVOID CallBackContext, PVOID Data, PVOID Argument2)
{
  NTSTATUS          ntStatus;
  PDATA_OBJECT      pDataObject = NULL;
  PVOID             pReceivedData = NULL;
  PCallbackContext  pCallbackContext = (PCallbackContext)CallBackContext;

  pDataObject = (PDATA_OBJECT)Data;
  if (pDataObject)
  {
    keAddReferDataObject(pDataObject);
    pReceivedData = KeGetDataObjectBuffer(pDataObject)

    {
      Process received data;
    }

    keReleaseDataObject(pDataObject);
  }
}