寒江独钓键盘过滤卸载蓝屏

1.status = ObReferenceObjectByName( &uniNtNameString, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &KbdDriverObject ); // 如果失败了就直接返回 if (!NT_SUCCESS(status)) { KdPrint(("MyAttach: Couldn't get the MyTest Device Object\n")); return(status); } else { // 这个打开需要解应用。早点解除了免得之后忘记，解的是obreferencebyname打开的驱动对象，不是本驱动程序对应的驱动对象！！！！！ ObDereferenceObject(KbdDriverObject); } 2. c2pDetach(IN PDEVICE_OBJECT pDeviceObject) { PC2P_DEV_EXT devExt; BOOLEAN NoRequestsOutstanding = FALSE; devExt = (PC2P_DEV_EXT)pDeviceObject->DeviceExtension; __try { __try { IoDetachDevice(devExt->TargetDeviceObject); devExt->TargetDeviceObject = NULL; //IoDeleteDevice(pDeviceObject); devExt->pFilterDeviceObject = NULL; DbgPrint(("Detach Finished\n")); } __except (EXCEPTION_EXECUTE_HANDLER) {} } __finally {} return; } 3.c2pUnload(IN PDRIVER_OBJECT DriverObject) { PDEVICE_OBJECT DeviceObject; PDEVICE_OBJECT OldDeviceObject; PC2P_DEV_EXT devExt;

LARGE_INTEGER lDelay; PRKTHREAD CurrentThread; //delay some timelDelay = RtlConvertLongToLargeInteger(100 * DELAY_ONE_MILLISECOND); CurrentThread = KeGetCurrentThread(); // 把当前线程设置为低实时模式，以便让它的运行尽量少影响其他程序。 KeSetPriorityThread(CurrentThread, LOW_REALTIME_PRIORITY);

UNREFERENCED_PARAMETER(DriverObject); KdPrint(("DriverEntry unLoading...\n"));

// 遍历所有设备并一律解除绑定 DeviceObject = DriverObject->DeviceObject; while (DeviceObject) { // 解除绑定并删除所有的设备 c2pDetach(DeviceObject); DeviceObject = DeviceObject->NextDevice; } //ASSERT(NULL == DriverObject->DeviceObject);

while (gC2pKeyCount) { KeDelayExecutionThread(KernelMode, FALSE, &lDelay); }

DeviceObject = DriverObject->DeviceObject; while (DeviceObject) { // 解除绑定并删除所有的设备 IoDeleteDevice(DeviceObject); DeviceObject = DeviceObject->NextDevice; }

KdPrint(("DriverEntry unLoad OK!\n")); return; } 待没有pending的IRP再删除设备，因为设备回调函数中要以设备对象作为参数，故不能在回调执行前就删除设备！！！！

如果觉得《寒江独钓键盘过滤卸载蓝屏》对你有帮助，请点赞、收藏，并留下你的观点哦！