思维：利用指针特点，将R0产生的批量数据通过设置结构体存下，再将指定的结构体内存区域（一定大小的指针）拷贝进IRP的缓冲区即可

  1. #include <windows.h>
  2. #include <winioctl.h>
  3. #define  SYMBOLIC_NAME "\\\\.\\sym_name"
  4. //任何宏定义后面都不能有分号！！！
  5. #define CTL_CODE_BASE 0x8000
  6. #define CTL_CMD(i) CTL_CODE(FILE_DEVICE_UNKNOWN,CTL_CODE_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
  7. #define  CTL_TALK CTL_CMD(1)
  8. #define  CTL_GET CTL_CMD(2)
  9. #ifdef _DEBUG
  10. #define new DEBUG_NEW
  11. #endif
  13. typedef struct _PROCESS_INFOR_
  14. {
  15.     UINT64 pid;
  16.     WCHAR processname;
  17. }PROCESS_INFOR, *PPROCESS_INFOR;
  19. //获取进程数量
  20. void getcount()
  21. {
  22.     HANDLE hDevice = NULL;
  23.     DWORD retlen = 0;
  24.     ULONG count = 0;
  25.     hDevice = CreateFile(TEXT(SYMBOLIC_NAME), GENERIC_ALL, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  26.     DeviceIoControl(hDevice, CTL_TALK, &count, sizeof(ULONG), &count, sizeof(ULONG), &retlen, NULL);
  27.     CString demo;
  28.     demo.Format(TEXT("%d"), count);
  29.     AfxMessageBox(demo);
  30. }
  31. //获取进程id
  32. void getinfor()
  33. {
  34.     PPROCESS_INFOR processinfor = (PPROCESS_INFOR)malloc(100 * sizeof(PROCESS_INFOR));
  35.     HANDLE hDevice = NULL;
  36.     DWORD retlen = 0;
  37.     hDevice = CreateFile(TEXT(SYMBOLIC_NAME), GENERIC_ALL, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  38.     DeviceIoControl(hDevice, CTL_GET, processinfor, 100 * sizeof(PROCESS_INFOR), processinfor, 100 * sizeof(PROCESS_INFOR), &retlen, NULL);
  39.     CString demo;
  40.     demo.Format(TEXT("%d"), processinfor[20].pid);
  41.     AfxMessageBox(demo);  // 除非将焦点设置到控件，否则返回 TRUE
  42. }
  1. #include <ntddk.h>
  2. #define  DEVICE_NAME L"\\device\\mydevice"
  3. #define  SYMBOLIC_NAME L"\\dosdevices\\sym_name"
  4. #define CTL_CODE_BASE 0x8000
  5. #define CTL_CMD(i) CTL_CODE(FILE_DEVICE_UNKNOWN,CTL_CODE_BASE+i,METHOD_BUFFERED,FILE_ANY_ACCESS)
  6. #define  CTL_TALK CTL_CMD(1)
  7. #define  CTL_GET CTL_CMD(2)
  9. ULONG count = 0;
  11. typedef struct _PROCESS_INFOR_
  12. {
  13.     UINT64 pid;
  14.     WCHAR processname;
  15. }PROCESS_INFOR, *PPROCESS_INFOR;
  17. VOID GetInfor(PVOID pBuff)
  18. {
  19.     DbgPrint("Suc!");
  20.     UINT64 process_pid = 0;
  21.     PUCHAR process_name = NULL;
  22.     PLIST_ENTRY process_list = NULL;
  23.     PEPROCESS process_first = NULL;
  24.     PEPROCESS process_address = PsGetCurrentProcess();
  25.     ULONG pid_offset = 0x180;
  26.     ULONG list_offset = 0x188;
  27.     ULONG name_offset = 0x2e0;
  28.     ULONG uIndex = 0;
  29.     PPROCESS_INFOR processinfromation = (PPROCESS_INFOR)ExAllocatePool(PagedPool, 100 * sizeof(PROCESS_INFOR));
  30.     //因为双向链表 首节点的位置是0，所以我们要指向第一个节点之前
  31.     process_list = (PLIST_ENTRY)((UINT64)process_address + list_offset);
  32.     process_first = (PEPROCESS)((UINT64)(process_list->Blink) - list_offset);
  33.     if (!process_address)
  34.     {
  35.         DbgPrint("[ERROR]: NOT ....\n");
  36.         return;
  37.     }
  38.     while (process_address)
  39.     {
  40.         process_pid = *(UINT64*)((UINT64)process_address + pid_offset);
  41.         process_name = (PUCHAR)((UINT64)process_address + name_offset);
  42.         processinfromation[uIndex].pid = (UINT64)process_pid;
  43.         DbgPrint("  pid = %ld  name = %s   \n", process_pid, process_name);
  44.         uIndex++;
  45.         count++;
  46.         process_list = process_list->Flink;
  47.         process_address = (PEPROCESS)((UINT64)(process_list)-list_offset);
  48.         if (process_first == process_address)
  49.         {
  50.             DbgPrint("END!......\n");
  51.             break;
  52.         }
  53.     }
  54.     RtlCopyMemory(pBuff, processinfromation, 100 * sizeof(PROCESS_INFOR));
  55.     DbgPrint("进程id:%d", processinfromation[20].pid);
  56. }
  59. NTSTATUS DispatchControl(PDEVICE_OBJECT pDevice, PIRP pIrp)
  60. {
  61.     PVOID pBuff = pIrp->AssociatedIrp.SystemBuffer;
  62.     PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
  63.     ULONG CtlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
  64.     switch (CtlCode)
  65.     {
  66.     case CTL_TALK:
  67.     {
  68.                      ULONG tmpcount = count;
  69.                      RtlCopyMemory(pBuff,&tmpcount,sizeof(ULONG));
  70.                      DbgPrint("%d",tmpcount);
  71.                      pIrp->IoStatus.Information = sizeof(ULONG);
  72.                      break;
  73.     }
  74.     case CTL_GET:
  75.     {
  76.                     GetInfor(pBuff);
  77.                     pIrp->IoStatus.Information = sizeof(PEPROCESS)* 100;
  78.                     break;
  79.     }
  80.     default:
  81.         break;
  82.     }
  83.     pIrp->IoStatus.Status = STATUS_SUCCESS;
  84.     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
  85.     return STATUS_SUCCESS;
  86. }
  88. NTSTATUS DispatchCreate(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
  89. {
  90.     DbgPrint("Create!");
  91.     //设置IRP处理已经成功了
  92.     pIrp->IoStatus.Status = STATUS_SUCCESS;
  93.     //返回多少字节的数据
  94.     pIrp->IoStatus.Information = 0;
  95.     //结束IRP处理流程
  96.     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
  97.     //函数调用成功
  98.     return STATUS_SUCCESS;
  99. }
  103. VOID UnloadDriver(PDRIVER_OBJECT pDriver)
  104. {
  105.     UNICODE_STRING uSyb_Name = RTL_CONSTANT_STRING(SYMBOLIC_NAME);
  106.     IoDeleteDevice(pDriver->DeviceObject);
  107.     IoDeleteSymbolicLink(&uSyb_Name);
  108.     DbgPrint("卸载成功");
  109. }
  111. NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegpath)
  112. {
  113.     PDEVICE_OBJECT pDevice = NULL;
  114.     UNICODE_STRING uDeciceName = RTL_CONSTANT_STRING(DEVICE_NAME);
  115.     UNICODE_STRING uSyb_Name = RTL_CONSTANT_STRING(SYMBOLIC_NAME);
  116.     NTSTATUS status = STATUS_SUCCESS;
  117.     status = IoCreateDevice(pDriver, 0, &uDeciceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevice);
  118.     if (!NT_SUCCESS(status))
  119.     {
  120.         DbgPrint("创建设备失败\n");
  121.     }
  122.     status = IoCreateSymbolicLink(&uSyb_Name, &uDeciceName);
  123.     if (!NT_SUCCESS(status))
  124.     {
  125.         DbgPrint("创建符号链接失败\n");
  126.     }
  128.     pDevice->Flags |= DO_BUFFERED_IO;
  129.     pDriver->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
  130.     pDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchControl;
  131.     DbgPrint("驱动加载成功");
  132.     pDriver->DriverUnload = UnloadDriver;
  133.     return STATUS_SUCCESS;
  134. }