获取中断描述符表IDT的信息

<pre name="code" class="cpp">//GetIDT.h文件
#ifndef _WIN32_WINNT		// Allow use of features specific to Windows XP or later.
#define _WIN32_WINNT 0x0501	// Change this to the appropriate value to target other versions of Windows.
#endif						
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#include <ntddstor.h>
#include <mountdev.h>
#include <ntddvol.h>
#ifdef __cplusplus
}
#endif
//***************************************************************************************************************
//GetIDT.cpp文件
#include "GetIDT.h"
//#include <stdio.h> 
//IDT表的最大项数为256
#define MAX_IDT_ENTRIES    0XFF
#define MAKELONG(a, b)\
	((unsigned long) (((unsigned short) (a)) | ((unsigned long) ((unsigned short) (b))) << 16))
//SIDT返回的数据格式
typedef struct
{
	unsigned short IDTLimit;        //IDT表项的个数
	unsigned short LowIDTBase;      //地址低16位
	unsigned short HiIDTBase;       //地址高16位
}IDTINFO, *PIDTINFO;
#pragma pack(1)
typedef struct
{
	unsigned short LowOffset;				//地址低16位
	unsigned short Selector;				//段选择字
	unsigned char  unused_lo;				//保留
	unsigned char  segment_type:4;			//中断门类型
	unsigned char  system_segment_flag:1;   //为0是中断门
	unsigned char  DPL:2;                   //特权级
	unsigned char  P:1;                     //现在是否是使用中断
	unsigned short HiOffset;                //地址高16位
}IDTENTRY, *PIDTENTRY;
#pragma pack()
//卸载例程
void GetIDTUnload(IN PDRIVER_OBJECT DriverObject);
//创建和关闭例程
NTSTATUS GetIDTCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
//默认处理例程
NTSTATUS GetIDTDefaultHandler(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
//获取IDT表的例程函数
NTSTATUS Fun_GetIDT();
#ifdef __cplusplus
//驱动入口函数
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath);
#endif
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath)
{
	//设备名称
	UNICODE_STRING DeviceName;
	//设备连接符
	UNICODE_STRING Win32Device;
	//设备对象
	PDEVICE_OBJECT DeviceObject = NULL;
	NTSTATUS status;
	unsigned i;
	//DeviceName-设备对象名称
	RtlInitUnicodeString(&DeviceName,L"\\Device\\GetIDT0");
	//Win32Device-连接符
	RtlInitUnicodeString(&Win32Device,L"\\DosDevices\\GetIDT0");
	for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
	{
		//设置默认的处理例程函数
		DriverObject->MajorFunction[i] = GetIDTDefaultHandler;
	}
	//设置创建处理例程函数
	DriverObject->MajorFunction[IRP_MJ_CREATE] = GetIDTCreateClose;
	//设置关闭处理例程函数
	DriverObject->MajorFunction[IRP_MJ_CLOSE] = GetIDTCreateClose;
	//设置卸载处理例程函数
	DriverObject->DriverUnload = GetIDTUnload;
	//创建设备对象
	status = IoCreateDevice(DriverObject,
							0,
							&DeviceName,
							FILE_DEVICE_UNKNOWN,  //设备类型
							0,
							FALSE,
							&DeviceObject);
	if (!NT_SUCCESS(status))
		return status;
	if (!DeviceObject)
		return STATUS_UNEXPECTED_IO_ERROR;
	//设置缓冲区通信方式
	DeviceObject->Flags |= DO_DIRECT_IO;
	//设置字对齐
	DeviceObject->AlignmentRequirement = FILE_WORD_ALIGNMENT;
	//创建连接符
	status = IoCreateSymbolicLink(&Win32Device, &DeviceName);
	//设备初始化完成
	DeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
	//获取IDT表
	Fun_GetIDT();
	return STATUS_SUCCESS;
}
//获取IDT表的例程函数
NTSTATUS Fun_GetIDT()
{
	IDTINFO idtInfo;
	PIDTENTRY pIdtEntry;
	//获取IDT表的基地址
	__asm sidt idtInfo
	pIdtEntry = (PIDTENTRY)MAKELONG(idtInfo.LowIDTBase, idtInfo.HiIDTBase);
	for (unsigned long i = 0; i < MAX_IDT_ENTRIES; i++)
	{
		//char szBuffer[255];
		PIDTENTRY pTmpIdtEntry = &pIdtEntry[i];
		//获取IDT表的每项的地址
		unsigned long lgAddr = MAKELONG(pTmpIdtEntry->LowOffset, pTmpIdtEntry->HiOffset);
        //_snprintf(szBuffer, 253, "中断号：%d，地址：%08X\r\n", i, lgAddr);
		//显示
		KdPrint(("中断号：%04d，地址：%08X\r\n", i, lgAddr));
	}
	return STATUS_SUCCESS;
}
//卸载例程
void GetIDTUnload(IN PDRIVER_OBJECT DriverObject)
{
	UNICODE_STRING Win32Device;
	RtlInitUnicodeString(&Win32Device,L"\\DosDevices\\GetIDT0");
	IoDeleteSymbolicLink(&Win32Device);
	IoDeleteDevice(DriverObject->DeviceObject);
}
//创建关闭例程
NTSTATUS GetIDTCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
	Irp->IoStatus.Status = STATUS_SUCCESS;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}
//默认处理例程
NTSTATUS GetIDTDefaultHandler(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
	Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
	Irp->IoStatus.Information = 0;
	IoCompleteRequest(Irp, IO_NO_INCREMENT);
	return Irp->IoStatus.Status;
}