驅動程序啓動類型屬性

Question

我需要檢測驅動程序是否在啓動或系統中初始化...並且我有變量「DEVICE_OBJECT」來獲取此信息。研究了「DEVICE_OBJECT」和「DRIVER_OBJECT」的屬性來提取這些信息而沒有成功。有沒有人有任何提示如何做？

Answer 1

NTSTATUS 
IopInitializeDeviceNodeService(PDEVICE_NODE DeviceNode, BOOLEAN BootDriverOnly) 
{ 
    NTSTATUS Status; 
    ULONG ServiceStart; 
    RTL_QUERY_REGISTRY_TABLE QueryTable[2]; 

    if (DeviceNode->ServiceName.Buffer == NULL) 
    { 
     return STATUS_UNSUCCESSFUL; 
    } 

    /* 
    * Get service start value 
    */ 

    RtlZeroMemory(QueryTable, sizeof(QueryTable)); 
    QueryTable[0].Name = L"Start"; 
    QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT; 
    QueryTable[0].EntryContext = &ServiceStart; 
    Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES, 
     DeviceNode->ServiceName.Buffer, QueryTable, NULL, NULL); 
    if (!NT_SUCCESS(Status)) 
    { 
     DPRINT("RtlQueryRegistryValues() failed (Status %x)\n", Status); 
     return Status; 
    }