IO定時(shí)器每隔1s就會觸發(fā)一次，從而進(jìn)入到定時(shí)器例程中，如果某個(gè)操作是每n秒執(zhí)行一次（n為正整數(shù)）可以考慮在定時(shí)器例程中記錄一個(gè)計(jì)數(shù)器大小就為n，每次進(jìn)入定時(shí)器例程中時(shí)將計(jì)數(shù)器減一，當(dāng)計(jì)數(shù)器為0時(shí)，表示到達(dá)n秒，這個(gè)時(shí)候可以執(zhí)行操作。IO定時(shí)器只適合處理整數(shù)秒的情況 在使用IO定時(shí)器之前需要對定時(shí)器進(jìn)行初始化，初始化函數(shù)為IoInitializeTimer，定義如下：
NTSTATUS IoInitializeTimer( IN PDEVICE_OBJECT DeviceObject, //設(shè)備對象指針 IN PIO_TIMER_ROUTINE TimerRoutine,//定時(shí)器例程 IN PVOID Context//傳給定時(shí)器例程的函數(shù) );初始化完成后可以使用IoStartTimer來啟動定時(shí)器，使用IoStopTimer來停止定時(shí)器，下面是一個(gè)例子
#define PAGEDCODE code_seg("PAGE")#define LOCKEDCODE code_seg()#define INITCODE code_seg("INIT")#define PAGEDDATA data_seg("PAGE")#define LOCKEDDATA data_seg()#define INITDATA data_seg("INIT")typedef struct _tag_DEVICE_EXTENSION{ PDEVICE_OBJECT DeviceObject; UNICODE_STRING uDeviceName; UNICODE_STRING uSymbolickName; LONG lTimerCount; //定時(shí)器觸發(fā)時(shí)間，以秒為單位}DEVICE_EXTENSION, *PDEVICE_EXTENSION;NTSTATUS DriverEntry(DRIVER_OBJECT *DriverObject, PUNICODE_STRING RegistryPath){ NTSTATUS status; LONG i; PDEVICE_OBJECT pDeviceObject; UNREFERENCED_PARAMETER(RegistryPath); DriverObject->DriverUnload = DriverUnload; //設(shè)置派遣函數(shù)，這些代碼在這就省略了 status = CreateDevice(DriverEntry, &pDeviceObject); IoStartTimer(pDeviceObject); return status;}#PRagma LOCKEDCODEVOID IoTimer(DEVICE_OBJECT *DeviceObject,PVOID Context){ LONG ret; PDEVICE_EXTENSION pDeviceExtension; UNICODE_STRING uProcessName; PEPROCESS pCurrProcess; UNREFERENCED_PARAMETER(Context); pDeviceExtension = (PDEVICE_EXTENSION)(DeviceObject->DeviceExtension); ASSERT(NULL != pDeviceExtension); //采用互鎖操作將定時(shí)器數(shù)減一 InterlockedDecrement(&pDeviceExtension->lTimerCount); //判斷當(dāng)前時(shí)間是否到達(dá)3秒 ret = InterlockedCompareExchange(&pDeviceExtension->lTimerCount, TIME_OUT, 0); if(0 == ret) { DbgPrint("3s time out/n"); } pCurrProcess = IoGetCurrentProcess(); RtlInitUnicodeString(&uProcessName, (PTSTR)((ULONG)pCurrProcess + 0x174)); DbgPrint("the current process %wZ", uProcessName);}#pragma INITCODENTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObject,PDEVICE_OBJECT *ppDeviceObject){ NTSTATUS status; UNICODE_STRING uDeviceName; UNICODE_STRING uSymbolickName; PDEVICE_EXTENSION pDeviceExtension; RtlInitUnicodeString(&uDeviceName, DEVICE_NAME); RtlInitUnicodeString(&uSymbolickName, SYMBOLICK_NAME); if(NULL != ppDeviceObject) { //創(chuàng)建設(shè)備對象并填充設(shè)備擴(kuò)展中的變量 ... IoInitializeTimer(*ppDeviceObject, IoTimer, NULL); status = IoCreateSymbolicLink(&uSymbolickName, &uDeviceName); if(!NT_SUCCESS(status)) { //出錯的話就做一些清理工作 ... return status; } if(NULL != pDeviceExtension) { RtlInitUnicodeString(&pDeviceExtension->uSymbolickName, SYMBOLICK_NAME); } return status; } return STATUS_UNSUCCESSFUL;}需要注意的是IO定時(shí)器例程是位于DISPATCH_LEVEL，所以它不能使用分頁內(nèi)存，所以在函數(shù)前加上一句#pragma LOCKEDCODE，表示它在非分頁內(nèi)存中
DPC定時(shí)器相比IO定時(shí)器來說更加靈活，它可以指定任何時(shí)間間隔。DPC內(nèi)部使用KTIMER這個(gè)內(nèi)核對象進(jìn)行定時(shí)，每當(dāng)時(shí)間到達(dá)設(shè)置的時(shí)間，那么系統(tǒng)就會將對應(yīng)的DPC例程加入到DPC隊(duì)列中，當(dāng)系統(tǒng)讀取DPC隊(duì)列時(shí)，這個(gè)DPC例程就會被執(zhí)行，使用DPC定時(shí)器的步驟一般是： 1. 分別調(diào)用KeInitializeTimer和KeInitializeDpc初始化KTIMER對象和DPC對象 2. 用KeSetTimer開啟定時(shí)器 3. 在DPC例程中再次調(diào)用KeSetTimer開啟定時(shí)器 4. 調(diào)用KeCancelTimer關(guān)閉定時(shí)器 由于每次執(zhí)行KeSetTimer都只會觸發(fā)一次DPC例程，所以如果想要周期性的調(diào)用DPC例程，需要在DPC例程中再次調(diào)用KeSetTimer。 這些函數(shù)的定義如下:
VOID KeInitializeDpc( IN PRKDPC Dpc, //DPC對象 IN PKDEFERRED_ROUTINE DeferredRoutine, //DPC例程 IN PVOID DeferredContext//傳給DPC例程的參數(shù) );BOOLEAN KeSetTimer( IN PKTIMER Timer,//定時(shí)器 IN LARGE_INTEGER DueTime, //隔多久觸發(fā)這個(gè)DPC例程，這個(gè)值是正數(shù)則表示從1601年1月1日到觸發(fā)這個(gè)DPC例程所經(jīng)歷的時(shí)間，為負(fù)數(shù)，則表示從當(dāng)前時(shí)間，間隔多長時(shí)間后觸發(fā)，單位為100ns IN PKDPC Dpc OPTIONAL //傳入上面初始化的DPC對象 );下面是一個(gè)使用的例子
typedef struct _tag_DEVICE_EXTENSION{ PDEVICE_OBJECT pDeviceObj; UNICODE_STRING uDeviceName; UNICODE_STRING uSymbolickName; KTIMER timer; KDPC Dpc;}DEVICE_EXTENSION, *PDEVICE_EXTENSION;NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath){ PDEVICE_EXTENSION pDeviceExtension; PDEVICE_OBJECT pDeviceObj; int i; NTSTATUS status; LARGE_INTEGER time_out; UNREFERENCED_PARAMETER(pRegistryPath); pDriverObject->DriverUnload = DriverUnload; //設(shè)置派遣函數(shù) ... status = CreateDevice(pDriverObject, &pDeviceObj); //失敗處理 ... //設(shè)置定時(shí)器 time_out.QuadPart = -1 * 10000000; //1s = 1000000000ns status = KeSetTimer(&pDeviceExtension->timer,time_out, &pDeviceExtension->Dpc); return STATUS_SUCCESS;}VOID DriverUnload(PDRIVER_OBJECT pDriverObject){ //該函數(shù)主要用來清理相關(guān)資源 ...}NTSTATUS DefauleDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp){ //默認(rèn)返回成功}NTSTATUS CreateDevice(PDRIVER_OBJECT pDriverObj, PDEVICE_OBJECT *ppDeviceObj){ PDEVICE_EXTENSION pDevEx; PDEVICE_OBJECT pDevObj; UNICODE_STRING uDeviceName; UNICODE_STRING uSymbolicName; NTSTATUS status; //創(chuàng)建設(shè)備對象，填充擴(kuò)展設(shè)備內(nèi)容 ... //初始化KTIMER DPC KeInitializeTimer(&pDevEx->timer); KeInitializeDpc(&pDevEx->Dpc, TimerDpc, pDevObj); //設(shè)置連接符號 ... return STATUS_SUCCESS;}VOID TimerDpc( __in struct _KDPC *Dpc, __in_opt PVOID DeferredContext, __in_opt PVOID SystemArgument1, __in_opt PVOID SystemArgument2 ){ static int i = 0; PTSTR pProcessName; PEPROCESS pEprocess; LARGE_INTEGER time_out; PDEVICE_OBJECT pDevObj = (PDEVICE_OBJECT)DeferredContext; PDEVICE_EXTENSION pDevEx = (PDEVICE_EXTENSION)(pDevObj->DeviceExtension); ASSERT(NULL != pDevObj); pEprocess = PsGetCurrentProcess(); pProcessName = (PTSTR)((ULONG)pEprocess + 0x174); DbgPrint("%d Call TimerDpc, Process: %s/n", i, pProcessName); time_out.QuadPart = -1 * 10000000; //1s = 1000000000ns KeSetTimer(&pDevEx->timer, time_out, &pDevEx->Dpc); i++;}新聞熱點(diǎn)
疑難解答
