自学教程：C++ ExFreePool函数代码示例

//.........这里部分代码省略.........    cdb->MODE_SENSE.Pc = 0x0B;    buffer = ExAllocatePool(NonPagedPoolCacheAligned,        sizeof(NINE_TRACKSENSE_DATA));    if (!buffer) {        return STATUS_INSUFFICIENT_RESOURCES;    }    status = ScsiClassSendSrbSynchronous(DeviceObject,                                &srb,                                buffer,                                sizeof(NINE_TRACKSENSE_DATA),                                FALSE);    if (NT_SUCCESS(status)) {        Irp->IoStatus.Information = sizeof(TAPE_GET_DRIVE_PARAMETERS);        //        // Indicate support of following:        //        tapeGetDriveParams->ECC = FALSE;        tapeGetDriveParams->Compression = FALSE;        tapeGetDriveParams->DataPadding = FALSE;        tapeGetDriveParams->ReportSetmarks = FALSE;        tapeGetDriveParams->FeaturesLow =            TAPE_DRIVE_ERASE_SHORT |            TAPE_DRIVE_FIXED_BLOCK |            TAPE_DRIVE_VARIABLE_BLOCK |            TAPE_DRIVE_WRITE_PROTECT |            TAPE_DRIVE_GET_ABSOLUTE_BLK |            TAPE_DRIVE_GET_LOGICAL_BLK;        tapeGetDriveParams->FeaturesHigh =            TAPE_DRIVE_LOAD_UNLOAD |            TAPE_DRIVE_LOCK_UNLOCK |            TAPE_DRIVE_SET_BLOCK_SIZE |            TAPE_DRIVE_ABSOLUTE_BLK |            TAPE_DRIVE_ABS_BLK_IMMED |            TAPE_DRIVE_LOGICAL_BLK |            TAPE_DRIVE_END_OF_DATA |            TAPE_DRIVE_FILEMARKS |            TAPE_DRIVE_SEQUENTIAL_FMKS |            TAPE_DRIVE_REVERSE_POSITION |            TAPE_DRIVE_WRITE_FILEMARKS;    }    ExFreePool(buffer);    if (!NT_SUCCESS(status)) {        return status;    }    //    // Zero CDB in SRB on stack.    //    RtlZeroMemory(cdb, MAXIMUM_CDB_SIZE);    srb.CdbLength = CDB6GENERIC_LENGTH;    cdb->CDB6GENERIC.OperationCode = SCSIOP_READ_BLOCK_LIMITS;    //    // Set timeout value.    //    srb.TimeOutValue = deviceExtension->TimeOutValue;    blockLimits = ExAllocatePool(NonPagedPoolCacheAligned,        sizeof(READ_BLOCK_LIMITS_DATA));    if (!blockLimits) {        return STATUS_INSUFFICIENT_RESOURCES;    }    RtlZeroMemory(blockLimits, sizeof(READ_BLOCK_LIMITS_DATA));    status = ScsiClassSendSrbSynchronous(DeviceObject,                                &srb,                                blockLimits,                                sizeof(READ_BLOCK_LIMITS_DATA),                                FALSE);    if (NT_SUCCESS(status)) {        tapeGetDriveParams->MaximumBlockSize = blockLimits->BlockMaximumSize[2];        tapeGetDriveParams->MaximumBlockSize += (blockLimits->BlockMaximumSize[1] << 8);        tapeGetDriveParams->MaximumBlockSize += (blockLimits->BlockMaximumSize[0] << 16);        tapeGetDriveParams->MinimumBlockSize = blockLimits->BlockMinimumSize[1];        tapeGetDriveParams->MinimumBlockSize += (blockLimits->BlockMinimumSize[0] << 8);    }    ExFreePool(blockLimits);    return status;} // end TapeGetDriveParameters()

/* Creates the client side */NTSTATUS DEFAULTAPIMsfsCreate(PDEVICE_OBJECT DeviceObject,           PIRP Irp){    PIO_STACK_LOCATION IoStack;    PFILE_OBJECT FileObject;    PMSFS_DEVICE_EXTENSION DeviceExtension;    PMSFS_FCB Fcb;    PMSFS_CCB Ccb;    PMSFS_FCB current = NULL;    PLIST_ENTRY current_entry;    KIRQL oldIrql;    DPRINT("MsfsCreate(DeviceObject %p Irp %p)/n", DeviceObject, Irp);    IoStack = IoGetCurrentIrpStackLocation(Irp);    DeviceExtension = DeviceObject->DeviceExtension;    FileObject = IoStack->FileObject;    DPRINT("Mailslot name: %wZ/n", &FileObject->FileName);    Ccb = ExAllocatePool(NonPagedPool, sizeof(MSFS_CCB));    if (Ccb == NULL)    {        Irp->IoStatus.Status = STATUS_NO_MEMORY;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_NO_MEMORY;    }    KeLockMutex(&DeviceExtension->FcbListLock);    current_entry = DeviceExtension->FcbListHead.Flink;    while (current_entry != &DeviceExtension->FcbListHead)    {        current = CONTAINING_RECORD(current_entry,                                    MSFS_FCB,                                    FcbListEntry);        if (!RtlCompareUnicodeString(&FileObject->FileName, &current->Name, TRUE))            break;        current_entry = current_entry->Flink;    }    if (current_entry == &DeviceExtension->FcbListHead)    {        ExFreePool(Ccb);        KeUnlockMutex(&DeviceExtension->FcbListLock);        Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_UNSUCCESSFUL;    }    Fcb = current;    KeAcquireSpinLock(&Fcb->CcbListLock, &oldIrql);    InsertTailList(&Fcb->CcbListHead, &Ccb->CcbListEntry);    KeReleaseSpinLock(&Fcb->CcbListLock, oldIrql);    Fcb->ReferenceCount++;    Ccb->Fcb = Fcb;    KeUnlockMutex(&DeviceExtension->FcbListLock);    FileObject->FsContext = Fcb;    FileObject->FsContext2 = Ccb;    FileObject->Flags |= FO_MAILSLOT;    Irp->IoStatus.Status = STATUS_SUCCESS;    Irp->IoStatus.Information = 0;    IoCompleteRequest(Irp, IO_NO_INCREMENT);    return STATUS_SUCCESS;}

NTSTATUSNTAPISeLocateProcessImageName(IN PEPROCESS Process,                         OUT PUNICODE_STRING *ProcessImageName){    POBJECT_NAME_INFORMATION AuditName;    PUNICODE_STRING ImageName;    PFILE_OBJECT FileObject;    NTSTATUS Status = STATUS_SUCCESS;    PAGED_CODE();    /* Assume failure */    *ProcessImageName = NULL;    /* Check if we have audit info */    AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;    if (!AuditName)    {        /* Get the file object */        Status = PsReferenceProcessFilePointer(Process, &FileObject);        if (!NT_SUCCESS(Status)) return Status;        /* Initialize the audit structure */        Status = SeInitializeProcessAuditName(FileObject, TRUE, &AuditName);        if (NT_SUCCESS(Status))        {            /* Set it */            if (InterlockedCompareExchangePointer((PVOID*)&Process->                                                  SeAuditProcessCreationInfo.ImageFileName,                                                  AuditName,                                                  NULL))            {                /* Someone beat us to it, deallocate our copy */                ExFreePool(AuditName);            }        }        /* Dereference the file object */        ObDereferenceObject(FileObject);        if (!NT_SUCCESS(Status)) return Status;    }    /* Get audit info again, now we have it for sure */    AuditName = Process->SeAuditProcessCreationInfo.ImageFileName;    /* Allocate the output string */    ImageName = ExAllocatePoolWithTag(NonPagedPool,                                      AuditName->Name.MaximumLength +                                      sizeof(UNICODE_STRING),                                      TAG_SEPA);    if (!ImageName) return STATUS_NO_MEMORY;    /* Make a copy of it */    RtlCopyMemory(ImageName,                  &AuditName->Name,                  AuditName->Name.MaximumLength + sizeof(UNICODE_STRING));    /* Fix up the buffer */    ImageName->Buffer = (PWSTR)(ImageName + 1);    /* Return it */    *ProcessImageName = ImageName;    /* Return status */    return Status;}

NTSTATUSFsRtlGetTunnelParameterValue (    IN PUNICODE_STRING ValueName,    IN OUT PULONG Value    )/*++Routine Description:    Given a unicode value name this routine will go into the registry    location for the Tunnel parameter information and get the    value.Arguments:    ValueName - the unicode name for the registry value located in the                double space configuration location of the registry.    Value   - a pointer to the ULONG for the result.Return Value:    NTSTATUS    If STATUS_SUCCESSFUL is returned, the location *Value will be    updated with the DWORD value from the registry.  If any failing    status is returned, this value is untouched.--*/{    HANDLE Handle;    NTSTATUS Status;    ULONG RequestLength;    ULONG ResultLength;    UCHAR Buffer[KEY_WORK_AREA];    UNICODE_STRING KeyName;    OBJECT_ATTRIBUTES ObjectAttributes;    PKEY_VALUE_FULL_INFORMATION KeyValueInformation;    KeyName.Buffer = TUNNEL_KEY_NAME;    KeyName.Length = sizeof(TUNNEL_KEY_NAME) - sizeof(WCHAR);    KeyName.MaximumLength = sizeof(TUNNEL_KEY_NAME);    InitializeObjectAttributes(&ObjectAttributes,                               &KeyName,                               OBJ_CASE_INSENSITIVE,                               NULL,                               NULL);    Status = ZwOpenKey(&Handle,                       KEY_READ,                       &ObjectAttributes);    if (!NT_SUCCESS(Status)) {        return Status;    }    RequestLength = KEY_WORK_AREA;    KeyValueInformation = (PKEY_VALUE_FULL_INFORMATION)Buffer;    while (1) {        Status = ZwQueryValueKey(Handle,                                 ValueName,                                 KeyValueFullInformation,                                 KeyValueInformation,                                 RequestLength,                                 &ResultLength);        ASSERT( Status != STATUS_BUFFER_OVERFLOW );        if (Status == STATUS_BUFFER_OVERFLOW) {            //            // Try to get a buffer big enough.            //            if (KeyValueInformation != (PKEY_VALUE_FULL_INFORMATION)Buffer) {                ExFreePool(KeyValueInformation);            }            RequestLength += 256;            KeyValueInformation = (PKEY_VALUE_FULL_INFORMATION)                                  ExAllocatePoolWithTag(PagedPool,                                                        RequestLength,                                                        'KnuT');            if (!KeyValueInformation) {                return STATUS_NO_MEMORY;            }        } else {            break;        }//.........这里部分代码省略.........

//.........这里部分代码省略.........          status = STATUS_BUFFER_OVERFLOW;        }      } else {        DDbgPrint("   MountPoint %wZ is not a drive/n", dcb->MountPoint);        status = STATUS_NOT_FOUND;      }    } else {      DDbgPrint("   MountPoint is NULL or undefined/n");      status = STATUS_NOT_FOUND;    }  } break;  case IOCTL_MOUNTDEV_LINK_CREATED: {    PMOUNTDEV_NAME mountdevName = Irp->AssociatedIrp.SystemBuffer;    DDbgPrint("   IOCTL_MOUNTDEV_LINK_CREATED/n");    status = STATUS_SUCCESS;    if (!IsUnmountPending(DeviceObject) && mountdevName != NULL &&        mountdevName->NameLength > 0) {      WCHAR *symbolicLinkNameBuf =          ExAllocatePool((mountdevName->NameLength + 1) * sizeof(WCHAR));      if (symbolicLinkNameBuf == NULL) {        status = STATUS_INSUFFICIENT_RESOURCES;        break;      }      RtlZeroMemory(symbolicLinkNameBuf,                    (mountdevName->NameLength + 1) * sizeof(WCHAR));      RtlCopyMemory(symbolicLinkNameBuf, mountdevName->Name,                    mountdevName->NameLength);      DDbgPrint("   MountDev Name: %ws/n", symbolicLinkNameBuf);      if (wcsncmp(symbolicLinkNameBuf, L"//DosDevices//", 12) == 0) {        if (dcb->MountPoint != NULL && dcb->MountPoint->Length == 0) {          ExFreePool(dcb->MountPoint);          dcb->MountPoint = NULL;        }        if (dcb->MountPoint == NULL) {          DDbgPrint("   Not current MountPoint. MountDev set as MountPoint/n");          dcb->MountPoint = DokanAllocateUnicodeString(symbolicLinkNameBuf);          if (dcb->DiskDeviceName != NULL) {            PMOUNT_ENTRY mountEntry;            PDOKAN_CONTROL dokanControl = ExAllocatePool(sizeof(DOKAN_CONTROL));            if (dokanControl == NULL) {              ExFreePool(symbolicLinkNameBuf);              status = STATUS_INSUFFICIENT_RESOURCES;              break;            }            RtlZeroMemory(dokanControl, sizeof(*dokanControl));            RtlCopyMemory(dokanControl->DeviceName, dcb->DiskDeviceName->Buffer,                          dcb->DiskDeviceName->Length);            if (dcb->UNCName->Buffer != NULL && dcb->UNCName->Length > 0) {              RtlCopyMemory(dokanControl->UNCName, dcb->UNCName->Buffer,                            dcb->UNCName->Length);            }            mountEntry = FindMountEntry(dcb->Global, dokanControl, TRUE);            ExFreePool(dokanControl);            if (mountEntry != NULL) {              RtlStringCchCopyW(mountEntry->MountControl.MountPoint,                                MAXIMUM_FILENAME_LENGTH, symbolicLinkNameBuf);            } else {              DDbgPrint("   Cannot found associated MountEntry./n");            }          } else {            DDbgPrint(                "   DiskDeviceName is null. Is device currently unmounted?/n");          }

NTSTATUS KDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp){    NTSTATUS              status = STATUS_UNSUCCESSFUL;    PIO_STACK_LOCATION    irpStack  = IoGetCurrentIrpStackLocation(Irp);    PPROCESS_EVENT        pProcessEvent;	PCHAR pOutputBuffer;	PPROCESS_INFORMATION pInputBuffer;	UINT dwDataWritten = 0;	PCAPTURE_PROCESS_MANAGER pProcessManager;	/* Get the process manager from the device extension */    pProcessManager = gpDeviceObject->DeviceExtension;    switch(irpStack->Parameters.DeviceIoControl.IoControlCode)    {        case IOCTL_CAPTURE_GET_PROCINFO:			/* Update the time the user space program last sent an IOCTL */			//UpdateLastContactTime();			/* Return some of the process events that are queued */            if(irpStack->Parameters.DeviceIoControl.OutputBufferLength >= sizeof(PROCESS_EVENT))            {				ULONG left = irpStack->Parameters.DeviceIoControl.OutputBufferLength;				ULONG done = 0;				pOutputBuffer = Irp->UserBuffer;				__try {					ProbeForWrite(pOutputBuffer, 								irpStack->Parameters.DeviceIoControl.OutputBufferLength,								__alignof (PROCESS_EVENT));					//ExAcquireFastMutex(&pProcessManager->mProcessWaitingSpinLock);					//if(pProcessManager->pCurrentProcessEvent != NULL)					//{					//	RtlCopyMemory(pOutputBuffer+done, pProcessManager->pCurrentProcessEvent, sizeof(PROCESS_EVENT));					//	done += sizeof(PROCESS_EVENT);					//	ExFreePoolWithTag(pProcessManager->pCurrentProcessEvent, PROCESS_POOL_TAG);					//	pProcessManager->pCurrentProcessEvent = NULL;					//}					//ExReleaseFastMutex(&pProcessManager->mProcessWaitingSpinLock);										if(!IsListEmpty(&pProcessManager->lQueuedProcessEvents))					{						PLIST_ENTRY head;						PPROCESS_EVENT_PACKET pProcessEventPacket;						head = ExInterlockedRemoveHeadList(&pProcessManager->lQueuedProcessEvents, &pProcessManager->lQueuedProcessEventsSpinLock);						pProcessManager->nQueuedProcessEvents--;						pProcessEventPacket = CONTAINING_RECORD(head, PROCESS_EVENT_PACKET, Link);												RtlCopyMemory(pOutputBuffer, &pProcessEventPacket->processEvent, sizeof(PROCESS_EVENT));						done = sizeof(PROCESS_EVENT);						ExFreePool(pProcessEventPacket);						// Notify that we still have process events queued						if( pProcessManager->nQueuedProcessEvents )						{							KeSetEvent(pProcessManager->eNewProcessEvent, 0, FALSE);							KeClearEvent(pProcessManager->eNewProcessEvent);						}					}										dwDataWritten = done;					status = STATUS_SUCCESS;				} __except( EXCEPTION_EXECUTE_HANDLER ) {					DbgPrint("CaptureProcessMonitor: EXCEPTION IOCTL_CAPTURE_GET_PROCINFO - %08x/n", GetExceptionCode());					status = GetExceptionCode();     				}                    }            break;        default:            break;    }

//.........这里部分代码省略.........                                  Buffer );                FoundNextLsn = TRUE;            }        } __finally {            DebugUnwind( LfsReadNextLogRecord );            //            //  If we exited due to an error, we have to restore the context            //  block.            //            if (UnwindRememberLcbFields) {                if (AbnormalTermination()) {                    //                    //  If the record header in the context block is not                    //  the same as we started with.  Then we unpin that                    //  data.                    //                    if (Lcb->RecordHeaderBcb != NULL) {                        CcUnpinData( Lcb->RecordHeaderBcb );                    }                    if (Lcb->CurrentLogRecord != NULL                        && Lcb->AuxilaryBuffer == TRUE) {                        ExFreePool( Lcb->CurrentLogRecord );                    }                    Lcb->RecordHeaderBcb = UnwindRecordHeaderBcb;                    Lcb->RecordHeader = UnwindRecordHeader;                    Lcb->CurrentLogRecord = UnwindCurrentLogRecord;                    Lcb->AuxilaryBuffer = UnwindAuxilaryBuffer;                //                //  Otherwise, if we have successfully found the next Lsn,                //  we free up any resources being held from the previous search.                //                } else if (FoundNextLsn ) {                    if (UnwindRecordHeaderBcb != NULL) {                        CcUnpinData( UnwindRecordHeaderBcb );                    }                    if (UnwindCurrentLogRecord != NULL                        && UnwindAuxilaryBuffer == TRUE) {                        ExFreePool( UnwindCurrentLogRecord );                    }                //                //  Restore the Bcb and auxilary buffer field for the final                //  cleanup.                //                } else {

NTSTATUSReleaseTimeoutPendingIrp(   PDEVICE_EXTENSION	DeviceExtension   ){	KIRQL				oldIrql;    PLIST_ENTRY			thisEntry, nextEntry, listHead;	PIRP_ENTRY			irpEntry;	LARGE_INTEGER		tickCount;	LIST_ENTRY			completeList;	PIRP				irp;	DDbgPrint("==> ReleaseTimeoutPendingIRP/n");	InitializeListHead(&completeList);	ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);	KeAcquireSpinLock(&DeviceExtension->PendingIrp.ListLock, &oldIrql);	// when IRP queue is empty, there is nothing to do	if (IsListEmpty(&DeviceExtension->PendingIrp.ListHead)) {		KeReleaseSpinLock(&DeviceExtension->PendingIrp.ListLock, oldIrql);		DDbgPrint("  IrpQueue is Empty/n");		return STATUS_SUCCESS;	}	KeQueryTickCount(&tickCount);	// search timeout IRP through pending IRP list	listHead = &DeviceExtension->PendingIrp.ListHead;    for (thisEntry = listHead->Flink;		thisEntry != listHead;		thisEntry = nextEntry) {        nextEntry = thisEntry->Flink;        irpEntry = CONTAINING_RECORD(thisEntry, IRP_ENTRY, ListEntry);		// this IRP is NOT timeout yet		if ( (tickCount.QuadPart - irpEntry->TickCount.QuadPart) * KeQueryTimeIncrement()			< DOKAN_IPR_PENDING_TIMEOUT * 10000 * 1000) {			break;		}		RemoveEntryList(thisEntry);		DDbgPrint(" timeout Irp #%X/n", irpEntry->SerialNumber);		irp = irpEntry->Irp;		if (irp == NULL) {			// this IRP has already been canceled			ASSERT(irpEntry->CancelRoutineFreeMemory == FALSE);			ExFreePool(irpEntry);			continue;		}		// this IRP is not canceled yet		if (IoSetCancelRoutine(irp, NULL) == NULL) {			// Cancel routine will run as soon as we release the lock			InitializeListHead(&irpEntry->ListEntry);			irpEntry->CancelRoutineFreeMemory = TRUE;			continue;		}		// IrpEntry is saved here for CancelRoutine		// Clear it to prevent to be completed by CancelRoutine twice		irp->Tail.Overlay.DriverContext[DRIVER_CONTEXT_IRP_ENTRY] = NULL;		InsertTailList(&completeList, &irpEntry->ListEntry);	}	if (IsListEmpty(&DeviceExtension->PendingIrp.ListHead)) {		KeClearEvent(&DeviceExtension->PendingIrp.NotEmpty);	}	KeReleaseSpinLock(&DeviceExtension->PendingIrp.ListLock, oldIrql);		while (!IsListEmpty(&completeList)) {		listHead = RemoveHeadList(&completeList);		irpEntry = CONTAINING_RECORD(listHead, IRP_ENTRY, ListEntry);		irp = irpEntry->Irp;		irp->IoStatus.Information = 0;		irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;		ExFreePool(irpEntry);		IoCompleteRequest(irp, IO_NO_INCREMENT);	}	DDbgPrint("<== ReleaseTimeoutPendingIRP/n");	return STATUS_SUCCESS;}

//.........这里部分代码省略.........    if (OpenEntry->WriteOnly)    {        Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);                return STATUS_INVALID_PARAMETER;    }    /* Make the read cancellable */    IoAcquireCancelSpinLock(&OldCancelIrql);    IoSetCancelRoutine(Irp, ReadIrpCancel);    if (Irp->Cancel)    {        IoReleaseCancelSpinLock(OldCancelIrql);        /* Indicate a 0 byte read */        Irp->IoStatus.Status = STATUS_SUCCESS;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);                return STATUS_SUCCESS;    }    IoReleaseCancelSpinLock(OldCancelIrql);    while (TRUE)    {        KeAcquireSpinLock(&AdapterContext->Spinlock, &OldIrql);        /* Check if we have a packet */        if (IsListEmpty(&AdapterContext->PacketList))        {            KeReleaseSpinLock(&AdapterContext->Spinlock, OldIrql);            /* Wait for a packet (in the context of the calling user thread) */            Status = KeWaitForSingleObject(&AdapterContext->PacketReadEvent,                                           UserRequest,                                           UserMode,                                           TRUE,                                           NULL);            if (Status != STATUS_SUCCESS)            {                /* Remove the cancel routine */                IoAcquireCancelSpinLock(&OldCancelIrql);                IoSetCancelRoutine(Irp, NULL);                IoReleaseCancelSpinLock(OldCancelIrql);                break;            }        }        else        {            /* Remove the cancel routine */            IoAcquireCancelSpinLock(&OldCancelIrql);            IoSetCancelRoutine(Irp, NULL);            IoReleaseCancelSpinLock(OldCancelIrql);                        /* Remove the first packet in the list */            ListEntry = RemoveHeadList(&AdapterContext->PacketList);            PacketEntry = CONTAINING_RECORD(ListEntry, NDISUIO_PACKET_ENTRY, ListEntry);            /* Release the adapter lock */            KeReleaseSpinLock(&AdapterContext->Spinlock, OldIrql);                        /* And we're done with this loop */            Status = STATUS_SUCCESS;            break;        }    }        /* Check if we got a packet */    if (PacketEntry != NULL)    {        /* Find the right amount of bytes to copy */        BytesCopied = PacketEntry->PacketLength;        if (BytesCopied > IrpSp->Parameters.Read.Length)            BytesCopied = IrpSp->Parameters.Read.Length;        /* Copy the packet */        RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer,                      &PacketEntry->PacketData[0],                      BytesCopied);                /* Free the packet entry */        ExFreePool(PacketEntry);    }    else    {        /* Something failed */        BytesCopied = 0;    }    /* Complete the IRP */    Irp->IoStatus.Status = Status;    Irp->IoStatus.Information = BytesCopied;    IoCompleteRequest(Irp, IO_NETWORK_INCREMENT);        return Status;}

//.........这里部分代码省略.........	//ReLoadNtosCALL((PVOID)(&RExAllocatePool),L"ExAllocatePool",SystemKernelModuleBase,(ULONG)ImageModuleBase);	//ReLoadNtosCALL((PVOID)(&RExFreePool),L"ExFreePool",SystemKernelModuleBase,(ULONG)ImageModuleBase);	//ReLoadNtosCALL((PVOID)(&RZwClose),L"ZwClose",SystemKernelModuleBase,(ULONG)ImageModuleBase);	//if (ZwQueryVirtualMemory &&	//	RObOpenObjectByPointer &&	//	RExAllocatePool &&	//	RExFreePool &&	//	RZwClose)	//{	//	bInit = TRUE;	//}	//if (!bInit)	//	return ;	////进程已经退出鸟	//if (!IsExitProcess((PEPROCESS)EProcess)){	//	return ;	//}	status = ObOpenObjectByPointer(		(PVOID)pEProcess,          // Object    		OBJ_KERNEL_HANDLE,  // HandleAttributes    		NULL,               // PassedAccessState OPTIONAL    		(ACCESS_MASK)0,       // DesiredAccess    		*PsProcessType,     // ObjectType    		KernelMode,         // AccessMode    		&hProcess);    	if (!NT_SUCCESS(status))	{		//if (DebugOn)		//KdPrint(("ObOpenObjectByPointer failed:%d",RtlNtStatusToDosError(status)));		return ;	}	pSectionNam = (PUNICODE_STRING)ExAllocatePool(NonPagedPool, MAX_PATH * sizeof(WCHAR));	if (!pSectionNam)	{		ZwClose(hProcess);		return;	}	RtlZeroMemory(pSectionNam->Buffer, MAX_PATH * sizeof(WCHAR));	pSectionNam->MaximumLength = MAX_PATH;	__try	{		for (dwStartAddr = 0; dwStartAddr < 0x7fffffff; dwStartAddr = dwStartAddr + 0x10000)		{			status = ZwQueryVirtualMemory(				hProcess,				(PVOID)dwStartAddr,				MemoryBasicInformation,				&mbi,				sizeof(MEMORY_BASIC_INFORMATION),				0				);			if (NT_SUCCESS(status) && mbi.Type == MEM_IMAGE)			{				status = ZwQueryVirtualMemory(					hProcess,					(PVOID)dwStartAddr,					MemorySectionName,					pSectionNam,					MAX_PATH*sizeof(WCHAR),					0					);				if (NT_SUCCESS(status) && !MmIsAddressValid(pSectionNam->Buffer))				{					//如果当前的DLL模块路径 不等于前一个，则说明是开始了下一个DLL的枚举了，首先判断第一个字节是否是'/'					if (((PCHAR)pSectionNam->Buffer)[0] == 0x5c)					{ 						if (count == -1 ||/							RtlCompareMemory(pAllModuleInf->vModuleInf[count].ImagePathName, pSectionNam->Buffer, pSectionNam->Length)/							!= pSectionNam->Length)						{							RtlCopyMemory(pAllModuleInf->vModuleInf[++count].ImagePathName, pSectionNam->Buffer, pSectionNam->Length);							for (ulDllSize = dwStartAddr+mbi.RegionSize; ulDllSize < 0x7fffffff; ulDllSize += mbi.RegionSize)							{								status = ZwQueryVirtualMemory(									hProcess,									(PVOID)ulDllSize,									MemoryBasicInformation,									&mbi,									sizeof(MEMORY_BASIC_INFORMATION),									0									);								if (NT_SUCCESS(status) && mbi.Type != MEM_IMAGE)								{									pAllModuleInf->vModuleInf[count].size = ulDllSize - dwStartAddr;								}							}						}					}				}			}		}	}__except(EXCEPTION_EXECUTE_HANDLER){}_FunctionRet:	pAllModuleInf->uCount = count;	ExFreePool(pSectionNam);	ZwClose(hProcess);}

//.........这里部分代码省略.........        goto exit;    }    nodeName = NULL; //transferred owenership to tree        nodeDesc = SdpNodeInterface->SdpCreateNodeString(        ansiStrName.Buffer,         ansiStrName.Length,         POOLTAG_BTHECHOSAMPLE        );    if(NULL == nodeDesc)    {        status = STATUS_INSUFFICIENT_RESOURCES;        TraceEvents(TRACE_LEVEL_ERROR, DBG_SDP,             "Creating node for service desc failed, Status code %!STATUS!/n", status);        goto exit;    }        status = SdpNodeInterface->SdpAddAttributeToTree(        tree,         LANG_DEFAULT_ID+STRING_DESCRIPTION_OFFSET,         nodeDesc,         POOLTAG_BTHECHOSAMPLE        );    if(!NT_SUCCESS(status))    {        TraceEvents(TRACE_LEVEL_ERROR, DBG_SDP,             "SdpAddAttributeToTree for service desc failed, Status code %!STATUS!/n", status);                goto exit;    }    nodeDesc = NULL;    //    // Create stream from tree    //    status = SdpParseInterface->SdpConvertTreeToStream(tree, &stream, &size, POOLTAG_BTHECHOSAMPLE);    if(!NT_SUCCESS(status))    {        TraceEvents(TRACE_LEVEL_ERROR, DBG_SDP,             "Failed to get stream from tree for SDP record, Status code %!STATUS!/n", status);                goto exit;    }    status = SdpParseInterface->SdpValidateStream(        stream,        size,        &errorByte        );    if(!NT_SUCCESS(status))    {        TraceEvents(TRACE_LEVEL_ERROR, DBG_SDP,             "Validate stream failed for SDP record, first failure at address %p/n", (PVOID)errorByte);                goto exit;    }    *Stream = stream;    *Size = size;    exit:    if (NULL != tree)    {        SdpNodeInterface->SdpFreeTree(tree);    }    if (NULL != nodeName)    {        //        // If we failed to add attribute to tree use ExFreePool to free it        //        ExFreePool(nodeName);    }        if (NULL != nodeDesc)    {        //        // If we failed to add attribute to tree use ExFreePool to free it        //        ExFreePool(nodeDesc);    }        RtlFreeAnsiString(&ansiStrName);    if (!NT_SUCCESS(status))    {        if (stream != NULL)        {            ExFreePoolWithTag(stream, POOLTAG_BTHECHOSAMPLE);        }    }        return status;}

void STDCALL free_cache() {    ExFreePool(cache_callbacks);}

NTSTATUSTapeSetMediaParameters(    IN PDEVICE_OBJECT DeviceObject,    IN PIRP Irp    )/*++Routine Description:    This routine sets the fixed-length logical block size or variable-length    block mode (if the block size is 0).Arguments:    DeviceObject    IrpReturn Value:    NTSTATUS--*/{    PDEVICE_EXTENSION   deviceExtension = DeviceObject->DeviceExtension;    PTAPE_SET_MEDIA_PARAMETERS tapeSetMediaParams = Irp->AssociatedIrp.SystemBuffer;    PMODE_PARM_READ_WRITE_DATA buffer;    SCSI_REQUEST_BLOCK  srb;    PCDB                cdb = (PCDB)srb.Cdb;    NTSTATUS            status;    DebugPrint((3,"TapeIoControl: Set Tape Media Parameters /n"));    //    // Zero CDB in SRB on stack.    //    RtlZeroMemory(cdb, MAXIMUM_CDB_SIZE);    srb.CdbLength = CDB6GENERIC_LENGTH;    cdb->MODE_SELECT.OperationCode = SCSIOP_MODE_SELECT;    //    // Set timeout value.    //    srb.TimeOutValue = deviceExtension->TimeOutValue;    cdb->MODE_SELECT.ParameterListLength = sizeof(MODE_PARM_READ_WRITE_DATA);    cdb->MODE_SELECT.Reserved1 = MODE_SELECT_PFBIT;    buffer = ExAllocatePool(NonPagedPoolCacheAligned,        sizeof(MODE_PARM_READ_WRITE_DATA));    if (!buffer) {        return STATUS_INSUFFICIENT_RESOURCES;    }    RtlZeroMemory(buffer, sizeof(MODE_PARM_READ_WRITE_DATA));    buffer->ParameterListHeader.DeviceSpecificParameter = 0x10;    buffer->ParameterListHeader.BlockDescriptorLength = MODE_BLOCK_DESC_LENGTH;    buffer->ParameterListBlock.BlockLength[0] =        (UCHAR)((tapeSetMediaParams->BlockSize >> 16) & 0xFF);    buffer->ParameterListBlock.BlockLength[1] =        (UCHAR)((tapeSetMediaParams->BlockSize >> 8) & 0xFF);    buffer->ParameterListBlock.BlockLength[2] =        (UCHAR)(tapeSetMediaParams->BlockSize & 0xFF);    status = ScsiClassSendSrbSynchronous(DeviceObject,                                &srb,                                buffer,                                sizeof( MODE_PARM_READ_WRITE_DATA ),                                TRUE);    ExFreePool(buffer);    return status;} // end TapeSetMediaParameters()

NTSTATUSTapeGetMediaParameters(    IN PDEVICE_OBJECT DeviceObject,    IN PIRP Irp    )/*++Routine Description:    The OVERLAND 9-track tape device can return whether media is    write-protected.Arguments:    DeviceObject    IrpReturn Value:    NTSTATUS--*/{    PDEVICE_EXTENSION   deviceExtension = DeviceObject->DeviceExtension;    PTAPE_GET_MEDIA_PARAMETERS tapeGetMediaParams = Irp->AssociatedIrp.SystemBuffer;    PNINE_TRACKSENSE_DATA  buffer;    SCSI_REQUEST_BLOCK  srb;    PCDB                cdb = (PCDB)srb.Cdb;    NTSTATUS            status;    DebugPrint((3,"TapeGetMediaParameters: Get Tape Media Parameters/n"));    //    // Zero SRB on stack.    //    RtlZeroMemory(&srb, sizeof(SCSI_REQUEST_BLOCK));    srb.CdbLength = CDB6GENERIC_LENGTH;    cdb->MODE_SENSE.OperationCode = SCSIOP_MODE_SENSE;    //    // Set timeout value.    //    srb.TimeOutValue = deviceExtension->TimeOutValue;    cdb->MODE_SENSE.AllocationLength = sizeof(NINE_TRACKSENSE_DATA);    cdb->MODE_SENSE.PageCode = MODE_SENSE_CURRENT_VALUES;    cdb->MODE_SENSE.Pc = 0x0B;    buffer = ExAllocatePool(NonPagedPoolCacheAligned,        sizeof(NINE_TRACKSENSE_DATA));    if (!buffer) {        return STATUS_INSUFFICIENT_RESOURCES;    }    status = ScsiClassSendSrbSynchronous(DeviceObject,                                &srb,                                buffer,                                sizeof(NINE_TRACKSENSE_DATA),                                FALSE);    if (status == STATUS_DATA_OVERRUN) {        status = STATUS_SUCCESS;    }    if (NT_SUCCESS(status)) {        Irp->IoStatus.Information = sizeof(TAPE_GET_MEDIA_PARAMETERS);        tapeGetMediaParams->BlockSize = buffer->BlockLength[2];        tapeGetMediaParams->BlockSize += buffer->BlockLength[1] << 8;        tapeGetMediaParams->BlockSize += buffer->BlockLength[0] << 16;        tapeGetMediaParams->WriteProtected = buffer->WriteProtected;        tapeGetMediaParams->PartitionCount = 0;    }    ExFreePool(buffer);    return status;    return status;} // end TapeGetMediaParameters()

NTSTATUSFatPostStackOverflowRead (    IN PIRP_CONTEXT IrpContext,    IN PIRP Irp,    IN PFCB Fcb)/*++Routine Description:    This routine posts a read request that could not be processed by    the fsp thread because of stack overflow potential.Arguments:    Irp - Supplies the request to process.    Fcb - Supplies the file.Return Value:    STATUS_PENDING.--*/{    PKEVENT Event;    PERESOURCE Resource;    DebugTrace(0, Dbg, "Getting too close to stack limit pass request to Fsp/n", 0 );    //    //  Allocate an event and get shared on the resource we will    //  be later using the common read.    //    Event = FsRtlAllocatePool( NonPagedPool, sizeof(KEVENT) );    KeInitializeEvent( Event, NotificationEvent, FALSE );    if (FlagOn(Irp->Flags, IRP_PAGING_IO) && (Fcb->Header.PagingIoResource != NULL)) {        Resource = Fcb->Header.PagingIoResource;    } else {        Resource = Fcb->Header.Resource;    }    ExAcquireResourceShared( Resource, TRUE );    try {        //        //  Make the Irp just like a regular post request and        //  then send the Irp to the special overflow thread.        //  After the post we will wait for the stack overflow        //  read routine to set the event that indicates we can        //  now release the scb resource and return.        //        FatPrePostIrp( IrpContext, Irp );        //        //  If this read is the result of a verify, we have to        //  tell the overflow read routne to temporarily        //  hijack the Vcb->VerifyThread field so that reads        //  can go through.        //        if (Fcb->Vcb->VerifyThread == KeGetCurrentThread()) {            SetFlag(IrpContext->Flags, IRP_CONTEXT_FLAG_VERIFY_READ);        }        FsRtlPostStackOverflow( IrpContext, Event, FatStackOverflowRead );        //        //  And wait for the worker thread to complete the item        //        (VOID) KeWaitForSingleObject( Event, Executive, KernelMode, FALSE, NULL );    }    finally {        ExReleaseResource( Resource );        ExFreePool( Event );    }    return STATUS_PENDING;}

//.........这里部分代码省略.........    /* Check if this is a connection port */    if ((Port->Flags & LPCP_PORT_TYPE_MASK) == LPCP_CONNECTION_PORT)    {        /* Delete the name */        Port->Flags |= LPCP_NAME_DELETED;    }    /* Walk all the threads waiting and signal them */    ListHead = &Port->LpcReplyChainHead;    NextEntry = ListHead->Flink;    while ((NextEntry) && (NextEntry != ListHead))    {        /* Get the Thread */        Thread = CONTAINING_RECORD(NextEntry, ETHREAD, LpcReplyChain);        /* Make sure we're not in exit */        if (Thread->LpcExitThreadCalled) break;        /* Move to the next entry */        NextEntry = NextEntry->Flink;        /* Remove and reinitialize the List */        RemoveEntryList(&Thread->LpcReplyChain);        InitializeListHead(&Thread->LpcReplyChain);        /* Check if someone is waiting */        if (!KeReadStateSemaphore(&Thread->LpcReplySemaphore))        {            /* Get the message */            Message = LpcpGetMessageFromThread(Thread);            if (Message)            {                /* Check if it's a connection request */                if (Message->Request.u2.s2.Type == LPC_CONNECTION_REQUEST)                {                    /* Get the connection message */                    ConnectMessage = (PLPCP_CONNECTION_MESSAGE)(Message + 1);                    /* Check if it had a section */                    if (ConnectMessage->SectionToMap)                    {                        /* Dereference it */                        ObDereferenceObject(ConnectMessage->SectionToMap);                    }                }                /* Clear the reply message */                Thread->LpcReplyMessage = NULL;                /* And remove the message from the port zone */                LpcpFreeToPortZone(Message, 1);                NextEntry = Port->LpcReplyChainHead.Flink;            }            /* Release the semaphore and reset message id count */            Thread->LpcReplyMessageId = 0;            KeReleaseSemaphore(&Thread->LpcReplySemaphore, 0, 1, FALSE);        }    }    /* Reinitialize the list head */    InitializeListHead(&Port->LpcReplyChainHead);    /* Loop queued messages */    while ((Port->MsgQueue.ReceiveHead.Flink) &&           !(IsListEmpty(&Port->MsgQueue.ReceiveHead)))    {        /* Get the message */        Message = CONTAINING_RECORD(Port->MsgQueue.ReceiveHead.Flink,                                    LPCP_MESSAGE,                                    Entry);        /* Free and reinitialize it's list head */        RemoveEntryList(&Message->Entry);        InitializeListHead(&Message->Entry);        /* Remove it from the port zone */        LpcpFreeToPortZone(Message, 1);    }    /* Release the lock */    KeReleaseGuardedMutex(&LpcpLock);    /* Dereference the connection port */    if (ConnectionPort) ObDereferenceObject(ConnectionPort);    /* Check if we have to free the port entirely */    if (Destroy)    {        /* Check if the semaphore exists */        if (Port->MsgQueue.Semaphore)        {            /* Use the semaphore to find the port queue and free it */            ExFreePool(CONTAINING_RECORD(Port->MsgQueue.Semaphore,                                         LPCP_NONPAGED_PORT_QUEUE,                                         Semaphore));        }    }}

NTSTATUS	IrpCreateFile(	IN PUNICODE_STRING FileName,	IN ACCESS_MASK DesiredAccess,	__out PIO_STATUS_BLOCK IoStatusBlock,	IN ULONG FileAttributes,	IN ULONG ShareAccess,	IN ULONG CreateDisposition,	IN ULONG CreateOptions,	IN PDEVICE_OBJECT DeviceObject,	IN PDEVICE_OBJECT RealDevice,	OUT PFILE_OBJECT *Object	){	NTSTATUS status;	KEVENT event;	PIRP irp;	PIO_STACK_LOCATION irpSp;	IO_SECURITY_CONTEXT securityContext;	ACCESS_STATE accessState;	OBJECT_ATTRIBUTES objectAttributes;	PFILE_OBJECT fileObject;	AUX_ACCESS_DATA auxData;	PAGED_CODE();	RtlZeroMemory(&auxData, sizeof(AUX_ACCESS_DATA));		InitializeObjectAttributes(&objectAttributes, NULL, OBJ_CASE_INSENSITIVE| OBJ_KERNEL_HANDLE, 0, NULL);	status = ObCreateObject(KernelMode,		*IoFileObjectType,		&objectAttributes,		KernelMode,		NULL,		sizeof(FILE_OBJECT),		0,		0,		(PVOID *)&fileObject);	if (!NT_SUCCESS(status)) {		return status;	}	RtlZeroMemory(fileObject, sizeof(FILE_OBJECT));	fileObject->Type = IO_TYPE_FILE;	fileObject->Size = sizeof(FILE_OBJECT);	fileObject->DeviceObject = RealDevice;	//	fileObject->RelatedFileObject = NULL;	fileObject->Flags = FO_SYNCHRONOUS_IO;	fileObject->FileName.MaximumLength = FileName->MaximumLength;	fileObject->FileName.Buffer = (PWCH)ExAllocatePoolWithTag(NonPagedPool, FileName->MaximumLength, 'File');	//fileObject->FileObjectExtension	if (fileObject->FileName.Buffer == NULL) {		ObDereferenceObject(fileObject);		return STATUS_INSUFFICIENT_RESOURCES;	}	RtlCopyUnicodeString(&fileObject->FileName, FileName);	KeInitializeEvent(&fileObject->Lock, SynchronizationEvent, FALSE);	KeInitializeEvent(&fileObject->Event, NotificationEvent, FALSE);	irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);		if (irp == NULL) {		ObDereferenceObject(fileObject);		return STATUS_INSUFFICIENT_RESOURCES;	}	KeInitializeEvent(&event, SynchronizationEvent, FALSE);	irp->MdlAddress = NULL;	irp->Flags |= IRP_CREATE_OPERATION | IRP_SYNCHRONOUS_API;	irp->RequestorMode = KernelMode;	irp->UserIosb = IoStatusBlock;	////LCXL:CHANGE	irp->UserEvent = &event;	//irp->UserEvent = NULL;	irp->PendingReturned = FALSE;	irp->Cancel = FALSE;	irp->CancelRoutine = NULL;	irp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();	irp->Tail.Overlay.AuxiliaryBuffer = NULL;	irp->Tail.Overlay.OriginalFileObject = fileObject;	status = SeCreateAccessState(&accessState,		&auxData,		DesiredAccess,		IoGetFileObjectGenericMapping());	if (!NT_SUCCESS(status)) {		IoFreeIrp(irp);		ExFreePool(fileObject->FileName.Buffer);		ObDereferenceObject(fileObject);		return status;	}	securityContext.SecurityQos = NULL;	securityContext.AccessState = &accessState;	securityContext.DesiredAccess = DesiredAccess;	securityContext.FullCreateOptions = 0;//.........这里部分代码省略.........

//.........这里部分代码省略.........                                 sizeof(USB_STRING_DESCRIPTOR) + StringDescriptorBytes,                                 NULL);                status = SendAwaitUrb(fdo, &urb);        if(NT_SUCCESS(status))        {                        desc->bString[ (desc->bLength / 2) - 1 ] = L'/0';            RtlInitUnicodeString( &dummy       , desc->bString );            RtlCopyUnicodeString( &pdx->product, &dummy        );                    }        else        {            RtlInitUnicodeString( &dummy       , EmptyString );            RtlCopyUnicodeString( &pdx->product, &dummy      );                   KdPrint(( DRIVERNAME " - could not retrieve product %08x/n", status ));                  }    }    if(0 != pdx->dd.iSerialNumber)    {        // Serial Number        UsbBuildGetDescriptorRequest(&urb,                                  sizeof(_URB_CONTROL_DESCRIPTOR_REQUEST),                                  USB_STRING_DESCRIPTOR_TYPE,                                 pdx->dd.iSerialNumber,                                 LangId,                                  desc,                                  NULL,                                  sizeof(USB_STRING_DESCRIPTOR) + StringDescriptorBytes,                                 NULL);                status = SendAwaitUrb(fdo, &urb);        if(NT_SUCCESS(status))        {                        desc->bString[ (desc->bLength / 2) - 1 ] = L'/0';                        RtlInitUnicodeString( &dummy            , desc->bString );            RtlCopyUnicodeString( &pdx->serialNumber, &dummy        );                    }        else        {                      RtlInitUnicodeString( &dummy            , EmptyString );            RtlCopyUnicodeString( &pdx->serialNumber, &dummy      );            KdPrint(( DRIVERNAME " - could not retrieve serial number %08x/n", status ));                    }    }        // DisplayName    UsbBuildGetDescriptorRequest(&urb,                              sizeof(_URB_CONTROL_DESCRIPTOR_REQUEST),                              USB_STRING_DESCRIPTOR_TYPE,                             DisplayNameId,                             LangId,                              desc,                              NULL,                              sizeof(USB_STRING_DESCRIPTOR) + StringDescriptorBytes,                             NULL);        status = SendAwaitUrb(fdo, &urb);    if(NT_SUCCESS(status))    {                    desc->bString[ (desc->bLength / 2) - 1 ] = L'/0';                RtlInitUnicodeString( &dummy           , desc->bString );        RtlCopyUnicodeString( &pdx->displayName, &dummy        );            }    else    {        RtlInitUnicodeString( &dummy            , EmptyString );        RtlCopyUnicodeString( &pdx->displayName, &dummy      );        KdPrint(( DRIVERNAME " - could not retrieve display name %08x/n", status ));        }cleanup:        if(desc) ExFreePool( desc );        if(!NT_SUCCESS(status))    {        if(pdx->manufacturer.Buffer) ExFreePool( pdx->manufacturer.Buffer );        if(pdx->product     .Buffer) ExFreePool( pdx->product     .Buffer );        if(pdx->serialNumber.Buffer) ExFreePool( pdx->serialNumber.Buffer );        if(pdx->displayName .Buffer) ExFreePool( pdx->displayName .Buffer );        pdx->manufacturer.Buffer = NULL;        pdx->product     .Buffer = NULL;        pdx->serialNumber.Buffer = NULL;        pdx->displayName .Buffer = NULL;           }        return status;}

NTSTATUS transfer(libusb_device_t *dev, IRP *irp,                  int direction, int urb_function, int endpoint,                   int packet_size, MDL *buffer, int size){  IO_STACK_LOCATION *stack_location = NULL;  context_t *context;  NTSTATUS status = STATUS_SUCCESS;   DEBUG_PRINT_NL();  if(urb_function == URB_FUNCTION_ISOCH_TRANSFER)    DEBUG_MESSAGE("transfer(): isochronous transfer");  else    DEBUG_MESSAGE("transfer(): bulk or interrupt transfer");  if(direction == USBD_TRANSFER_DIRECTION_IN)    DEBUG_MESSAGE("transfer(): direction in");  else    DEBUG_MESSAGE("transfer(): direction out");  DEBUG_MESSAGE("transfer(): endpoint 0x%02x", endpoint);  if(urb_function == URB_FUNCTION_ISOCH_TRANSFER)    DEBUG_MESSAGE("transfer(): packet_size 0x%x", packet_size);  DEBUG_MESSAGE("transfer(): size %d", size);  DEBUG_MESSAGE("transfer(): sequence %d", sequence);  DEBUG_PRINT_NL();  if(!dev->config.value)    {      DEBUG_ERROR("transfer(): invalid configuration 0");      remove_lock_release(dev);      return complete_irp(irp, STATUS_INVALID_DEVICE_STATE, 0);    }    context = ExAllocatePool(NonPagedPool, sizeof(context_t));  if(!context)    {      remove_lock_release(dev);      return complete_irp(irp, STATUS_NO_MEMORY, 0);    }  status = create_urb(dev, &context->urb, direction, urb_function,                       endpoint, packet_size, buffer, size);      if(!NT_SUCCESS(status))    {      ExFreePool(context);      remove_lock_release(dev);      return complete_irp(irp, status, 0);    }  context->sequence = sequence++;  stack_location = IoGetNextIrpStackLocation(irp);      stack_location->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;  stack_location->Parameters.Others.Argument1 = context->urb;  stack_location->Parameters.DeviceIoControl.IoControlCode     = IOCTL_INTERNAL_USB_SUBMIT_URB;      IoSetCompletionRoutine(irp, transfer_complete, context,                         TRUE, TRUE, TRUE);      return IoCallDriver(dev->target_device, irp);}

//.........这里部分代码省略.........    ++ped;    if(!ped || 0 != (ped->bEndpointAddress & 0x80) || ped->bmAttributes != USB_ENDPOINT_TYPE_BULK || ped->wMaxPacketSize > 64)    {        KdPrint((DRIVERNAME " - Endpoint has wrong attributes/n"));        status = STATUS_DEVICE_CONFIGURATION_ERROR;        goto cleanup;    }    ++ped;    PUSBD_INTERFACE_INFORMATION pii = interfaces[0].Interface;    ASSERT(pii->NumberOfPipes == pid->bNumEndpoints);    // Initialize the maximum transfer size for each of the endpoints. The    // default would be PAGE_SIZE. The firmware itself only has a 4096-byte    // ring buffer, though. We need to restrict the test applet to that many    // bytes. In order to exercise the multi-segment aspect of the transfer code,    // therefore, reduce the maximum transfer size to 1024 bytes.    pii->Pipes[0].MaximumTransferSize = USBD_DEFAULT_MAXIMUM_TRANSFER_SIZE;    pii->Pipes[1].MaximumTransferSize = USBD_DEFAULT_MAXIMUM_TRANSFER_SIZE;    pdx->maxtransfer = USBD_DEFAULT_MAXIMUM_TRANSFER_SIZE;    // Submit the set-configuration request    status = SendAwaitUrb(fdo, selurb);    if(!NT_SUCCESS(status))    {        KdPrint((DRIVERNAME " - Error %X trying to select configuration/n", status));        goto cleanup;    }    // Save the configuration and pipe handles    pdx->hconfig = selurb->UrbSelectConfiguration.ConfigurationHandle;    pdx->hinpipe = pii->Pipes[0].PipeHandle;    pdx->houtpipe = pii->Pipes[1].PipeHandle;    // Transfer ownership of the configuration descriptor to the device extension    pdx->pcd = pcd;    pcd = NULL;    // Enable the interface    IoSetDeviceInterfaceState(&pdx->operationsInterfaceName, TRUE);            // Enable the interface    IoSetDeviceInterfaceState(&pdx->inquiriesInterfaceName, TRUE);                        // create recovery thread                         status = PsCreateSystemThread(&RecoveryHandle, 0, NULL, NULL, NULL, RecoveryThread, (PVOID)pdx);    if(!NT_SUCCESS(status))    {        KdPrint((DRIVERNAME " - PsCreateSystemThread failed with error %08x/n", status));        goto cleanup;    }        status = ObReferenceObjectByHandle( RecoveryHandle,                                        SYNCHRONIZE,                                        NULL,                                        KernelMode,                                        (PVOID*)&pdx->RecoveryThread,                                        NULL );    ASSERT(NT_SUCCESS(status));    ZwClose(RecoveryHandle);        // Start polling    status = StartPolling(pdx);        if(!NT_SUCCESS(status))    {           KdPrint((DRIVERNAME " - StartPolling failed 0x%08x/n", status));        if(pdx->RecoveryThread)        {            // shutdown recovery thread            pdx->RecoveryExit = TRUE;             KeSetEvent(&pdx->RecoveryEvent, 0, FALSE);                // wait for polling thread to exit             KeWaitForSingleObject(pdx->RecoveryThread, Executive, KernelMode, FALSE, NULL);                 ObDereferenceObject(pdx->RecoveryThread);            pdx->RecoveryThread = NULL;        }                goto cleanup;    }    cleanup:    if(selurb) ExFreePool(selurb);    if(pcd   ) ExFreePool(pcd   );    // get rid of return codes like STATUS_PENDING    if(NT_SUCCESS(status))     {        return STATUS_SUCCESS;    }        return status;}

//.........这里部分代码省略.........        //        //  We now have the log record desired.  If the Lsn in the        //  log record doesn't match the desired Lsn then the disk is        //  corrupt.        //        if ( Lsn.QuadPart != Lcb->RecordHeader->ThisLsn.QuadPart ) {                                                   //**** xxNeq( Lsn, Lcb->RecordHeader->ThisLsn )            ExRaiseStatus( STATUS_DISK_CORRUPT_ERROR );        }        //        //  Check that the length field isn't greater than the total available space        //  in the log file.        //        LogRecordLength = Lcb->RecordHeader->ClientDataLength + Lfcb->RecordHeaderLength;                              //**** xxFromUlong( Lcb->RecordHeader->ClientDataLength + Lfcb->RecordHeaderLength );        if ( LogRecordLength >= Lfcb->TotalAvailable ) {                                                               //**** xxGeq( LogRecordLength, Lfcb->TotalAvailable )            ExRaiseStatus( STATUS_DISK_CORRUPT_ERROR );        }        //        //  If the entire log record is on this log page, put a pointer to        //  the log record in the context block.        //        if (!FlagOn( Lcb->RecordHeader->Flags, LOG_RECORD_MULTI_PAGE )) {            //            //  If client size indicates that we have to go beyond the end of the current            //  page, we raise an error.            //            PageOffset = LfsLsnToPageOffset( Lfcb, Lsn );            if ((PageOffset + Lcb->RecordHeader->ClientDataLength + Lfcb->RecordHeaderLength)                > (ULONG)Lfcb->LogPageSize) {                ExRaiseStatus( STATUS_DISK_CORRUPT_ERROR );            }            Lcb->CurrentLogRecord = LfsAdd2Ptr( Lcb->RecordHeader, LFS_RECORD_HEADER_SIZE, PVOID );            Lcb->AuxilaryBuffer = FALSE;        //        //  Else we copy the data and remember that we allocated a buffer.        //        } else {            NewBuffer = FsRtlAllocatePool( PagedPool, Lcb->RecordHeader->ClientDataLength );            LfsCopyReadLogRecord( Lfcb,                                  Lcb->RecordHeader,                                  NewBuffer );            Lcb->CurrentLogRecord = NewBuffer;            Lcb->AuxilaryBuffer = TRUE;            NewBuffer = NULL;        }        //        //  We need to update the caller's parameters and the context block.        //        *RecordType = Lcb->RecordHeader->RecordType;        *TransactionId = Lcb->RecordHeader->TransactionId;        *UndoNextLsn = Lcb->RecordHeader->ClientUndoNextLsn;        *PreviousLsn = Lcb->RecordHeader->ClientPreviousLsn;        *Buffer = Lcb->CurrentLogRecord;        *BufferLength = Lcb->RecordHeader->ClientDataLength;    } __finally {        DebugUnwind( LfsFindLogRecord );        //        //  If an error occurred we unpin the record header and the log        //  We also free the buffer if allocated by us.        //        if (NewBuffer != NULL) {            ExFreePool( NewBuffer );        }        LfsDebugTrace(  0, Dbg, "Buffer Length -> %08lx/n", *BufferLength );        LfsDebugTrace(  0, Dbg, "Buffer        -> %08lx/n", *Buffer );        LfsDebugTrace( -1, Dbg, "LfsFindLogRecord:  Exit/n", 0 );    }    return;}

NTSTATUS OnWriteComplete(PDEVICE_OBJECT fdo, PIRP Irp, PRWCONTEXT ctx){       PIO_STACK_LOCATION stack;    NTSTATUS           status;    ULONG              length;    KIRQL              OldIrql;    ULONG              count;        PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) fdo->DeviceExtension;    status = Irp->IoStatus.Status;        if(NT_SUCCESS(status) && ctx->remain && !Irp->Cancel)    {        /* we have more to transfer */        length = ctx->remain;        if(length > pdx->maxtransfer)            length = pdx->maxtransfer;                UsbBuildInterruptOrBulkTransferRequest(&ctx->urb,                                               sizeof(_URB_BULK_OR_INTERRUPT_TRANSFER),                                               pdx->houtpipe,                                               ctx->data,                                               NULL,                                               length,                                               (USBD_TRANSFER_DIRECTION_OUT | USBD_SHORT_TRANSFER_OK),                                               NULL);        ctx->data += length;        ctx->remain -= length;                stack = IoGetNextIrpStackLocation(Irp);        stack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;        stack->Parameters.Others.Argument1 = (PVOID)&ctx->urb;        stack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;        IoSetCompletionRoutine(Irp,                                (PIO_COMPLETION_ROUTINE)OnWriteComplete,                               (PVOID) ctx,                               TRUE,                               TRUE,                               TRUE);        IoCallDriver(pdx->LowerDeviceObject, Irp);        return STATUS_MORE_PROCESSING_REQUIRED;    }        if(NT_SUCCESS(status))     {        Irp->IoStatus.Information = ctx->total;    }     else     {        KdPrint((DRIVERNAME " - finished with error!/n"));    }        ExFreePool(ctx);    StartNextPacket    ( &pdx->dqWrite, fdo    );    IoReleaseRemoveLock( &pdx->RemoveLock, Irp );        return STATUS_SUCCESS;}

/* Source: WDK/src_5239/kmdf/1394/isochapi.c, line 679. */NTSTATUSt1394_IsochFreeResources(    PDEVICE_EXTENSION   deviceExtension, /* added for SLAyer *//*     IN WDFDEVICE   Device, *//*     IN WDFREQUEST  Request, */    /* IN */ HANDLE      hResource    ){    NTSTATUS              ntStatus            = STATUS_SUCCESS;/*     PDEVICE_EXTENSION     deviceExtension     = GetDeviceContext(Device); */    PIRB                  pIrb                = NULL;    PISOCH_RESOURCE_DATA  IsochResourceData   = NULL;    PLIST_ENTRY           listHead;    PLIST_ENTRY           thisEntry;/*     ENTER("t1394_IsochFreeResources"); *//*     TRACE(TL_TRACE, ("hResource = 0x%x/n", hResource)); */    pIrb = ExAllocatePoolWithTag(NonPagedPool, sizeof(IRB), POOLTAG_1394);    if (!pIrb) {/*         TRACE(TL_ERROR, ("Failed to allocate pIrb!/n")); */        ntStatus = STATUS_INSUFFICIENT_RESOURCES;        goto Exit_IsochFreeResources;    } // if    // remove this one from our list...	WdfSpinLockAcquire(deviceExtension->IsochResourceSpinLock);    listHead = &deviceExtension->IsochResourceData;    for(thisEntry = listHead->Flink;                    thisEntry != listHead;                    IsochResourceData = NULL, thisEntry = thisEntry->Flink)    {        IsochResourceData = CONTAINING_RECORD(thisEntry,                                              ISOCH_RESOURCE_DATA,                                              IsochResourceList);        if (IsochResourceData->hResource == hResource) {/*             TRACE(TL_TRACE, ("Removing hResource = 0x%x/n", hResource)); */            RemoveEntryList(&IsochResourceData->IsochResourceList);            ExFreePool(IsochResourceData);            break;        }    }	WdfSpinLockRelease(deviceExtension->IsochResourceSpinLock);    RtlZeroMemory (pIrb, sizeof (IRB));/*     pIrb->FunctionNumber = REQUEST_ISOCH_FREE_RESOURCES; */    pIrb->Flags = 0;/*     pIrb->u.IsochFreeResources.hResource = hResource; *//*     ntStatus = t1394_SubmitIrpSynch(deviceExtension->StackIoTarget, Request, pIrb); */    if (!NT_SUCCESS(ntStatus)) {/*         TRACE(TL_ERROR, ("SubmitIrpSync failed = 0x%x/n", ntStatus)); */    }Exit_IsochFreeResources:    if (pIrb)    {        ExFreePool(pIrb);    }/*     EXIT("t1394_IsochFreeResources", ntStatus); */    return(ntStatus);} // t1394_IsochFreeResources

//.........这里部分代码省略.........		}	}	for (i=0; i < maxConn; i++) {		if(!LspIsConnected(&tempLSS[i])) {			continue;		}		KDPrintM(DBG_LURN_TRACE, ("Con#%u/n", i));		cleaned++;		//	extract login information from the existing LSS.		LspBuildLoginInfo(LSS, &loginInfo);		status = LspLookupProtocol(loginInfo.HWType, loginInfo.HWVersion, &LSProto);		if(!NT_SUCCESS(status)) {			LspDisconnect(&tempLSS[i]);			KDPrintM(DBG_LURN_ERROR, ("Wrong hardware version./n"));			continue;		}		//	Log in with read-only access.		if (loginInfo.HWVersion == LANSCSIIDE_VERSION_2_5) {			loginInfo.UserID = MAKE_USER_ID(DEFAULT_USER_NUM, USER_PERMISSION_RO);		} else {			loginInfo.UserID &= 0x0000ffff;		}		status = LspLogin(						&tempLSS[i],						&loginInfo,						LSProto,						FALSE					);		if(!NT_SUCCESS(status)) {			KDPrintM(DBG_LURN_ERROR, ("LspLogin() failed. STATUS:0x%08x/n", status));			LspDisconnect(&tempLSS[i]);			ASSERT(FALSE);			continue;		}		//		//	Acquire the lock on the NDAS device.		//		pduDesc.Command = VENDOR_OP_SET_MUTEX;		status = LspVendorRequest(						&tempLSS[i],						&pduDesc,						&pduResponse						);		if(pduResponse != LANSCSI_RESPONSE_SUCCESS) {			KDPrintM(DBG_LURN_ERROR,	("Acquiring lock #%u denied by NDAS device/n", LockNo));		}		if(!NT_SUCCESS(status)) {			LspDisconnect(&tempLSS[i]);			KDPrintM(DBG_LURN_ERROR, ("LspVendorRequest() failed. STATUS=%08lx/n", status));			continue;		}		//		//	Release the lock on the NDAS device.		//		pduDesc.Command = VENDOR_OP_FREE_MUTEX;		status = LspVendorRequest(						&tempLSS[i],						&pduDesc,						&pduResponse						);		if(pduResponse != LANSCSI_RESPONSE_SUCCESS) {			KDPrintM(DBG_LURN_ERROR,	("Releasing lock #%u denied by NDAS device/n", LockNo));		}		if(!NT_SUCCESS(status)) {			LspDisconnect(&tempLSS[i]);			KDPrintM(DBG_LURN_ERROR, ("LspVendorRequest() failed. STATUS=%08lx/n", status));			continue;		}		//		//	Log out and disconnect.		//		LspLogout(			&tempLSS[i]			);		LspDisconnect(			&tempLSS[i]			);	}	KDPrintM(DBG_LURN_INFO, ("Cleaned #%u/n", cleaned));	ExFreePool(tempLSS);	return status;}

/* Creates the server side */NTSTATUS DEFAULTAPIMsfsCreateMailslot(PDEVICE_OBJECT DeviceObject,                   PIRP Irp){    PEXTENDED_IO_STACK_LOCATION IoStack;    PFILE_OBJECT FileObject;    PMSFS_DEVICE_EXTENSION DeviceExtension;    PMSFS_FCB Fcb;    PMSFS_CCB Ccb;    KIRQL oldIrql;    PLIST_ENTRY current_entry;    PMSFS_FCB current = NULL;    PMAILSLOT_CREATE_PARAMETERS Buffer;    DPRINT("MsfsCreateMailslot(DeviceObject %p Irp %p)/n", DeviceObject, Irp);    IoStack = (PEXTENDED_IO_STACK_LOCATION)IoGetCurrentIrpStackLocation(Irp);    DeviceExtension = DeviceObject->DeviceExtension;    FileObject = IoStack->FileObject;    Buffer = IoStack->Parameters.CreateMailslot.Parameters;    DPRINT("Mailslot name: %wZ/n", &FileObject->FileName);    Fcb = ExAllocatePool(NonPagedPool, sizeof(MSFS_FCB));    if (Fcb == NULL)    {        Irp->IoStatus.Status = STATUS_NO_MEMORY;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_NO_MEMORY;    }    Fcb->Name.Length = FileObject->FileName.Length;    Fcb->Name.MaximumLength = Fcb->Name.Length + sizeof(UNICODE_NULL);    Fcb->Name.Buffer = ExAllocatePool(NonPagedPool, Fcb->Name.MaximumLength);    if (Fcb->Name.Buffer == NULL)    {        ExFreePool(Fcb);        Irp->IoStatus.Status = STATUS_NO_MEMORY;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_NO_MEMORY;    }    RtlCopyUnicodeString(&Fcb->Name, &FileObject->FileName);    Ccb = ExAllocatePool(NonPagedPool, sizeof(MSFS_CCB));    if (Ccb == NULL)    {        ExFreePool(Fcb->Name.Buffer);        ExFreePool(Fcb);        Irp->IoStatus.Status = STATUS_NO_MEMORY;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_NO_MEMORY;    }    Fcb->ReferenceCount = 0;    InitializeListHead(&Fcb->CcbListHead);    KeInitializeSpinLock(&Fcb->CcbListLock);    Fcb->MaxMessageSize = Buffer->MaximumMessageSize;    Fcb->MessageCount = 0;    Fcb->TimeOut = Buffer->ReadTimeout;    KeInitializeEvent(&Fcb->MessageEvent,                      NotificationEvent,                      FALSE);    InitializeListHead(&Fcb->MessageListHead);    KeInitializeSpinLock(&Fcb->MessageListLock);    KeLockMutex(&DeviceExtension->FcbListLock);    current_entry = DeviceExtension->FcbListHead.Flink;    while (current_entry != &DeviceExtension->FcbListHead)    {        current = CONTAINING_RECORD(current_entry,                                    MSFS_FCB,                                    FcbListEntry);        if (!RtlCompareUnicodeString(&Fcb->Name, &current->Name, TRUE))            break;        current_entry = current_entry->Flink;    }    if (current_entry != &DeviceExtension->FcbListHead)    {        ExFreePool(Fcb->Name.Buffer);        ExFreePool(Fcb);        ExFreePool(Ccb);//.........这里部分代码省略.........

//.........这里部分代码省略.........			break;		}		status = LstransAddrTypeToTransType(DestAddr->Address[0].AddressType, &transport);		if(!NT_SUCCESS(status)) {			KDPrintM(DBG_PROTO_ERROR, ("Address type not supported. STATUS=%08lx/n", status));			break;		}		status = LstransQueryBindingDevices(transport, addrListLen, addrList, NULL);		if(!NT_SUCCESS(status)) {			KDPrintM(DBG_PROTO_ERROR, ("LstransQueryBindingDevices() failed. STATUS=%08lx/n", status));			break;		}		//		//	Validate binding address		//		if(BindAddr) {			status = LstransIsInAddressList(addrList, BindAddr, TRUE);			if(status == STATUS_OBJECT_NAME_NOT_FOUND) {				BindAddr = NULL;			} else if(!NT_SUCCESS(status)) {				break;			}		}		if(BindAddr2) {			status = LstransIsInAddressList(addrList, BindAddr2, TRUE);			if(status == STATUS_OBJECT_NAME_NOT_FOUND) {				BindAddr2 = NULL;			} else if(!NT_SUCCESS(status)) {				break;			}		}		//		//	Try bind addresses in order of BindAddr, BindAddr2, and any addresses available.		//		addrListPrioritized = LstranAllocateAddr(								LSTRANS_MAX_BINDADDR,								NULL);		if(!addrListPrioritized) {			status = STATUS_INSUFFICIENT_RESOURCES;			break;		}		idx_addr = 0;		addrListPrioritized->TAAddressCount = 0;		if(BindAddr) {			RtlCopyMemory(&addrListPrioritized->Address[idx_addr], BindAddr->Address, sizeof(struct  _AddrLstrans));			addrListPrioritized->TAAddressCount ++;			idx_addr ++;		}		if(BindAddr2) {			RtlCopyMemory(&addrListPrioritized->Address[idx_addr], BindAddr2->Address, sizeof(struct  _AddrLstrans));			addrListPrioritized->TAAddressCount ++;			idx_addr ++;		}		if(BindAnyAddress) {			ULONG	idx_bindaddr;			for(idx_bindaddr = 0; idx_bindaddr < (ULONG)addrList->TAAddressCount; idx_bindaddr ++) {				//				//	If an address has a valid length, copy into prioritized address list.				//	Set zero legnth to the same address as BindAddr and BindAddr2 in LstransIsInAddressList().				//				if(addrList->Address[idx_bindaddr].AddressLength) {					RtlCopyMemory(	&addrListPrioritized->Address[idx_addr],									&addrList->Address[idx_bindaddr],									sizeof(TA_LSTRANS_ADDRESS));					addrListPrioritized->TAAddressCount ++;					idx_addr ++;				}			}		}		//		//	Try connecting with prioritized binding address.		//		status = LspConnectBindAddrList(LSS, BoundAddr, DestAddr, addrListPrioritized);	} while(FALSE);	if(addrListPrioritized)		ExFreePool(addrListPrioritized);	if(addrList)		ExFreePool(addrList);	return status;}

NTSTATUS DEFAULTAPIMsfsClose(PDEVICE_OBJECT DeviceObject,          PIRP Irp){    PIO_STACK_LOCATION IoStack;    PFILE_OBJECT FileObject;    PMSFS_DEVICE_EXTENSION DeviceExtension;    PMSFS_FCB Fcb;    PMSFS_CCB Ccb;    PMSFS_MESSAGE Message;    KIRQL oldIrql;    DPRINT("MsfsClose(DeviceObject %p Irp %p)/n", DeviceObject, Irp);    IoStack = IoGetCurrentIrpStackLocation(Irp);    DeviceExtension = DeviceObject->DeviceExtension;    FileObject = IoStack->FileObject;    KeLockMutex(&DeviceExtension->FcbListLock);    if (DeviceExtension->FcbListHead.Flink == &DeviceExtension->FcbListHead)    {        KeUnlockMutex(&DeviceExtension->FcbListLock);        Irp->IoStatus.Status = STATUS_SUCCESS;        Irp->IoStatus.Information = 0;        IoCompleteRequest(Irp, IO_NO_INCREMENT);        return STATUS_SUCCESS;    }    Fcb = FileObject->FsContext;    Ccb = FileObject->FsContext2;    DPRINT("Mailslot name: %wZ/n", &Fcb->Name);    Fcb->ReferenceCount--;    if (Fcb->ServerCcb == Ccb)    {        /* delete all messages from message-list */        KeAcquireSpinLock(&Fcb->MessageListLock, &oldIrql);        while (Fcb->MessageListHead.Flink != &Fcb->MessageListHead)        {            Message = CONTAINING_RECORD(Fcb->MessageListHead.Flink,                                        MSFS_MESSAGE,                                        MessageListEntry);            RemoveEntryList(Fcb->MessageListHead.Flink);            ExFreePool(Message);        }        Fcb->MessageCount = 0;        KeReleaseSpinLock(&Fcb->MessageListLock, oldIrql);        Fcb->ServerCcb = NULL;    }    KeAcquireSpinLock(&Fcb->CcbListLock, &oldIrql);    RemoveEntryList(&Ccb->CcbListEntry);    KeReleaseSpinLock(&Fcb->CcbListLock, oldIrql);    ExFreePool(Ccb);    FileObject->FsContext2 = NULL;    if (Fcb->ReferenceCount == 0)    {        DPRINT("ReferenceCount == 0: Deleting mailslot data/n");        RemoveEntryList(&Fcb->FcbListEntry);        ExFreePool(Fcb->Name.Buffer);        ExFreePool(Fcb);    }    KeUnlockMutex(&DeviceExtension->FcbListLock);    Irp->IoStatus.Status = STATUS_SUCCESS;    Irp->IoStatus.Information = 0;    IoCompleteRequest(Irp, IO_NO_INCREMENT);    return STATUS_SUCCESS;}

//.........这里部分代码省略......... * @param   pvUser1         User argument 1. * @param   pvUser2         User argument 2. * @param   enmCpuid        What to do / is idCpu valid. * @param   idCpu           Used if enmCpuid RT_NT_CPUID_SPECIFIC, otherwise ignored. */static int rtMpCall(PFNRTMPWORKER pfnWorker, void *pvUser1, void *pvUser2, RT_NT_CPUID enmCpuid, RTCPUID idCpu){    PRTMPARGS pArgs;    KDPC     *paExecCpuDpcs;#if 0    /* KeFlushQueuedDpcs must be run at IRQL PASSIVE_LEVEL according to MSDN, but the     * driver verifier doesn't complain...     */    AssertMsg(KeGetCurrentIrql() == PASSIVE_LEVEL, ("%d != %d (PASSIVE_LEVEL)/n", KeGetCurrentIrql(), PASSIVE_LEVEL));#endif#ifdef IPRT_TARGET_NT4    KAFFINITY Mask;    /* g_pfnrtNt* are not present on NT anyway. */    return VERR_NOT_SUPPORTED;#else    KAFFINITY Mask = KeQueryActiveProcessors();#endif    /* KeFlushQueuedDpcs is not present in Windows 2000; import it dynamically so we can just fail this call. */    if (!g_pfnrtNtKeFlushQueuedDpcs)        return VERR_NOT_SUPPORTED;    pArgs = (PRTMPARGS)ExAllocatePoolWithTag(NonPagedPool, MAXIMUM_PROCESSORS*sizeof(KDPC) + sizeof(RTMPARGS), (ULONG)'RTMp');    if (!pArgs)        return VERR_NO_MEMORY;    pArgs->pfnWorker = pfnWorker;    pArgs->pvUser1   = pvUser1;    pArgs->pvUser2   = pvUser2;    pArgs->idCpu     = NIL_RTCPUID;    pArgs->cHits     = 0;    paExecCpuDpcs = (KDPC *)(pArgs + 1);    if (enmCpuid == RT_NT_CPUID_SPECIFIC)    {        KeInitializeDpc(&paExecCpuDpcs[0], rtmpNtDPCWrapper, pArgs);        KeSetImportanceDpc(&paExecCpuDpcs[0], HighImportance);        KeSetTargetProcessorDpc(&paExecCpuDpcs[0], (int)idCpu);    }    else    {        for (unsigned i = 0; i < MAXIMUM_PROCESSORS; i++)        {            KeInitializeDpc(&paExecCpuDpcs[i], rtmpNtDPCWrapper, pArgs);            KeSetImportanceDpc(&paExecCpuDpcs[i], HighImportance);            KeSetTargetProcessorDpc(&paExecCpuDpcs[i], i);        }    }    /* Raise the IRQL to DISPATCH_LEVEL so we can't be rescheduled to another cpu.     * KeInsertQueueDpc must also be executed at IRQL >= DISPATCH_LEVEL.     */    KIRQL oldIrql;    KeRaiseIrql(DISPATCH_LEVEL, &oldIrql);    /*     * We cannot do other than assume a 1:1 relationship between the     * affinity mask and the process despite the warnings in the docs.     * If someone knows a better way to get this done, please let bird know.     */    if (enmCpuid == RT_NT_CPUID_SPECIFIC)    {        BOOLEAN ret = KeInsertQueueDpc(&paExecCpuDpcs[0], 0, 0);        Assert(ret);    }    else    {        unsigned iSelf = KeGetCurrentProcessorNumber();        for (unsigned i = 0; i < MAXIMUM_PROCESSORS; i++)        {            if (    (i != iSelf)                &&  (Mask & RT_BIT_64(i)))            {                BOOLEAN ret = KeInsertQueueDpc(&paExecCpuDpcs[i], 0, 0);                Assert(ret);            }        }        if (enmCpuid != RT_NT_CPUID_OTHERS)            pfnWorker(iSelf, pvUser1, pvUser2);    }    KeLowerIrql(oldIrql);    /* Flush all DPCs and wait for completion. (can take long!) */    /** @todo Consider changing this to an active wait using some atomic inc/dec     *  stuff (and check for the current cpu above in the specific case). */    g_pfnrtNtKeFlushQueuedDpcs();    ExFreePool(pArgs);    return VINF_SUCCESS;}

NTSTATUSNTAPISeInitializeProcessAuditName(IN PFILE_OBJECT FileObject,                             IN BOOLEAN DoAudit,                             OUT POBJECT_NAME_INFORMATION *AuditInfo){    OBJECT_NAME_INFORMATION LocalNameInfo;    POBJECT_NAME_INFORMATION ObjectNameInfo = NULL;    ULONG ReturnLength = 8;    NTSTATUS Status;    PAGED_CODE();    ASSERT(AuditInfo);    /* Check if we should do auditing */    if (DoAudit)    {        /* FIXME: TODO */    }    /* Now query the name */    Status = ObQueryNameString(FileObject,                               &LocalNameInfo,                               sizeof(LocalNameInfo),                               &ReturnLength);    if (((Status == STATUS_BUFFER_OVERFLOW) ||         (Status == STATUS_BUFFER_TOO_SMALL) ||         (Status == STATUS_INFO_LENGTH_MISMATCH)) &&        (ReturnLength != sizeof(LocalNameInfo)))    {        /* Allocate required size */        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,                                               ReturnLength,                                               TAG_SEPA);        if (ObjectNameInfo)        {            /* Query the name again */            Status = ObQueryNameString(FileObject,                                       ObjectNameInfo,                                       ReturnLength,                                       &ReturnLength);        }    }    /* Check if we got here due to failure */    if ((ObjectNameInfo) &&        (!(NT_SUCCESS(Status)) || (ReturnLength == sizeof(LocalNameInfo))))    {        /* First, free any buffer we might've allocated */        ASSERT(FALSE);        if (ObjectNameInfo) ExFreePool(ObjectNameInfo);        /* Now allocate a temporary one */        ReturnLength = sizeof(OBJECT_NAME_INFORMATION);        ObjectNameInfo = ExAllocatePoolWithTag(NonPagedPool,                                               sizeof(OBJECT_NAME_INFORMATION),                                               TAG_SEPA);        if (ObjectNameInfo)        {            /* Clear it */            RtlZeroMemory(ObjectNameInfo, ReturnLength);            Status = STATUS_SUCCESS;        }    }    /* Check if memory allocation failed */    if (!ObjectNameInfo) Status = STATUS_NO_MEMORY;    /* Return the audit name */    *AuditInfo = ObjectNameInfo;    /* Return status */    return Status;}

VOID SendDeviceIrp(IN PDEVICE_OBJECT DeviceObject, IN PIRP SIrp ){    NTSTATUS                  ntStatus;    POWER_STATE               powState;    PDEVICE_EXTENSION         deviceExtension;    PIO_STACK_LOCATION        irpStack;    SYSTEM_POWER_STATE        systemState;    DEVICE_POWER_STATE        devState;    PPOWER_COMPLETION_CONTEXT powerContext;    irpStack = IoGetCurrentIrpStackLocation(SIrp);    systemState = irpStack->Parameters.Power.State.SystemState;    deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;    FreeBT_DbgPrint(3, ("FBTUSB: SendDeviceIrp: Entered/n"));    // Read out the D-IRP out of the S->D mapping array captured in QueryCap's.    // we can choose deeper sleep states than our mapping but never choose    // lighter ones.    devState = deviceExtension->DeviceCapabilities.DeviceState[systemState];    powState.DeviceState = devState;    powerContext = (PPOWER_COMPLETION_CONTEXT) ExAllocatePool(NonPagedPool, sizeof(POWER_COMPLETION_CONTEXT));    if (!powerContext)	{        FreeBT_DbgPrint(1, ("FBTUSB: SendDeviceIrp: Failed to alloc memory for powerContext/n"));        ntStatus = STATUS_INSUFFICIENT_RESOURCES;    }    else	{        powerContext->DeviceObject = DeviceObject;        powerContext->SIrp = SIrp;        // in win2k PoRequestPowerIrp can take fdo or pdo.        ntStatus = PoRequestPowerIrp(                            deviceExtension->PhysicalDeviceObject,                            irpStack->MinorFunction,                            powState,                            (PREQUEST_POWER_COMPLETE)DevPoCompletionRoutine,                            powerContext,                            NULL);    }    if (!NT_SUCCESS(ntStatus))	{        if (powerContext)		{            ExFreePool(powerContext);        }        PoStartNextPowerIrp(SIrp);        SIrp->IoStatus.Status = ntStatus;        SIrp->IoStatus.Information = 0;        IoCompleteRequest(SIrp, IO_NO_INCREMENT);        FreeBT_DbgPrint(3, ("FBTUSB: SendDeviceIrp::"));        FreeBT_IoDecrement(deviceExtension);    }    FreeBT_DbgPrint(3, ("FBTUSB: SendDeviceIrp: Leaving/n"));}