22.DriverBase-ObReferenceObjectByHandle通过Ring3句柄获得Ring0对象

示例ring3的event传入ring0，并在ring0设置有信号状态
ring0:

#include "Driver.h"

#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
            IN PDRIVER_OBJECT pDriverObject,
            IN PUNICODE_STRING pRegistryPath    ) 
{
    NTSTATUS status;
    pDriverObject->DriverUnload = HelloDDKUnload;
    pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutine;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDeviceIOControl;
    status = CreateDevice(pDriverObject);
    return status;
}

#pragma PAGEDCODE
NTSTATUS CreateDevice (IN PDRIVER_OBJECT    pDriverObject) 
{
    NTSTATUS status;
    PDEVICE_OBJECT pDevObj;
    PDEVICE_EXTENSION pDevExt;

    //创建设备名称
    UNICODE_STRING devName;
    RtlInitUnicodeString(&devName,L"\\Device\\Handle2Object");

    //创建设备
    status = IoCreateDevice( pDriverObject,
                        sizeof(DEVICE_EXTENSION),
                        &(UNICODE_STRING)devName,
                        FILE_DEVICE_UNKNOWN,
                        0, TRUE,
                        &pDevObj );
    if (!NT_SUCCESS(status))
        return status;

    pDevObj->Flags |= DO_DIRECT_IO;
    pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
    pDevExt->pDevice = pDevObj;
    pDevExt->ustrDeviceName = devName;


    //创建符号链接
    UNICODE_STRING symLinkName;
    RtlInitUnicodeString(&symLinkName,L"\\??\\Handle2ObjectLink");
    pDevExt->ustrSymLinkName = symLinkName;
    status = IoCreateSymbolicLink( &symLinkName,&devName );
    if (!NT_SUCCESS(status)) 
    {
        IoDeleteDevice( pDevObj );
        return status;
    }
    return STATUS_SUCCESS;
}

#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject) 
{
    PDEVICE_OBJECT  pNextObj;
    KdPrint(("Enter DriverUnload\n"));
    pNextObj = pDriverObject->DeviceObject;
    while (pNextObj != NULL) 
    {
        PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;

        //删除符号链接
        UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
        IoDeleteSymbolicLink(&pLinkName);
        pNextObj = pNextObj->NextDevice;
        IoDeleteDevice( pDevExt->pDevice );
    }
}

#pragma PAGEDCODE
NTSTATUS HelloDDKDeviceIOControl(IN PDEVICE_OBJECT pDevObj,
                                 IN PIRP pIrp)
{
    NTSTATUS status = STATUS_SUCCESS;
    KdPrint(("Enter HelloDDKDeviceIOControl\n"));

    //得到当前堆栈
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
    //得到输入缓冲区大小
    ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
    //得到输出缓冲区大小
    ULONG cbout = stack->Parameters.DeviceIoControl.OutputBufferLength;
    //得到IOCTL码
    ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;

    ULONG info = 0;

    switch (code)
    {                       // process request
        case IOCTL_TEST1:
        {
            KdPrint(("IOCTL_TEST1\n"));
            HANDLE hUserEvent= *(HANDLE*)pIrp->AssociatedIrp.SystemBuffer;
            PKEVENT pEvent;
            // 由事件句柄得到内核事件数据结构
            status = ObReferenceObjectByHandle(hUserEvent,EVENT_MODIFY_STATE,*ExEventObjectType,KernelMode,(PVOID*)&pEvent,NULL);// 参看MSDN
            // 设置事件
            KeSetEvent(pEvent,IO_NO_INCREMENT,FALSE);
            // 减小引用计数
            ObDereferenceObject(pEvent);
            break;
        }

        default:
            status = STATUS_INVALID_VARIANT;
    }

    // 完成IRP
    pIrp->IoStatus.Status = status;
    pIrp->IoStatus.Information = info;  // bytes xfered
    IoCompleteRequest( pIrp, IO_NO_INCREMENT );
    KdPrint(("Leave HelloDDKDeviceIOControl\n"));

    return status;
}

#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutine(IN PDEVICE_OBJECT pDevObj,
                                 IN PIRP pIrp) 
{
    KdPrint(("Enter HelloDDKDispatchRoutine\n"));
    NTSTATUS status = STATUS_SUCCESS;
    // 完成IRP
    pIrp->IoStatus.Status = status;
    pIrp->IoStatus.Information = 0; // bytes xfered
    IoCompleteRequest( pIrp, IO_NO_INCREMENT );
    KdPrint(("Leave HelloDDKDispatchRoutine\n"));
    return status;
}

ring3:

// Handle2ObjectRing3.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <process.h>

#define IOCTL_TEST1 CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)
unsigned __stdcall ThreadProc(PVOID lp)
{
    HANDLE hEvent = *(HANDLE*)lp;
    WaitForSingleObject(hEvent,INFINITE);
    return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hDevice = 
        CreateFileA("\\\\.\\Handle2ObjectLink",
        GENERIC_READ | GENERIC_WRITE,
        0,      // share mode none
        NULL,   // no security
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL );     // no template
    if (INVALID_HANDLE_VALUE == hDevice)
    {
        printf("fail:%d",GetLastError());
        system("pause");
        return 1;
    }
    // 创建用户模式同步事件
    HANDLE hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);
    HANDLE hThread = (HANDLE)_beginthreadex(NULL,0,ThreadProc,&hEvent,0,NULL);
    DWORD dwOutPut;
    DeviceIoControl(hDevice,IOCTL_TEST1,&hEvent,sizeof(hEvent),NULL,0,&dwOutPut,NULL);
    WaitForSingleObject(hThread,INFINITE);
    CloseHandle(hDevice);
    CloseHandle(hThread);
    CloseHandle(hEvent);
    system("pause");
    return 0;
}