Windows驱动中注册系统关闭重启回调函数IoRegisterShutdownNotification

方法1:自己创建设备

处理IRP_MJ_SHUTDOWN irp回调 ,还需要调用IoRegisterShutdownNotification函数来关联设备.就可以成功的注册关机通知了.

#include "LoadFirst.h"
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
    KdPrint(("驱动卸载成功\n"));
}

NTSTATUS DispatchShutDown(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
    KdPrint(("关机回调运行\n"));
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
    NTSTATUS status = STATUS_SUCCESS;
    pDriverObject->DriverUnload = DriverUnload;
    PDEVICE_OBJECT pDeviceObject;
    status=IoCreateDevice(pDriverObject, 0, NULL, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDeviceObject);
    if(!NT_SUCCESS(status))
    {
        KdPrint(("设备创建失败\n"));
        return status;
    }
    pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = DispatchShutDown;
    IoRegisterShutdownNotification(pDeviceObject);

    KdPrint(("驱动加载成功\n"));
    return status;
}

方法2:寻找别的设备对象

#include "LoadFirst.h"
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
    KdPrint(("驱动卸载成功\n"));
}

NTSTATUS DispatchShutDown(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
    KdPrint(("关机回调运行 other device\n"));
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
{
    NTSTATUS status = STATUS_SUCCESS;
    pDriverObject->DriverUnload = DriverUnload;
    PDEVICE_OBJECT pDeviceObject;

    UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(L"\\Device\\Null");
    PFILE_OBJECT pFileObject;

    status=IoGetDeviceObjectPointer(&DeviceName, FILE_ALL_ACCESS, &pFileObject, &pDeviceObject);
    if(!NT_SUCCESS(status))
    {
        KdPrint(("获取设备指针失败\n"));
        return status;
    }
    pDeviceObject->DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = DispatchShutDown;
    IoRegisterShutdownNotification(pDeviceObject);

    KdPrint(("驱动加载成功\n"));
    return status;
}