文件系统驱动编程基础篇之5文件系统驱动编程基础篇之5.doc

文件系统驱动编程基础篇之5——注册表与Inf 关键字：文件系统驱动编程,注册表与Inf 作者：wskjuf 更新：2008-10-06 22:13:29 浏览：13221 文件系统驱动编程基础篇之五——注册表与Inf 一、前略 Registry Keys for Drivers》 3.《Windows上获得IP地址的四种方法》 4.《Device Information Sets》 5.《Using a Device Interface》 6.《Using Device Installation Functions》7.《From the Lab: Mapping USB devices via LNK files》 8.《Getting a file handle of a USB volume from its vid/pid/serial number》9.《Fill Level field in DEVICE_NODE structure》 10.《Tracing USB Device artefacts on Windows XP operating system for forensic purpose》11.《INF Models Section》关于硬件ID的命名规则部分12. devids.txt阅读基础：不限。本章目的：了解注册表在驱动编程的重要作用，阅读并学会编写简单的Inf。 二、注册表的配置 注册表以树形方式存储配置信息，树节点称为键（key），键可以包含子键（subkey）和称为值（value）的数据项。 一）需要关注的几种键（注：硬件键、类键、设备接口类应是所列位置下的子键）： 二）第3点中的服务键的写法与其他键有所不同，它以\REGISTRY打头，这是内核模式下根键的规定写法。 User-mode Handle Corresponding Object Name HKEY_LOCAL_MACHINE \Registry\Machine HKEY_USERS \Registry\User HKEY_CLASSES_ROOT No kernel-mode equivalent HKEY_CURRENT_USER No simple kernel-mode equivalent, but see Registry Run-Time Library Routines 三）服务的启动类型，如Start为3表示按需启动，scm在基础篇四已经有所论述了。 启动类型 注释 SERVICE_AUTO_START0 A service started automatically by the service control manager（scm） during system startup. For more information, see Automatically Starting Services. SERVICE_BOOT_START0 A device driver started by the system loader. This value is valid only for driver services. SERVICE_DEMAND_START0 A service started by the service control manager when a process calls the StartService function. For more information, see Starting Services on Demand. SERVICE_DISABLED0 A service that cannot be started. Attempts to start the service result in the error code ERROR_SERVICE_DISABLED. SERVICE_SYSTEM_START0 A device driver started by the IoInitSystem function. This value is valid only for driver services. 四）Chap6\pnpevent示例驱动为例的具体键值，硬件键的命名问题详看资料1第十二章。 三、内核模式下注册表的访问 请先阅读资料1第三章五小节，本小节仅仅补充两个有删节的示例。一）IoOpenDeviceRegistryKey与Zw