#include?
#include?
#include?“MouseFilter.h“

MOUSE_FILTER_DATA?gFilterData?=?{0};


NTSTATUS
CreateClose（
????__in?PDEVICE_object?Deviceobject
????__in?PIRP?Irp
????）
{
????PIO_STACK_LOCATION?irpStack?=?IoGetCurrentIrpStackLocation（Irp）;
????
????UNREFERENCED_PARAMETER（Deviceobject）;

????PAGED_CODE（）;

????KdPrint（（“Entered?IRP_MJ_%s\n“?（irpStack->MajorFunction?==?IRP_MJ_CREATE）???“CREATE“?:?“CLOSE“?））;

????Irp->IoStatus.Status?=?STATUS_SUCCESS;
????Irp->IoStatus.Information?=?0;
????IoCompleteRequest（Irp?IO_NO_INCREMENT）;

????return?Irp->IoStatus.Status;
}

NTSTATUS
DeviceControl（
????IN?PDEVICE_object?Deviceobject
????IN?PIRP?Irp
????）
{
????PAGED_CODE（）;

????Irp->IoStatus.Status?=?STATUS_INVALID_PARAMETER;
????Irp->IoStatus.Information?=?0;
????IoCompleteRequest?（IrpIO_NO_INCREMENT）;

????return?Irp->IoStatus.Status;
}

VOID?CleanUP（__in?PDEVICE_object?Deviceobject）
{
????UNICODE_STRING??SymboliclinkName;

????if（!Deviceobject）
????????return;

????//?刪除符號(hào)鏈接和設(shè)備對(duì)象
????RtlInitUnicodeString（&SymboliclinkName?DOS_DEVICE_NAME）;
????IoDeleteSymboliclink（&SymboliclinkName）;???????
????IoDeleteDevice（Deviceobject）;
????
????//恢復(fù)IRP??hook
????if（gFilterData.OldRead）
????{
????????InterlockedExchange（
????????????????（PLONG）&gFilterData.pMouseDriverobject->MajorFunction[IRP_MJ_READ]?
????????????????（LONG）gFilterData.OldRead
????????????????）;?????????
????}??
????
????if（gFilterData.pMouseDriverobject）
????{
????????ObDereferenceobject（gFilterData.pMouseDriverobject）;??
????}
}

//?取消等待的IRP
VOID?CancelPendingIrp（）
{
????PPENDING_IRP_LIST?PendingList?=?NULL?CancelList?=?NULL;
????PSINGLE_LIST_ENTRY?pSingleListEntry?=?NULL;

????//?獲取互斥體，保護(hù)鏈表gFilterData.ListHead
????KeWaitForMutexobject（&gFilterData.ReadMutex?Executive?KernelMode?FALSE?NULL）;
????
????pSingleListEntry?=?gFilterData.ListHead.Next;
????while（pSingleListEntry）
????{???????
????????PendingList?=?CONTAINING_RECORD（pSingleListEntry?PENDING_IRP_LIST?SingleListEntry）;
????????KdPrint（（“Copy?Single?List?=?0x%x“?PendingList））;

????????//?復(fù)制鏈表，然后將取消IRP的操作放到新的鏈表中處理
????????CancelList?=?（PPENDING_IRP_LIST）ExAllocatePoolWithTag（NonPagedPool?sizeof（PENDING_IRP_LIST）?POOL_TAG）;
????????if（CancelList）
????????{
????????????RtlCopyMemory（CancelList?PendingList?sizeof（PENDING_IRP_LIST））;
????????????PushEntryList（&gFilterData.CancelHead?&CancelList->SingleListEntry）;
????????}???????????
????????
????????pSingleListEntry?=?pSingleListEntry->Next;
????}???
????//?釋放互斥體
????KeReleaseMutex（&gFilterData.ReadMutex?FALSE）;
????

????//?之所以要復(fù)制一個(gè)新的鏈表來取消IRP?（通過調(diào)用IoCancelIrp），
????//?是因?yàn)镮oCancelIrp?會(huì)調(diào)用MyReadComplete?這個(gè)完成例程回調(diào)，
????//?而MyReadComplete里面又對(duì)鏈表進(jìn)行操作，這樣會(huì)破壞鏈表的結(jié)構(gòu)
????pSingleListEntry?=?PopEntryList（&gFilterData.CancelHead）;
????while（pSingleListEntry）
????{
????????CancelList?=?CONTAINING_RECORD（pSingleListEntry?PENDING_IRP_LIST?SingleListEntry）;
???????