1. NTSTATUS.H头文件解析NTSTATUS.H是Windows NT内核开发中最重要的头文件之一它定义了系统范围内使用的状态代码。这些状态代码用于表示操作系统的各种执行结果从成功状态到各种错误条件。1.1 NTSTATUS值的基本结构每个NTSTATUS值都是32位整数按以下方式组织第31位最高位严重性位0 成功1 错误/警告第30-29位保留位第28-16位设施代码表示错误来源第15-0位状态代码典型的NTSTATUS值格式如下#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #define STATUS_INVALID_PARAMETER ((NTSTATUS)0xC000000DL)1.2 常见NTSTATUS值分类NTSTATUS值可以分为以下几大类成功状态0x0XXXXXXXSTATUS_SUCCESS (0x00000000)STATUS_WAIT_0 (0x00000000)STATUS_ABANDONED_WAIT_0 (0x00000080)信息状态0x4XXXXXXXSTATUS_SINGLE_STEP (0x4000001E)STATUS_BREAKPOINT (0x80000003)警告状态0x8XXXXXXXSTATUS_GUARD_PAGE_VIOLATION (0x80000001)STATUS_DATATYPE_MISALIGNMENT (0x80000002)错误状态0xCXXXXXXXSTATUS_UNSUCCESSFUL (0xC0000001)STATUS_NOT_IMPLEMENTED (0xC0000002)STATUS_INVALID_INFO_CLASS (0xC0000003)2. NTSTATUS值的实际应用2.1 在驱动程序开发中的使用在Windows驱动程序开发中NTSTATUS值用于几乎所有内核API的返回值。例如NTSTATUS DriverEntry( _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath ) { NTSTATUS status; // 初始化驱动程序 status InitializeDriver(DriverObject); if (!NT_SUCCESS(status)) { KdPrint((Driver initialization failed: 0x%X\n, status)); return status; } return STATUS_SUCCESS; }2.2 常见错误处理模式处理NTSTATUS值的标准模式是使用NT_SUCCESS宏NTSTATUS status SomeKernelFunction(); if (!NT_SUCCESS(status)) { // 错误处理 LogError(status); return status; }3. NTSTATUS值的调试与分析3.1 使用WinDbg解析NTSTATUS值在WinDbg调试器中可以使用!error命令查看NTSTATUS值的含义0: kd !error c0000005 Error code: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.3.2 常见NTSTATUS错误代码解析以下是一些常见的NTSTATUS错误代码及其含义状态代码值描述STATUS_SUCCESS0x00000000操作成功完成STATUS_INVALID_PARAMETER0xC000000D传递给函数的参数无效STATUS_ACCESS_VIOLATION0xC0000005内存访问冲突STATUS_INSUFFICIENT_RESOURCES0xC000009A系统资源不足STATUS_OBJECT_NAME_NOT_FOUND0xC0000034找不到指定的对象4. 高级NTSTATUS主题4.1 自定义NTSTATUS值虽然微软建议使用预定义的NTSTATUS值但在某些情况下可以定义自己的状态代码。自定义NTSTATUS值应遵循以下规则严重性位设置为1错误使用自定义设施代码0x7FF状态代码部分使用唯一值示例#define FACILITY_MY_DRIVER 0x7FF #define STATUS_MY_CUSTOM_ERROR ((NTSTATUS)0xC0070001L)4.2 NTSTATUS与HRESULT的转换在用户模式与内核模式交互时可能需要将NTSTATUS转换为HRESULTHRESULT NtStatusToHResult(NTSTATUS status) { if (NT_SUCCESS(status)) return S_OK; // 将NTSTATUS映射到相应的HRESULT switch (status) { case STATUS_INVALID_PARAMETER: return E_INVALIDARG; case STATUS_NO_MEMORY: return E_OUTOFMEMORY; // 其他映射... default: return HRESULT_FROM_NT(status); } }5. NTSTATUS最佳实践5.1 错误处理建议始终检查NTSTATUS返回值使用NT_SUCCESS宏进行快速检查在适当的地方记录错误状态将原始NTSTATUS值传播给调用者5.2 性能考虑避免在热路径中频繁转换NTSTATUS值对于常见错误路径进行优化考虑使用STATUS_PENDING进行异步操作6. 常见问题排查6.1 如何识别未知的NTSTATUS值使用WinDbg的!error命令在MSDN或WDK文档中搜索检查NTSTATUS.H头文件定义6.2 处理STATUS_PENDINGSTATUS_PENDING (0x00000103)表示操作已开始但尚未完成。处理这种状态需要NTSTATUS status StartAsyncOperation(); if (status STATUS_PENDING) { // 等待操作完成 status WaitForCompletion(); } if (!NT_SUCCESS(status)) { // 错误处理 }7. NTSTATUS在安全领域的应用7.1 安全相关的NTSTATUS值状态代码值安全含义STATUS_ACCESS_DENIED0xC0000022访问被拒绝STATUS_PRIVILEGE_NOT_HELD0xC0000061缺少必要权限STATUS_PASSWORD_EXPIRED0xC0000071密码已过期STATUS_ACCOUNT_LOCKED_OUT0xC0000234账户被锁定7.2 处理认证错误处理认证错误时的最佳实践NTSTATUS AuthenticateUser(PVOID Credentials) { NTSTATUS status ValidateCredentials(Credentials); switch (status) { case STATUS_SUCCESS: // 认证成功 break; case STATUS_WRONG_PASSWORD: case STATUS_PASSWORD_EXPIRED: case STATUS_ACCOUNT_LOCKED_OUT: // 记录安全事件 LogSecurityEvent(status); // 返回通用错误以避免信息泄露 return STATUS_LOGON_FAILURE; default: return status; } return STATUS_SUCCESS; }8. NTSTATUS与异常处理8.1 结构化异常处理中的NTSTATUS在Windows结构化异常处理(SEH)中异常代码通常是NTSTATUS值__try { // 可能引发异常的代码 ProbeForRead(UserBuffer, Length, sizeof(UCHAR)); } __except (FilterException(GetExceptionCode())) { NTSTATUS status GetExceptionCode(); if (status STATUS_ACCESS_VIOLATION) { // 处理访问冲突 } }8.2 常见异常状态代码异常代码值描述EXCEPTION_ACCESS_VIOLATION0xC0000005内存访问冲突EXCEPTION_BREAKPOINT0x80000003断点异常EXCEPTION_INT_DIVIDE_BY_ZERO0xC0000094整数除以零EXCEPTION_STACK_OVERFLOW0xC00000FD堆栈溢出9. NTSTATUS在文件系统中的应用9.1 文件系统相关状态代码状态代码值文件系统含义STATUS_OBJECT_PATH_NOT_FOUND0xC000003A路径不存在STATUS_OBJECT_NAME_NOT_FOUND0xC0000034文件名不存在STATUS_DELETE_PENDING0xC0000056对象正在被删除STATUS_FILE_LOCK_CONFLICT0xC0000057文件锁定冲突9.2 处理文件系统错误示例NTSTATUS OpenFile(PUNICODE_STRING FilePath, PHANDLE FileHandle) { OBJECT_ATTRIBUTES objAttr; IO_STATUS_BLOCK ioStatus; InitializeObjectAttributes(objAttr, FilePath, OBJ_KERNEL_HANDLE, NULL, NULL); NTSTATUS status ZwCreateFile( FileHandle, FILE_READ_DATA, objAttr, ioStatus, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT, NULL, 0); if (!NT_SUCCESS(status)) { if (status STATUS_OBJECT_NAME_NOT_FOUND) { KdPrint((File not found: %wZ\n, FilePath)); } else if (status STATUS_ACCESS_DENIED) { KdPrint((Access denied: %wZ\n, FilePath)); } return status; } return STATUS_SUCCESS; }10. NTSTATUS与注册表操作10.1 注册表相关状态代码状态代码值注册表含义STATUS_REGISTRY_IO_FAILED0xC0000189注册表I/O失败STATUS_REGISTRY_CORRUPT0xC000014C注册表损坏STATUS_KEY_DELETED0xC000017C注册表键已删除STATUS_KEY_HAS_CHILDREN0xC000017D注册表键有子项10.2 注册表操作错误处理NTSTATUS QueryRegistryValue(PUNICODE_STRING ValueName, PULONG ValueData) { NTSTATUS status; HANDLE keyHandle; OBJECT_ATTRIBUTES objAttr; UNICODE_STRING keyPath RTL_CONSTANT_STRING(L\\Registry\\Machine\\Software\\MyApp); InitializeObjectAttributes(objAttr, keyPath, OBJ_CASE_INSENSITIVE, NULL, NULL); status ZwOpenKey(keyHandle, KEY_QUERY_VALUE, objAttr); if (!NT_SUCCESS(status)) { KdPrint((Failed to open registry key: 0x%X\n, status)); return status; } KEY_VALUE_PARTIAL_INFORMATION info; ULONG resultLength; status ZwQueryValueKey( keyHandle, ValueName, KeyValuePartialInformation, info, sizeof(info), resultLength); ZwClose(keyHandle); if (!NT_SUCCESS(status)) { if (status STATUS_OBJECT_NAME_NOT_FOUND) { KdPrint((Registry value not found: %wZ\n, ValueName)); } return status; } if (info.Type ! REG_DWORD) { return STATUS_OBJECT_TYPE_MISMATCH; } *ValueData *(PULONG)info.Data; return STATUS_SUCCESS; }11. NTSTATUS与网络操作11.1 网络相关状态代码状态代码值网络含义STATUS_NETWORK_UNREACHABLE0xC000023C网络不可达STATUS_HOST_UNREACHABLE0xC000023D主机不可达STATUS_CONNECTION_REFUSED0xC0000236连接被拒绝STATUS_CONNECTION_RESET0xC000013C连接重置11.2 处理网络错误示例NTSTATUS SendNetworkRequest(PVOID Request, ULONG RequestSize) { NTSTATUS status; SOCKET sock; WSADATA wsaData; status WSAStartup(MAKEWORD(2,2), wsaData); if (status ! 0) { KdPrint((WSAStartup failed: %d\n, status)); return STATUS_UNSUCCESSFUL; } sock socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (sock INVALID_SOCKET) { status WSAGetLastError(); KdPrint((Socket creation failed: %d\n, status)); WSACleanup(); return STATUS_UNSUCCESSFUL; } // 设置超时 DWORD timeout 5000; // 5秒 setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, (char*)timeout, sizeof(timeout)); setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, (char*)timeout, sizeof(timeout)); // 连接服务器 SOCKADDR_IN serverAddr; serverAddr.sin_family AF_INET; serverAddr.sin_addr.s_addr inet_addr(192.168.1.1); serverAddr.sin_port htons(80); if (connect(sock, (SOCKADDR*)serverAddr, sizeof(serverAddr)) SOCKET_ERROR) { status WSAGetLastError(); KdPrint((Connection failed: %d\n, status)); closesocket(sock); WSACleanup(); switch (status) { case WSAETIMEDOUT: return STATUS_IO_TIMEOUT; case WSAECONNREFUSED: return STATUS_CONNECTION_REFUSED; default: return STATUS_UNSUCCESSFUL; } } // 发送请求 if (send(sock, (char*)Request, RequestSize, 0) SOCKET_ERROR) { status WSAGetLastError(); KdPrint((Send failed: %d\n, status)); closesocket(sock); WSACleanup(); return STATUS_UNSUCCESSFUL; } closesocket(sock); WSACleanup(); return STATUS_SUCCESS; }12. NTSTATUS与电源管理12.1 电源管理相关状态代码状态代码值电源管理含义STATUS_POWER_STATE_INVALID0xC00002D3无效的电源状态STATUS_DEVICE_BUSY0xC0000185设备忙无法改变电源状态STATUS_DEVICE_NOT_READY0xC00000A3设备未准备好STATUS_INSUFFICIENT_POWER0xC00002DE电源不足12.2 处理电源管理错误NTSTATUS SetDevicePowerState(PDEVICE_OBJECT DeviceObject, DEVICE_POWER_STATE PowerState) { NTSTATUS status; POWER_STATE newPowerState; newPowerState.DeviceState PowerState; status PoRequestPowerIrp( DeviceObject, IRP_MN_SET_POWER, newPowerState, (PREQUEST_POWER_COMPLETE)PowerCompletionRoutine, NULL, NULL); if (!NT_SUCCESS(status)) { KdPrint((PoRequestPowerIrp failed: 0x%X\n, status)); if (status STATUS_INSUFFICIENT_RESOURCES) { // 尝试释放资源后重试 FreeSomeResources(); status PoRequestPowerIrp(...); } } return status; } VOID PowerCompletionRoutine( PDEVICE_OBJECT DeviceObject, UCHAR MinorFunction, POWER_STATE PowerState, PVOID Context, PIO_STATUS_BLOCK IoStatus) { if (!NT_SUCCESS(IoStatus-Status)) { KdPrint((Power IRP completed with status: 0x%X\n, IoStatus-Status)); if (IoStatus-Status STATUS_POWER_STATE_INVALID) { // 处理无效的电源状态 } } }13. NTSTATUS与内存管理13.1 内存管理相关状态代码状态代码值内存管理含义STATUS_INVALID_PAGE_PROTECTION0xC0000045无效的页面保护STATUS_COMMITMENT_LIMIT0xC000012D提交限制超出STATUS_NO_MEMORY0xC0000017内存不足STATUS_WORKING_SET_QUOTA0xC00000A0工作集配额不足13.2 处理内存分配错误NTSTATUS AllocateNonPagedMemory(PVOID *Buffer, SIZE_T Size) { *Buffer ExAllocatePoolWithTag(NonPagedPool, Size, MyTa); if (*Buffer NULL) { KdPrint((Memory allocation failed for size: %Iu\n, Size)); return STATUS_NO_MEMORY; } return STATUS_SUCCESS; } NTSTATUS SafeMemoryOperation(PVOID UserBuffer, ULONG Length) { NTSTATUS status; __try { ProbeForRead(UserBuffer, Length, sizeof(UCHAR)); // 执行内存操作 status ProcessUserData(UserBuffer, Length); } __except (EXCEPTION_EXECUTE_HANDLER) { status GetExceptionCode(); KdPrint((Memory access exception: 0x%X\n, status)); if (status STATUS_ACCESS_VIOLATION) { // 处理访问冲突 status STATUS_INVALID_USER_BUFFER; } } return status; }14. NTSTATUS与多线程同步14.1 同步相关状态代码状态代码值同步含义STATUS_ABANDONED0xC0000184互斥体被放弃STATUS_SEMAPHORE_LIMIT_EXCEEDED0xC0000047信号量计数超出限制STATUS_TIMEOUT0x00000102操作超时STATUS_CANCELLED0xC0000120操作被取消14.2 处理同步对象错误NTSTATUS ThreadSafeOperation(PKSEMAPHORE SyncSemaphore) { NTSTATUS status; LARGE_INTEGER timeout; timeout.QuadPart -10 * 1000 * 1000; // 10秒超时 status KeWaitForSingleObject( SyncSemaphore, Executive, KernelMode, FALSE, timeout); if (!NT_SUCCESS(status)) { if (status STATUS_TIMEOUT) { KdPrint((Timeout waiting for semaphore\n)); } else if (status STATUS_ABANDONED) { KdPrint((Mutex was abandoned\n)); } return status; } __try { // 执行受保护的操作 PerformCriticalOperation(); } __finally { KeReleaseSemaphore(SyncSemaphore, 0, 1, FALSE); } return STATUS_SUCCESS; }15. NTSTATUS与设备I/O15.1 I/O相关状态代码状态代码值I/O含义STATUS_DEVICE_NOT_CONNECTED0xC00000A4设备未连接STATUS_DEVICE_DOES_NOT_EXIST0xC00000C0设备不存在STATUS_IO_DEVICE_ERROR0xC0000185I/O设备错误STATUS_VERIFIER_STOP0xC0000421驱动程序验证器停止15.2 处理设备I/O错误NTSTATUS ReadFromDevice(PDEVICE_OBJECT DeviceObject, PVOID Buffer, ULONG Length) { NTSTATUS status; KEVENT event; IO_STATUS_BLOCK ioStatus; PIRP irp; LARGE_INTEGER offset {0}; KeInitializeEvent(event, NotificationEvent, FALSE); irp IoBuildSynchronousFsdRequest( IRP_MJ_READ, DeviceObject, Buffer, Length, offset, event, ioStatus); if (irp NULL) { return STATUS_INSUFFICIENT_RESOURCES; } status IoCallDriver(DeviceObject, irp); if (status STATUS_PENDING) { KeWaitForSingleObject(event, Executive, KernelMode, FALSE, NULL); status ioStatus.Status; } if (!NT_SUCCESS(status)) { if (status STATUS_DEVICE_NOT_CONNECTED) { KdPrint((Device not connected\n)); } else if (status STATUS_IO_DEVICE_ERROR) { KdPrint((Device I/O error\n)); // 尝试重置设备 ResetDevice(DeviceObject); } } return status; }16. NTSTATUS与安全审计16.1 安全审计相关状态代码状态代码值安全审计含义STATUS_AUDIT_FAILED0xC00002C0审计失败STATUS_PRIVILEGE_NOT_HELD0xC0000061缺少必要权限STATUS_AUDIT_DISABLED0xC0000356审计被禁用STATUS_SECURITY_STREAM_IS_INCONSISTENT0xC000042F安全流不一致16.2 处理安全审计错误NTSTATUS GenerateSecurityAudit(PUNICODE_STRING AuditMessage) { NTSTATUS status; SECURITY_SUBJECT_CONTEXT subjectContext; BOOLEAN auditResult; SeCaptureSubjectContext(subjectContext); auditResult SeAuditingFileEventsWithContext( subjectContext, NULL, FILE_AUDIT_EVENT); if (!auditResult) { SeReleaseSubjectContext(subjectContext); return STATUS_AUDIT_DISABLED; } status SeAppendPrivileges( subjectContext, SeSecurityPrivilege); if (!NT_SUCCESS(status)) { SeReleaseSubjectContext(subjectContext); return status; } status SeOpenObjectAuditAlarm( ObjectTypeName, NULL, NULL, NULL, NULL, 0, subjectContext, FALSE, TRUE, auditResult); SeReleaseSubjectContext(subjectContext); if (!NT_SUCCESS(status)) { KdPrint((Failed to generate audit: 0x%X\n, status)); return status; } return STATUS_SUCCESS; }17. NTSTATUS与即插即用17.1 即插即用相关状态代码状态代码值即插即用含义STATUS_PNP_RESTART_ENUMERATION0xC00002CE需要重新枚举设备STATUS_PNP_REBOOT_REQUIRED0xC00002D2需要重启完成安装STATUS_PLUGPLAY_NO_DEVICE0xC000025E没有设备STATUS_INVALID_DEVICE_REQUEST0xC0000010无效的设备请求17.2 处理即插即用错误NTSTATUS HandlePnpEvent(PDEVICE_OBJECT DeviceObject, PIRP Irp) { NTSTATUS status; PIO_STACK_LOCATION stack IoGetCurrentIrpStackLocation(Irp); switch (stack-MinorFunction) { case IRP_MN_START_DEVICE: status StartDevice(DeviceObject, Irp); break; case IRP_MN_STOP_DEVICE: status StopDevice(DeviceObject, Irp); break; case IRP_MN_REMOVE_DEVICE: status RemoveDevice(DeviceObject, Irp); break; case IRP_MN_SURPRISE_REMOVAL: status HandleSurpriseRemoval(DeviceObject, Irp); break; default: status Irp-IoStatus.Status; break; } if (!NT_SUCCESS(status)) { KdPrint((PNP operation failed: 0x%X\n, status)); if (status STATUS_PNP_REBOOT_REQUIRED) { // 设置需要重启的标志 SetRebootRequiredFlag(); } } Irp-IoStatus.Status status; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status; }18. NTSTATUS与WMI18.1 WMI相关状态代码状态代码值WMI含义STATUS_WMI_GUID_NOT_FOUND0xC0000295找不到GUIDSTATUS_WMI_INSTANCE_NOT_FOUND0xC0000296找不到实例STATUS_WMI_ITEMID_NOT_FOUND0xC0000297找不到项目IDSTATUS_WMI_TRY_AGAIN0xC0000298需要重试18.2 处理WMI错误NTSTATUS HandleWmiQuery( PDEVICE_OBJECT DeviceObject, PIRP Irp, ULONG GuidIndex, ULONG InstanceIndex, ULONG InstanceCount, PULONG InstanceLengthArray, ULONG BufferAvail, PUCHAR Buffer) { NTSTATUS status STATUS_SUCCESS; if (GuidIndex WMI_GUID_COUNT) { return STATUS_WMI_GUID_NOT_FOUND; } if (InstanceIndex ! 0 InstanceIndex ! WMI_ALL_DATA) { return STATUS_WMI_INSTANCE_NOT_FOUND; } switch (GuidIndex) { case WMI_PERF_DATA_GUID_INDEX: status GetPerformanceData(Buffer, BufferAvail); break; case WMI_CONFIG_DATA_GUID_INDEX: status GetConfigurationData(Buffer, BufferAvail); break; default: status STATUS_WMI_GUID_NOT_FOUND; break; } if (status STATUS_BUFFER_TOO_SMALL) { // 设置所需的缓冲区大小 Irp-IoStatus.Information GetRequiredBufferSize(GuidIndex); } return status; }19. NTSTATUS与电源故障恢复19.1 电源故障相关状态代码状态代码值电源故障含义STATUS_POWER_FAILURE0xC000009E电源故障STATUS_DEVICE_POWER_FAILURE0xC00002D7设备电源故障STATUS_SYSTEM_POWERSTATE_TRANSITION0xC00002D8系统电源状态转换STATUS_POWER_STATE_INVALID0xC00002D3无效的电源状态19.2 处理电源故障NTSTATUS HandlePowerFailure(PDEVICE_OBJECT DeviceObject, PIRP Irp) { NTSTATUS status; PPOWER_STATE powerState; PIO_STACK_LOCATION stack IoGetCurrentIrpStackLocation(Irp); powerState stack-Parameters.Power.State; switch (stack-MinorFunction) { case IRP_MN_SET_POWER: switch (powerState-SystemState) { case PowerSystemWorking: status ResumeFromSleep(DeviceObject); break; case PowerSystemSleeping1: case PowerSystemSleeping2: case PowerSystemSleeping3: status PrepareForSleep(DeviceObject, powerState-SystemState); break; case PowerSystemShutdown: status PrepareForShutdown(DeviceObject); break; default: status STATUS_POWER_STATE_INVALID; break; } break; case IRP_MN_QUERY_POWER: status CanEnterPowerState(DeviceObject, powerState-SystemState); break; default: status Irp-IoStatus.Status; break; } if (!NT_SUCCESS(status)) { KdPrint((Power operation failed: 0x%X\n, status)); if (status STATUS_POWER_FAILURE) { // 处理电源故障 HandleEmergencyShutdown(DeviceObject); } } Irp-IoStatus.Status status; IoCompleteRequest(Irp, IO_NO_INCREMENT); return status; }20. NTSTATUS与驱动程序验证20.1 验证相关状态代码状态代码值验证含义STATUS_DRIVER_BLOCKED0xC000036C驱动程序被阻止加载STATUS_DRIVER_DATABASE_ERROR0xC000036D驱动程序数据库错误STATUS_DRIVER_PROCESS_TERMINATED0xC0000450驱动程序进程终止STATUS_DRIVER_ENTRYPOINT_NOT_FOUND0xC0000263找不到驱动程序入口点20.2 处理验证错误NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { NTSTATUS status; // 检查驱动程序签名 status SeValidateImageHeader(DriverObject-DriverStart, DriverObject-DriverSize); if (!NT_SUCCESS(status)) { KdPrint((Driver validation failed: 0x%X\n, status)); return status; } // 注册驱动程序验证回调 status DbgSetDebugFilterState(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, TRUE); if (!NT_SUCCESS(status)) { KdPrint((Failed to set debug filter: 0x%X\n, status)); } // 初始化驱动程序 DriverObject-DriverUnload DriverUnload; DriverObject-MajorFunction[IRP_MJ_CREATE] DispatchCreate; DriverObject-MajorFunction[IRP_MJ_CLOSE] DispatchClose; // 其他函数指针初始化... // 验证驱动程序完整性 status VerifyDriverIntegrity(DriverObject); if (!NT_SUCCESS(status)) { KdPrint((Driver integrity check failed: 0x%X\n, status)); return status; } return STATUS_SUCCESS; }