Function DriverEntry

Anti-Rootkit/ARK.cpp:110–259

// ����Ϊȫ��ִ��ʧ�ܣ���ô�Dz������ġ�
// ϵͳ���ڵ���Դ���ж�״̬�£�Ӧ��֤�������ڶ��ӻ����£����̶ȵ�����߼�����
extern "C" NTSTATUS
DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) {
	if (*InitSafeBootMode > 0) {
		// The operating system is in Safe Mode.
		return STATUS_NOT_SAFE_MODE_DRIVER;
	}

	// �������Լ����ˣ������û��ʵ������������Ӧ
	if (DriverObject == nullptr) {
		return STATUS_UNSUCCESSFUL;
	}

	g_DriverObject = DriverObject;

	TraceLoggingRegister(g_Provider);

	TraceLoggingWrite(g_Provider, "DriverEntry started",
		TraceLoggingLevel(TRACE_LEVEL_INFORMATION),
		TraceLoggingValue("Ark Driver", "DriverName"),
		TraceLoggingUnicodeString(RegistryPath, "RegistryPath")
	);

	Log(LogLevel::Information, "DriverEntry called.Registry Path: %wZ\n", RegistryPath);

	RTL_OSVERSIONINFOW info;
	NTSTATUS status = RtlGetVersion(&info);
	if (!NT_SUCCESS(status)) {
		KdPrint(("Failed to get the version information (0x%08X)\n", status));
		return status;
	}

	InitializeListHead(&g_SysMonGlobals.ItemHead);
	g_SysMonGlobals.Mutex.Init();

	// Set an Unload routine
	DriverObject->DriverUnload = AntiRootkitUnload;
	// Set dispatch routine the driver supports
	// ��ͼ����ʱ
	DriverObject->MajorFunction[IRP_MJ_CREATE] = AntiRootkitCreateClose;
	// ��������ʱ
	DriverObject->MajorFunction[IRP_MJ_CLOSE] = AntiRootkitCreateClose;
	// �豸��������
	DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = AntiRootkitDeviceControl;
	DriverObject->MajorFunction[IRP_MJ_READ] = AntiRootkitRead;
	DriverObject->MajorFunction[IRP_MJ_WRITE] = AntiRootkitWrite;
	DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = AntiRootkitShutdown;

	// After the DriverUnload is been initialized, this is very important!
	status = g_State.Lock.Init();
	if (!NT_SUCCESS(status))
		return status;

	
	UNICODE_STRING devName = RTL_CONSTANT_STRING(L"\\Device\\AntiRootkit");
	// �������ʱ��ʼ����Щ����
	PDEVICE_OBJECT DeviceObject = nullptr;
	UNICODE_STRING symLink = RTL_CONSTANT_STRING(L"\\??\\AntiRootkit");
	bool symLinkCreated = false;