nt!IopInitializeBuiltinDriver函数分析创建驱动对象和初始化例程的运行
0: kd> dx -r1 -nv (*((ntkrnlmp!_DRIVER_OBJECT *)0x895c2b68))
(*((ntkrnlmp!_DRIVER_OBJECT *)0x895c2b68)) : Driver "" [Type: _DRIVER_OBJECT]
[+0x000] Type : 4 [Type: short]
[+0x002] Size : 168 [Type: short]
[+0x004] DeviceObject : 0x0 [Type: _DEVICE_OBJECT *]
[+0x008] Flags : 0x0 [Type: unsigned long]
[+0x00c] DriverStart : 0xf7727000 [Type: void *] //赋值了
[+0x010] DriverSize : 0x8000 [Type: unsigned long] //赋值了
[+0x014] DriverSection : 0x899c8d78 [Type: void *] //赋值了
[+0x018] DriverExtension : 0x895c2c10 [Type: _DRIVER_EXTENSION *]
[+0x01c] DriverName [Type: _UNICODE_STRING]
[+0x024] HardwareDatabase : 0x0 [Type: _UNICODE_STRING *]
[+0x028] FastIoDispatch : 0x0 [Type: _FAST_IO_DISPATCH *]
[+0x02c] DriverInit : 0xf772c000 [Type: long (*)(_DRIVER_OBJECT *,_UNICODE_STRING *)]
[+0x030] DriverStartIo : 0x0 [Type: void (*)(_DEVICE_OBJECT *,_IRP *)]
[+0x034] DriverUnload : 0x0 [Type: void (*)(_DRIVER_OBJECT *)]
[+0x038] MajorFunction [Type: long (* [28])(_DEVICE_OBJECT *,_IRP *)]
//
// Save the name of the driver so that it can be easily located by functions
// such as error logging.
//
buffer = ExAllocatePool( PagedPool, DriverName->MaximumLength + 2 );
if (buffer) {
driverObject->DriverName.Buffer = buffer;
driverObject->DriverName.MaximumLength = DriverName->MaximumLength;
driverObject->DriverName.Length = DriverName->Length;
RtlCopyMemory( driverObject->DriverName.Buffer,
DriverName->Buffer,
DriverName->MaximumLength );
buffer[DriverName->Length >> 1] = (WCHAR) '