驱动函数分类

ExXxx()//暂定
IoXxx()//IO管理器
KeXxx()//目前理解过与同步相关
MmXxx()//内存相关
ObXxx()//驱动对象
PsXxx()//进程相关
RtlXxx()//与字符串相关
ZwXxx()//与文件 注册 进程相关
FltXxx()//文件过滤相关

NdisXxx()//Ndis过滤相关

ExAllocatePoolWithTag()ExAcquireFastMutex ExGetPreviousMode IoCreateDeviceIoCreateSymbolicLinkIoGetCurrentIrpStackLocationIoAttachDeviceToDeviceStackIoAllocateIrpIoSetCompletionRoutine KeWaitForSingleObjectKeSetEventKeInitializeEvent ObReferenceObjectByHandleObQueryNameString PsGetCurrentProcessPsGetCurrentProcessIdPsCreateSystemThreadPsLookupProcessByProcessId RtlZeroMemoryRtlInitUnicodeString ZwOpenKeyZwCreateFileZwOpenProcessZwQuerySystemInformation MmGetSystemRoutineAddressMmIsAddressValid