NtWriteFile(INHANDLEINHANDLEEventINPIO_APC_ROUTINEApcRoutineINPVOIDApcContextOUTPIO_STATUS_BLOCKIoStatusBlock,INPVOIDBuffer,INULONGINRGE_INTEGERByteOffsetOPTIONAL,INPULONGKeyOPTIONAL){if(DeviceObject->Flags&{if{{Irp->AssociatedIrp.SystemBuffer=RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer,Buffer,Length);}{IopCleanupAfterException(FileObject,Irp,EventObject,_SEH2_YIELD(return}Irp->Flags=(IRP_BUFFERED_IO|}}elseif(DeviceObject->Flags&{if{{Mdl=IoAllocateMdl(Buffer,Length,FALSE,TRUE,Irp);MmProbeAndLockPages(Mdl,PreviousMode,}{IopCleanupAfterException(FileObject,Irp,EventObject,_SEH2_YIELD(return}}Irp->Flags=}}typedefstruct_MDL{//緩沖描述符struct_MDL*Next;//下一個MDL，用來構(gòu)成mdl鏈表CSHORTMdlFlags;struct_EPROCESS*ProcessPVOIDMappedSystemVa;//該段緩沖在映射在系統(tǒng)空間中的地址PVOIDStartVa;//虛擬地址（對齊4kb）;//}MDL,INULONGLength,INBOOLEANSecondaryBuffer,//指新的mdl是插入到指定irp的關聯(lián)mdl鏈表后面還是替換INBOOLEANChargeQuota,INPIRPIrp)//將新建的mdl插入或替換到這個irp的mdl{PMDLMdl=NULL,ULONGFlags=0;ULONGSize;if(Length>=2GB)returnSize=ADDRESS_AND_SIZE_TO_SPAN_PAGES(VirtualAddress,Length);if(Size23)//若超過了23個虛擬頁面，就采用實際占用的虛擬頁面數(shù){Size*=sizeof(PFN_NUMBER);Size+=sizeof(MDL);if(Size>MAXUSHORT)return}{Size=(23*sizeof(PFN_NUMBER))+sizeof(MDL);Flags|=MDL_ALLOCATED_FIXED_SIZE;Mdl=}if{Mdl=ExAllocatePoolWithTag(NonPagedPool,Size,TAG_MDL);if(!Mdl)returnNULL;}MmInitializeMdl(Mdl,VirtualAddress,Length);Mdl->MdlFlags|=Flags;if{ifSecondaryBuffermdl{p=Irp-while(p->Next)p=p->Next;p->Next=Mdl;}Else//替換原mdl為新的{Irp->MdlAddress=}}return}#defineMmInitializeMdl(_MemoryDescriptorList,_BaseVa,_Length){(_MemoryDescriptorList)->Next=(PMDL)NULL;\ (_MemoryDescriptorList)->Size=(CSHORT)(sizeof(MDL)+\(sizeof(PFN_NUMBER)*ADDRESS_AND_SIZE_TO_SPAN_PAGES(_BaseVa,_Length)));\(_MemoryDescriptorList)->MdlFlags=0;\(_MemoryDescriptorList)->StartVa=(PVOID)PAGE_ALIGN(_BaseVa);\(_MemoryDescriptorList)->ByteOffset=BYTE_OFFSET(_BaseVa);\(_MemoryDescriptorList)->ByteCount=(ULONG)_Length;\}#defineMmGetSystemAddressForMdl(Mdl)Mdl->MdlFlags&(MDL_MAPPED_TO_SYSTEM_VA|MDL_SOURCE_IS_NONPAGED_POOL)?Mdl->MappedSystemVa:MmMapLockedPagesVOIDIoMdl(PMDL{if(!(Mdl->MdlFlags&MDL_ALLOCATED_FIXED_SIZE))ExPoolWithTag(Mdl,TAG_MDL);}

IopMdlFromLookaside(Mdl,VOIDMmBuildMdlForNonPagedPool(INPMDLMdl){PPFN_NUMBERMdlPages,EndPage;PFN_NUMBERPfn,PageCount;PVOIDBase;PMMPTEMdl->Process=MdlPages=(PPFN_NUMBER)(Mdl+1);Base=Mdl->StartVa;Mdl->MappedSystemVa=(PVOID)((ULONG_PTR)Base+MdlCount=ADDRESS_AND_SIZE_TO_SPAN_PAGES(Mdl->MappedSystemVa,Mdl->ByteCount);