typedef struct _FOO_DEVICE_EXTENSION {
ULONG Information;

} FOO_DEVICE_EXTENSION, *PFOO_DEVICE_EXTENSION;

// Function declarations

NTSTATUS
_declspec( dllimport )DoSomethingMeaningless(IN PIRP pIrp, IN PIO_STACK_LOCATION pIrpStack );

NTSTATUS
DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
{
        UNICODE_STRING nameString, linkString;
        PDEVICE_OBJECT deviceObject;
        NTSTATUS status;

        //slave.sys needs to start before master.sys
        // Create the device object.

        RtlInitUnicodeString( &nameString, L "\\Device\\MASTER");
        status = IoCreateDevice( DriverObject,
                sizeof(FOO_DEVICE_EXTENSION),
                 &nameString,
                FILE_DEVICE_UNKNOWN,
                0,
                FALSE,
                &deviceObject );

        if (!NT_SUCCESS( status ))
                return status;

        // Create the symbolic link.

        RtlInitUnicodeString( &linkString, L"\\DosDevices\\MASTER") );
        status = IoCreateSymbolicLink (&linkString, &nameString);

        if (!NT_SUCCESS( status )) {

        IoDeleteDevice (DriverObject->DeviceObject);
        return status;
        }

        // Initialize the driver object with this device driver's entry points.

        DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = MasterDispatchIoctl;
        return STATUS_SUCCESS;

}

NTSTATUS
MasterDispatchIoctl( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp )
{
        NTSTATUS                                  status;
        PIO_STACK_LOCATION          irpSp;

        // Init to default settings- we only expect 1 type of
        // IOCTL to roll through here, all others an error.

        Irp->IoStatus.Status = STATUS_SUCCESS;
        Irp->IoStatus.Information = 0;

        // Get a pointer to the current location in the Irp. This is where
        // the function codes and parameters are located.

        irpSp = IoGetCurrentIrpStackLocation( Irp );

        switch (irpSp->Parameters.DeviceIoControl.IoControlCode) {

                case IOCTL_CALL_KERNEL_MODE_DLL:

                        if ( NT_SUCCESS( DoSomethingMeaningless( Irp , irpSp) ) ) {
                                status = STATUS_SUCCESS;
                        }
                        else
                                status = STATUS_INVALID_PARAMETER;
                    break;

                default:
                                Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;

                    break;
        }

        // DON'T get cute and try to use the status field of
        // the irp in the return status. That IRP IS GONE as
        // soon as you call IoCompleteRequest.

        IoCompleteRequest(Irp, IO_NO_INCREMENT);

        // We never have pending operation so always return the status code.

        return status;

Both the driver and DLL are copied into the \%SystemRoot%\system32\drivers directory. I created a file called test.ini (Figure 7) and used the regini.exe utility in the DDK to update the registry. I was advised that the DLL should be loaded before the driver. Therefore, I set the Tag value accordingly so that the DLL would start before the driver when the group started.

int main ( void )
{
    HANDLE hDriver;
    DWORD cbReturned = 0x0;
    WORD iobuf = 0x0;

    // Try to open the device

    if ((hDriver = CreateFile("\\\.\\MASTER",
                        GENERIC_READ | GENERIC_WRITE,
                        0,
                        NULL,
                        OPEN_EXISTING,
                        FILE_ATTRIBUTE_NORMAL,
                        NULL )) != INVALID_HANDLE_VALUE )

            printf ("\nRetrieved valid handle for MASTER driver\n");

        else
    {
        printf ("Can't get a handle to MASTER driver\n");
        return 0;
    }

    // iobuf initialized to zero, so we better get something different after call.

    if ( DeviceIoControl (hDriver,
                        (DWORD) IOCTL_CALL_KERNEL_MODE_DLL,
                        &iobuf,
                        (DWORD)(2*(sizeof (WORD))),
                        &iobuf,
                        (DWORD)(2*(sizeof (WORD))),
                        &cbReturned,
                        (LPVOID)NULL) )
    {

        if (iobuf == 0xAA55) {
                        printf("DeviceIoControl worked and returned the correct value.\n");
        } else {
                        printf("DeviceIoControl worked but reurned the wrong value %x\n", iobuf);
        }
    } else {
                    printf("DeviceIoControl Failed\n");
    }

    CloseHandle(hDriver);