文章总结： 本文介绍编写Windows摄像头过滤驱动篡改图像输出的方法。详细解析了配置INF文件挂载驱动、实现内核函数拦截设备栈、处理IRP获取流参数及通过IOCTL修改帧缓冲区的全过程。实验成功将图像像素置零，展示了过滤驱动在底层系统干预与数据劫持中的实战应用。
综合评分： 86
文章分类： 二进制安全,安全开发,实战经验

写一个 Windows 摄像头过滤驱动篡改摄像头输出图像

原创

MyStackTrace

2025年11月30日 00:25
北京

Windows 的过滤驱动 (Filter Driver) 是一类非常特殊的 Windows 驱动，这类驱动本身是不能独立工作的，它们需要“附着”到现有驱动栈上才能工作。过滤驱动本身不管理硬件，而是像一个“中间人”或“过滤器”，拦截并处理发往目标设备的请求（IRP）和返回的数据。如果把普通的功能驱动比作公司的各个核心部门，负责核心业务，那么过滤驱动就像是公司内部的审计或者监控部门，它负责监控所有核心业务部门的业务，并对这些业务是否合法合规进行评估和修正。

Windows 过滤驱动是一种极其强大的技术，其应用范围非常广泛，它之所以重要，是因为它能在不修改原有核心驱动和硬件的前提下，为系统增加全新的功能层。Windows 过滤驱动在安全与隐私（杀毒软件，加密软件），功能增强（虚拟设备），系统监控（抓包，性能分析）等领域都有着广泛的应用。本文我们以 Windows 摄像头过滤驱动为例，来介绍一下如何写一个 Windows 过滤驱动，而且我会在这个过滤驱动中去篡改摄像头输出的图像。

不说废话了，下面我们就动手来写一下这个过滤驱动。首先是驱动的 INF 文件，不同于功能驱动的 INF 文件，过滤驱动需要在其 INF 文件中指明它想要“附着”的驱动类型。由于我们要写一个 Windows 摄像头驱动的过滤驱动，所以这个过滤驱动首先也必须是 Windows 摄像头驱动类别 (Class=Camera)，其次需要我们通过 AddReg 指明这个过滤驱动要是要附加在摄像头设备的驱动栈上（ca3e7ab9-b4c3-4ae6-8251-579ef933890f），而且这里指定的是 UpperFilters，也就是上层过滤驱动，附加在功能驱动之上，最靠近应用程序。上层过滤驱动是最先收到 IRP、最后收到IRP 完成通知的驱动，非常适合做这种数据监控或者篡改的操作。

;; CameraFilterDriver.inf;
[Version]Signature &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"$WINDOWS NT$"Class &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = CameraClassGuid &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}DriverPackageType &nbsp; = ClassFilterProvider &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= %PROVIDER%CatalogFile &nbsp; &nbsp; &nbsp; &nbsp; = CameraFilterDriver.catPnpLockdown &nbsp; &nbsp; &nbsp; &nbsp; = 1
[DestinationDirs]DefaultDestDir = 12
[SourceDisksNames]1 = %DiskId1%,,,"."
[SourceDisksFiles]CameraFilterDriver.sys = 1,,
[DefaultInstall.NTamd64]CopyFiles = @CameraFilterDriver.sysAddReg &nbsp; &nbsp;= CameraFilterDriver.AddReg
[DefaultUninstall.NTamd64]LegacyUninstall = 1DelFiles &nbsp;= CameraFilterDriver.DeleteFileSectionDelReg &nbsp; &nbsp;= CameraFilterDriver.DelReg
[CameraFilterDriver.DeleteFileSection]CameraFilterDriver.sys,,,0x00000001 &nbsp;; 0x00000001 (DELFLG_IN_USE)
[CameraFilterDriver.AddReg];Add CameraFilterDriver to UpperFiltersHKLM, System\CurrentControlSet\Control\Class\{ca3e7ab9-b4c3-4ae6-8251-579ef933890f}, UpperFilters, 0x00010008, CameraFilterDriver
[CameraFilterDriver.DelReg];Delete CameraFilterDriver from UpperFiltersHKLM, System\CurrentControlSet\Control\Class\{ca3e7ab9-b4c3-4ae6-8251-579ef933890f}, UpperFilters, 0x00018002, CameraFilterDriver
[DefaultInstall.NTamd64.Services]AddService = CameraFilterDriver,,Service.AddService
[DefaultUninstall.NTamd64.Services]LegacyUninstall = 1DelService = CameraFilterDriver,0x00000200
[Service.AddService]DisplayName &nbsp; &nbsp;= %CameraFilterDriver.SvcDesc%ServiceType &nbsp; &nbsp;= 1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; SERVICE_KERNEL_DRIVERStartType &nbsp; &nbsp; &nbsp;= 3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; SERVICE_DEMAND_STARTErrorControl &nbsp; = 2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; SERVICE_ERROR_SEVEREServiceBinary &nbsp;= %12%\CameraFilterDriver.sys
[Strings]PROVIDER =&nbsp;"CameraFilterDriver"StdMfg =&nbsp;"CameraFilterDriver Developers"DiskId1 =&nbsp;"CameraFilterDriver Installation Disk #1"CameraFilterDriver.DeviceDesc =&nbsp;"CameraFilterDriver Filter Driver"CameraFilterDriver.SvcDesc =&nbsp;"CameraFilterDriver

下面介绍过滤驱动代码部分，首先是 DriverEntry 函数。这里的驱动入口函数和普通的 WDM 驱动的写法没有区别，基本上就是提供 Windows 设备驱动的几个重要的派遣函数（Dispatch Function）。我们先用函数 DefaultDispatchFunction 把所有的派遣函数指针填一遍作为默认的派遣函数，然后针对 IRP_MJ_CREATE，IRP_MJ_DEVICE_CONTROL，IRP_MJ_POWER 和 IRP_MJ_PNP 设置不同的派遣函数，对这些 IRP 进行一些特别的处理。我们重点实现的函数有 AddDevice 回调函数，处理 IRP_MJ_CREATE 的派遣函数 DispatchCreate 和处理 IRP_MJ_DEVICE_CONTROL 的派遣函数

DispatchDeviceControl。

NTSTATUS&nbsp;DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath){&nbsp; &nbsp; WPP_INIT_TRACING(DriverObject, RegistryPath);&nbsp; &nbsp; DriverObject->DriverExtension->AddDevice = AddDevice;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;for&nbsp;(int&nbsp;i =&nbsp;0; i < IRP_MJ_MAXIMUM_FUNCTION +&nbsp;1; i++)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; DriverObject->MajorFunction[i] = DefaultDispatchFunction;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;&nbsp; &nbsp; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;&nbsp; &nbsp; DriverObject->MajorFunction[IRP_MJ_POWER] = DispatchPower;&nbsp; &nbsp; DriverObject->MajorFunction[IRP_MJ_PNP] = DispatchPnp;&nbsp; &nbsp; DriverObject->DriverUnload = DriverUnload;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;STATUS_SUCCESS;}

AddDevice 回调函数的作用是为过滤驱动创建过滤设备对象，并且调用 Windows 内核 API 函数 IoAttachDeviceToDeviceStack 将我们自己创建的过滤驱动设备对象（Filter Device Object）附加到目标设备的功能驱动设备对象（Functional Device Object, FDO）所在的设备栈（Device Stack）上，从而使我们的驱动能够拦截发往该目标设备的所有 I/O 请求。这里需要记住的是 NextDeviceObject，这就是过滤驱动所附着的驱动栈的下一层驱动对应的 FDO，后面我们需要把所有的 I/O 请求转发给这个 NextDeviceObject。

NTSTATUS AddDevice(IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT PhysicalDeviceObject){&nbsp; &nbsp; PDEVICE_EXTENSION devExt =&nbsp;NULL;&nbsp; &nbsp; PDEVICE_OBJECT devObj =&nbsp;NULL;&nbsp; &nbsp; WCHAR szTmpInfo[512];&nbsp; &nbsp; ULONG cbTmpInfoSize =&nbsp;0;&nbsp; &nbsp; NTSTATUS status = STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoCreateDevice(DriverObject,&nbsp;sizeof(DEVICE_EXTENSION),&nbsp;NULL,&nbsp; &nbsp; &nbsp; &nbsp; GetDeviceTypeToUse(PhysicalDeviceObject),&nbsp;0,&nbsp;FALSE, &devObj);&nbsp; &nbsp;&nbsp;if&nbsp;(NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; devExt = devObj->DeviceExtension;&nbsp; &nbsp; &nbsp; &nbsp; devExt->DeviceObject = devObj;&nbsp; &nbsp; &nbsp; &nbsp; devExt->NextDeviceObject = IoAttachDeviceToDeviceStack(devObj,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PhysicalDeviceObject);&nbsp; &nbsp; &nbsp; &nbsp; devObj->Flags |= devExt->NextDeviceObject->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DO_POWER_PAGABLE);&nbsp; &nbsp; &nbsp; &nbsp; devObj->Flags &= ~DO_DEVICE_INITIALIZING;&nbsp; &nbsp; &nbsp; &nbsp; devObj->DeviceType = devExt->NextDeviceObject->DeviceType;&nbsp; &nbsp; &nbsp; &nbsp; devObj->Characteristics = devExt->NextDeviceObject->Characteristics;&nbsp; &nbsp; &nbsp; &nbsp; IoInitializeRemoveLock(&devExt->RemoveLock, POOL_TAG,&nbsp;0,&nbsp;0);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(NT_SUCCESS(IoGetDeviceProperty(PhysicalDeviceObject, DevicePropertyFriendlyName,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;512&nbsp;*&nbsp;sizeof(WCHAR), szTmpInfo, (PULONG)&cbTmpInfoSize)))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, device name: %ws", szTmpInfo);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;status;}

在 DriverEntry 中我们给大部分 IRP 类型都设置了一个默认的派遣函数：DefaultDispatchFunction。对于这些类型的 IRP ，我们的过滤驱动是不关心的，所以仅仅是把这些 IRP 传给给下层驱动。核心函数就两个，第一个是 IoSkipCurrentIrpStackLocation，这个函数的作用是告诉内核：“这个 IRP 不是我关心的，我只是过一下手，什么都不改，也不需要知道它什么时候完成，直接让下一层驱动去处理吧。”。第二个核心函数是 IoCallDriver，这才是真正把这个 IRP 发给下一层驱动去处理的操作，所以这里需要指定下一层驱动的 FDO （NextDeviceObject）。

NTSTATUS&nbsp;DefaultDispatchFunction(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp){&nbsp; &nbsp;&nbsp;NTSTATUS&nbsp;status&nbsp;=&nbsp;STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;PDEVICE_EXTENSION&nbsp;devExt&nbsp;=&nbsp;DeviceObject->DeviceExtension;&nbsp; &nbsp;&nbsp;PIO_STACK_LOCATION&nbsp;irpStack&nbsp;=&nbsp;IoGetCurrentIrpStackLocation(Irp);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry, MajorFunction=%u, MinorFunction=%u, "&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"IoControlCode=%x", irpStack->MajorFunction, irpStack->MinorFunction,&nbsp; &nbsp; &nbsp; &nbsp; irpStack->Parameters.DeviceIoControl.IoControlCode);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoAcquireRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(!NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; IoSkipCurrentIrpStackLocation(Irp);&nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);
done:&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit, status=%x", status);&nbsp; &nbsp;&nbsp;return&nbsp;status;}

当用户态的摄像头应用程序打开摄像头的时候会给摄像头驱动发送 IRP_MJ_CREATE 类型的 IRP，我们的过滤驱动是第一个接收到这个 IRP 的驱动，我们要做的就是从这个 IRP 上获取摄像头应用程序设置的摄像头的参数，比如图像格式，分辨率，像素位宽等参数。由于这个 IRP 中有些内容是需要下层驱动填写的，因此我们需要等到下层驱动完成这个 IRP 的时候才能去获取上面的信息。所以这里我们的做法是调用内核 API 函数 IoSetCompletionRoutine 为这个 IRP 设置一个完成函数 DefaultIrpCompletion，然后通过 IoCopyCurrentIrpStackLocationToNext 和 IoCallDriver 的配合把这个 IRP 转发给下层驱动，接下来过滤驱动就等在一个 KEVENT 上，当下层驱动完成这个 IRP 的时候就会调用我们设置的IRP 完成函数 DefaultIrpCompletion，在这个完成函数中我们会通过 KEVENT 唤醒过滤驱动前面的等待，过滤驱动就知道这个 IRP 完成了，就可以放心的从这个 IRP 上获取我们关心的参数了。注意：这里我们把 IRP 转发给下层驱动用的是 IoCopyCurrentIrpStackLocationToNext 函数，这个函数的作用是告诉内核：“这个IRP我要仔细经手，我需要把我的参数复制给下一层，并且等下一层处理完后，我必须亲自检查一下结果。”，对比 IoSkipCurrentIrpStackLocation 和 IoCopyCurrentIrpStackLocationToNext 这两个函数的行为，大家应该能品出过滤驱动对于自己不关心的 IRP 和关心的 IRP 的处理逻辑的区别。

NTSTATUS DefaultIrpCompletion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context){&nbsp; &nbsp; UNREFERENCED_PARAMETER(DeviceObject);&nbsp; &nbsp; PKEVENT event = (PKEVENT)Context;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;if&nbsp;(Irp->PendingReturned == TRUE)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; KeSetEvent(event, IO_NO_INCREMENT, FALSE);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit");&nbsp; &nbsp;&nbsp;return&nbsp;STATUS_MORE_PROCESSING_REQUIRED;}
NTSTATUS DispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp){&nbsp; &nbsp; NTSTATUS status = STATUS_SUCCESS;&nbsp; &nbsp; PDEVICE_EXTENSION devExt = DeviceObject->DeviceExtension;&nbsp; &nbsp; PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoAcquireRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(!NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; KEVENT event;&nbsp; &nbsp; KeInitializeEvent(&event, NotificationEvent, FALSE);&nbsp; &nbsp; IoCopyCurrentIrpStackLocationToNext(Irp);&nbsp; &nbsp; IoSetCompletionRoutine(Irp, DefaultIrpCompletion, &event, TRUE, TRUE, TRUE);&nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(status == STATUS_PENDING)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; status = KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;if&nbsp;(irpStack->FileObject->FileName.Buffer)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Create&nbsp;%ws", irpStack->FileObject->FileName.Buffer);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(irpStack->FileObject->FileName.Length < wcslen(KSSTRING_Pin) * sizeof(WCHAR) +&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sizeof(KSPIN_CONNECT) + sizeof(KS_DATAFORMAT_VIDEOINFOHEADER))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; wchar_t *ksPinNameOffset = wcsstr(irpStack->FileObject->FileName.Buffer, KSSTRING_Pin);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!ksPinNameOffset)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; PKSPIN_CONNECT ksPinConnect = (PKSPIN_CONNECT)(ksPinNameOffset + wcslen(KSSTRING_Pin) +&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Ks PinId:&nbsp;%lu", ksPinConnect->PinId);&nbsp; &nbsp; &nbsp; &nbsp; PKSDATAFORMAT &nbsp;ksDataFormat = (PKSDATAFORMAT)(ksPinConnect +&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Ks Data Format: Specifier=%!GUID!, MajorFormat=%!GUID!, SubFormat=%!GUID!",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &ksDataFormat->Specifier, &ksDataFormat->MajorFormat, &ksDataFormat->SubFormat);&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Ks Data Format: Alignment=%lld, Flags=%x, FormatSize=%lu, SampleSize=%lu",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ksDataFormat->Alignment, ksDataFormat->Flags, ksDataFormat->FormatSize, ksDataFormat->SampleSize);&nbsp; &nbsp; &nbsp; &nbsp; const GUID g_KSDATAFORMAT_SPECIFIER_VIDEOINFO = { STATIC_KSDATAFORMAT_SPECIFIER_VIDEOINFO };&nbsp; &nbsp; &nbsp; &nbsp; const GUID g_KSDATAFORMAT_SPECIFIER_VIDEOINFO2 = { STATIC_KSDATAFORMAT_SPECIFIER_VIDEOINFO2 };&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(IsEqualGUID(&ksDataFormat->Specifier, &g_KSDATAFORMAT_SPECIFIER_VIDEOINFO))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PKS_DATAFORMAT_VIDEOINFOHEADER videoInfoHeader = (PKS_DATAFORMAT_VIDEOINFOHEADER)(ksPinConnect +&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(videoInfoHeader)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Video Info Header: Width=%d, Height=%d, BitCount=%u, Size=%u, SizeImage=%u",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader.bmiHeader.biWidth,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader.bmiHeader.biHeight,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader.bmiHeader.biBitCount,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader.bmiHeader.biSize,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader.bmiHeader.biSizeImage);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp;if&nbsp;(IsEqualGUID(&ksDataFormat->Specifier, &g_KSDATAFORMAT_SPECIFIER_VIDEOINFO2))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PKS_DATAFORMAT_VIDEOINFOHEADER2 videoInfoHeader = (PKS_DATAFORMAT_VIDEOINFOHEADER2)(ksPinConnect +&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(videoInfoHeader)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Video Info Header2: Width=%d, Height=%d, BitCount=%u, Size=%u, SizeImage=%u",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader2.bmiHeader.biWidth,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader2.bmiHeader.biHeight,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader2.bmiHeader.biBitCount,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader2.bmiHeader.biSize,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; videoInfoHeader->VideoInfoHeader2.bmiHeader.biSizeImage);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Unknown KS data format specifier");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);done:&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit, status=%x", status);&nbsp; &nbsp;&nbsp;return&nbsp;status;}

在现代 Windows 系统中，摄像头驱动基于 AVStream （音视频流）内核驱动模型构建。AVStream 与 Windows 的 Kernel Streaming （内核流）架构紧密集成，高效管理视频数据流。因此这里我们需要首先了解 AVStream 驱动框架，然后才能知道如何从 IRP_MJ_CREATE 类型的 IRP 中提取摄像头相关的参数，这里就不介绍细节了，感兴趣的同学可以结合 MSDN 上对 AVStream 驱动框架的介绍来理解上面从 IRP 中提取摄像头参数的代码。

当摄像头被应用程序打开之后，应用程序会调用摄像头驱动的 DeviceIoControl 给摄像头发送帧缓冲区（Frame Buffer），摄像头驱动会控制摄像头硬件填充这个帧缓冲区，最后再把这个帧缓冲区送回给应用程序。我们的过滤驱动需要做的就是拦截这个 DeviceIoControl，获取并记录每一个帧缓冲区，并且在这些帧缓冲区被下层驱动返上来的时候去篡改其中的图像数据。具体实现就在下面这几个函数中。在众多的 DeviceIoControl 的操作码中，我们需要关注的是 IOCTL_KS_READ_STREAM，这就是负责给摄像头驱动传递帧缓冲区的操作。简单来说我们需要从 IOCTL_KS_READ_STREAM 的 IRP 上获取 KSSTREAM_HEADER，然后从 KSSTREAM_HEADER 上获取帧缓冲区的地址（streamHeader->Data），并且通过一个 MDL 把这个帧缓冲区给锁定在内核。由于我们需要关注这个 IOCTL_KS_READ_STREAM IRP 的完成，因此为其设置了 IRP 完成函数 HandleKSReadStreamDone，并且给这个 IRP 指定了一个参数，就是那个锁定帧缓冲区的 MDL，通过这个 MDL 我们后面就能找到并访问对应的帧缓冲区。当摄像头硬件填充完帧缓冲区之后，下层驱动就会把这个 IRP 给完成了，这个时候就会调用到 HandleKSReadStreamDone，我们在这个函数中从前面传递的参数，也就是那个锁定帧缓冲区的 MDL 上获取到帧缓冲区的地址，并且把帧缓冲区中的前面 200 行像素给填成 0，如果摄像头应用程序选择的是 YUV 的输出格式，这里会把前面 200 行像素的 Y 分量给清零，在最终的图像上我们会看到前面 200 行都是绿色的。

NTSTATUS&nbsp;HandleKSReadStreamDone(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, PVOID Context){&nbsp; &nbsp;&nbsp;PDEVICE_EXTENSION&nbsp;devExt&nbsp;=&nbsp;(PDEVICE_EXTENSION)DeviceObject->DeviceExtension;&nbsp; &nbsp;&nbsp;PMDL&nbsp;mdl&nbsp;=&nbsp;(PMDL)Context;&nbsp; &nbsp;&nbsp;PVOID&nbsp;dataBuffer&nbsp;=&nbsp;NULL;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;if&nbsp;(Irp->PendingReturned)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; IoMarkIrpPending(Irp);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;PKSSTREAM_HEADER&nbsp;streamHeader&nbsp;=&nbsp;(PKSSTREAM_HEADER)Irp->AssociatedIrp.SystemBuffer;&nbsp; &nbsp;&nbsp;if&nbsp;(streamHeader == NULL)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_ERROR,&nbsp;"%!FUNC!, Stream header is NULL");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;PKS_FRAME_INFO&nbsp;frameInfo&nbsp;=&nbsp;(PKS_FRAME_INFO)((PBYTE)streamHeader + sizeof(KSSTREAM_HEADER));&nbsp; &nbsp;&nbsp;if&nbsp;(mdl != NULL)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; dataBuffer = MmGetSystemAddressForMdlSafe(mdl, NormalPagePriority);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(frameInfo->lSurfacePitch)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// This is just an experiment to override the first 200 lines of the frame&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memset(dataBuffer,&nbsp;0, frameInfo->lSurfacePitch *&nbsp;200);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Data=%p, DataUsed=%lu, FrameSize=%lu OptionsFlags=%x, "&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"SurfacePitch=%ld, MDL=%p, dataBuffer=%p", streamHeader->Data, streamHeader->DataUsed,&nbsp; &nbsp; &nbsp; &nbsp; streamHeader->FrameExtent, streamHeader->OptionsFlags, frameInfo->lSurfacePitch, mdl,&nbsp; &nbsp; &nbsp; &nbsp; dataBuffer);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;if&nbsp;(mdl != NULL)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; MmUnlockPages(mdl);&nbsp; &nbsp; &nbsp; &nbsp; IoFreeMdl(mdl);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);done:&nbsp; &nbsp;&nbsp;return&nbsp;STATUS_CONTINUE_COMPLETION;}
PMDL&nbsp;GetMdlFromKsStreamHeader(PDEVICE_OBJECT DeviceObject, PIRP Irp){&nbsp; &nbsp; UNREFERENCED_PARAMETER(DeviceObject);&nbsp; &nbsp;&nbsp;NTSTATUS&nbsp;status&nbsp;=&nbsp;STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;PIO_STACK_LOCATION&nbsp;irpStack&nbsp;=&nbsp;IoGetCurrentIrpStackLocation(Irp);&nbsp; &nbsp;&nbsp;ULONG&nbsp;inBufLength&nbsp;=&nbsp;irpStack->Parameters.DeviceIoControl.InputBufferLength;&nbsp; &nbsp;&nbsp;ULONG&nbsp;outBufLength&nbsp;=&nbsp;irpStack->Parameters.DeviceIoControl.OutputBufferLength;&nbsp; &nbsp;&nbsp;PVOID&nbsp;userBuffer&nbsp;=&nbsp;Irp->UserBuffer;&nbsp; &nbsp;&nbsp;PMDL&nbsp;mdl&nbsp;=&nbsp;NULL;
&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, userBuffer=%p, inBufLength=%lu, outBufLength=%lu",&nbsp; &nbsp; &nbsp; &nbsp; userBuffer, inBufLength, outBufLength);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;PKSSTREAM_HEADER&nbsp;streamHeader&nbsp;=&nbsp;(PKSSTREAM_HEADER)userBuffer;&nbsp; &nbsp;&nbsp;if&nbsp;(streamHeader == NULL)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_ERROR,&nbsp;"[ERROR] %!FUNC!, Stream header is NULL");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_INVALID_PARAMETER;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, KSSTREAM_HEADER: Data=%p, FrameExtent=%lu, OptionsFlags=%x",&nbsp; &nbsp; &nbsp; &nbsp; streamHeader->Data, streamHeader->FrameExtent, streamHeader->OptionsFlags);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;PKS_FRAME_INFO&nbsp;frameInfo&nbsp;=&nbsp;(PKS_FRAME_INFO)(streamHeader +&nbsp;1);&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, KS_FRAME_INFO: SurfacePitch=%d", frameInfo->lSurfacePitch);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; mdl = IoAllocateMdl(streamHeader->Data, streamHeader->FrameExtent, FALSE, TRUE, NULL);&nbsp; &nbsp;&nbsp;if&nbsp;(!mdl)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_INSUFFICIENT_RESOURCES;&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Allocate MDL failed");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;try&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; MmProbeAndLockPages(mdl, UserMode, IoWriteAccess);&nbsp; &nbsp; }&nbsp; &nbsp; except(EXCEPTION_EXECUTE_HANDLER)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; status = GetExceptionCode();&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Exception while locking data buffer 0X%08X in METHOD_NEITHER", status);&nbsp; &nbsp; &nbsp; &nbsp; IoFreeMdl(mdl);&nbsp; &nbsp; &nbsp; &nbsp; mdl = NULL;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Ks Read Stream MDL=%p", mdl);done:&nbsp; &nbsp;&nbsp;return&nbsp;mdl;}
NTSTATUS&nbsp;DispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp){&nbsp; &nbsp;&nbsp;NTSTATUS&nbsp;status&nbsp;=&nbsp;STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;PDEVICE_EXTENSION&nbsp;devExt&nbsp;=&nbsp;(PDEVICE_EXTENSION)DeviceObject->DeviceExtension;&nbsp; &nbsp;&nbsp;PIO_STACK_LOCATION&nbsp;irpStack&nbsp;=&nbsp;IoGetCurrentIrpStackLocation(Irp);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoAcquireRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(!NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;switch&nbsp;(irpStack->Parameters.DeviceIoControl.IoControlCode)&nbsp; &nbsp; {&nbsp; &nbsp;&nbsp;case&nbsp;IOCTL_KS_READ_STREAM:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;PMDL&nbsp;mdl&nbsp;=&nbsp;GetMdlFromKsStreamHeader(DeviceObject, Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoMarkIrpPending(Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoCopyCurrentIrpStackLocationToNext(Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoSetCompletionRoutine(Irp, HandleKSReadStreamDone, (PVOID)mdl, TRUE, TRUE, TRUE);&nbsp; &nbsp; &nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;status;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;default:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; IoSkipCurrentIrpStackLocation(Irp);&nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);
done:&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit, status=%x", status);&nbsp; &nbsp;&nbsp;return&nbsp;status;}

剩下的函数就不详细介绍了，代码我贴在下面。

NTSTATUS&nbsp;DispatchPower(PDEVICE_OBJECT DeviceObject, PIRP Irp){&nbsp; &nbsp;&nbsp;NTSTATUS&nbsp;status&nbsp;=&nbsp;STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;PDEVICE_EXTENSION&nbsp;devExt&nbsp;=&nbsp;(PDEVICE_EXTENSION)DeviceObject->DeviceExtension;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Entry");&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoAcquireRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(!NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; IoSkipCurrentIrpStackLocation(Irp);&nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);
done:&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC! Exit, status=%x", status);&nbsp; &nbsp;&nbsp;return&nbsp;status;}
NTSTATUS&nbsp;DispatchPnp(PDEVICE_OBJECT DeviceObject, PIRP Irp){&nbsp; &nbsp;&nbsp;NTSTATUS&nbsp;status&nbsp;=&nbsp;STATUS_SUCCESS;&nbsp; &nbsp;&nbsp;PDEVICE_EXTENSION&nbsp;devExt&nbsp;=&nbsp;DeviceObject->DeviceExtension;&nbsp; &nbsp;&nbsp;PIO_STACK_LOCATION&nbsp;irpStack&nbsp;=&nbsp;IoGetCurrentIrpStackLocation(Irp);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!+, MajorFunction=%u, MinorFunction=%u, IoControlCode=%x",&nbsp; &nbsp; &nbsp; &nbsp; irpStack->MajorFunction, irpStack->MinorFunction, irpStack->Parameters.DeviceIoControl.IoControlCode);&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; status = IoAcquireRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp;&nbsp;if&nbsp;(!NT_SUCCESS(status))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;switch&nbsp;(irpStack->MinorFunction)&nbsp; &nbsp; {&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_START_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Start device");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; KEVENT event;&nbsp; &nbsp; &nbsp; &nbsp; KeInitializeEvent(&event, NotificationEvent, FALSE);&nbsp; &nbsp; &nbsp; &nbsp; IoCopyCurrentIrpStackLocationToNext(Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoSetCompletionRoutine(Irp, DefaultIrpCompletion, &event, TRUE, TRUE, TRUE);&nbsp; &nbsp; &nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(status == STATUS_PENDING)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; status = Irp->IoStatus.Status;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(NT_SUCCESS(status))&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(devExt->NextDeviceObject->Characteristics & FILE_REMOVABLE_MEDIA)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DeviceObject->Characteristics |= FILE_REMOVABLE_MEDIA;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; &nbsp; &nbsp; IoCompleteRequest(Irp, IO_NO_INCREMENT);&nbsp; &nbsp; &nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_REMOVE_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Remove device");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; IoReleaseRemoveLockAndWait(&devExt->RemoveLock, Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoSkipCurrentIrpStackLocation(Irp);&nbsp; &nbsp; &nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; &nbsp; &nbsp; IoDetachDevice(devExt->NextDeviceObject);&nbsp; &nbsp; &nbsp; &nbsp; devExt->NextDeviceObject = NULL;&nbsp; &nbsp; &nbsp; &nbsp; IoDeleteDevice(DeviceObject);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;done;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_QUERY_STOP_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Query stop device");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_CANCEL_STOP_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Cancel stop device");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_STOP_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Stop device");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_QUERY_REMOVE_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Query remove device");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_SURPRISE_REMOVAL:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Surprise removal");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;case&nbsp;IRP_MN_CANCEL_REMOVE_DEVICE:&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!, Cancel remove device");&nbsp; &nbsp; &nbsp; &nbsp; status = STATUS_SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;default:&nbsp; &nbsp; &nbsp; &nbsp; status = Irp->IoStatus.Status;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; Irp->IoStatus.Status = status;&nbsp; &nbsp; IoSkipCurrentIrpStackLocation(Irp);&nbsp; &nbsp; status = IoCallDriver(devExt->NextDeviceObject, Irp);&nbsp; &nbsp; IoReleaseRemoveLock(&devExt->RemoveLock, Irp);
done:&nbsp; &nbsp; Trace(TRACE_INFO,&nbsp;"%!FUNC!-, status=%x", status);&nbsp; &nbsp;&nbsp;return&nbsp;status;}
void&nbsp;DriverUnload(PDRIVER_OBJECT DriverObject){&nbsp; &nbsp; WPP_CLEANUP(DriverObject);}

下面是驱动的头文件的内容，主要是定义了 DEVICE_EXTENSION 结构。

#ifndef&nbsp;_DRIVER_H_#define&nbsp;_DRIVER_H_#include&nbsp;<wdm.h>#include&nbsp;<windef.h>#include&nbsp;<ks.h>#include&nbsp;<ksmedia.h>
typedef&nbsp;struct&nbsp;_DEVICE_EXTENSION{&nbsp; &nbsp; PDEVICE_OBJECT DeviceObject;&nbsp; &nbsp; PDEVICE_OBJECT NextDeviceObject;&nbsp; &nbsp; IO_REMOVE_LOCK RemoveLock;} DEVICE_EXTENSION, *PDEVICE_EXTENSION;
#define&nbsp;POOL_TAG 'FMAC'
#endif&nbsp;// _DRIVER_H_

最后我们来看看把这个驱动安装上的效果，我把这个驱动安装到我的虚拟中的 USB 摄像头上，就是前面使用 QEMU 模拟的那个 USB 摄像头。下面是我们在设备管理器中查看摄像头驱动的情况，这里可以看到除了微软的 USB 摄像头驱动之外，还多了我们的 CameraFilterDriver.sys。

查看摄像头设备的 Device stack，可以看到我们的 CameraFilterDriver 是在最上层的，因为我们添加的是上层过滤驱动（UpperFilters），这里显示的很直观吧。

最后来看看打开摄像头应用程序的效果，可以看到摄像头输出的图像最上面一大片都是绿色的，这就是我们覆盖的那 200 行 0 （Y分量）。

下面是在 Windows Hello 中看到的红外相机的出图效果，由于红外相机出的图是只有 Y 分量的灰度图，全零表示的是黑色，所以这里图像的上方会出现一大片黑色。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：MyStackTrace MyStackTrace《写一个 Windows 摄像头过滤驱动篡改摄像头输出图像》

Tags: 二进制安全安全开发实战经验

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)