VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject) 
{
	PDEVICE_OBJECT	pNextObj;
	KdPrint(("DriverB:Enter B DriverUnload\n"));
	pNextObj = pDriverObject->DeviceObject;

	while (pNextObj != NULL) 
	{
		PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
			pNextObj->DeviceExtension;

		//删除符号链接
		UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
		IoDeleteSymbolicLink(&pLinkName);
		pNextObj = pNextObj->NextDevice;
		IoDeleteDevice( pDevExt->pDevice );
	}
	KdPrint(("DriverB:Enter B DriverUnload\n"));
}

static
VOID 
NTAPI
driver_unload(IN PDRIVER_OBJECT DriverObject)
{
	WCHAR               deviceLinkBuffer[]  = L"\\DosDevices\\"CO_DRIVER_NAME;
	UNICODE_STRING      deviceLinkUnicodeString;
	co_manager_t        *manager;

	manager = DriverObject->DeviceObject->DeviceExtension;
	if (manager) {
		co_manager_unload(manager);
	}

	RtlInitUnicodeString(&deviceLinkUnicodeString, deviceLinkBuffer);

	IoDeleteSymbolicLink(&deviceLinkUnicodeString);
	IoDeleteDevice(DriverObject->DeviceObject);
}

VOID BBUnload( IN PDRIVER_OBJECT DriverObject )
{
    UNICODE_STRING deviceLinkUnicodeString;

    // Unregister notification
    PsSetCreateProcessNotifyRoutine( BBProcessNotify, TRUE );

    // Cleanup physical regions
    BBCleanupProcessPhysList();

    // Cleanup process mapping info
    BBCleanupProcessTable();

    RtlUnicodeStringInit( &deviceLinkUnicodeString, DOS_DEVICE_NAME );
    IoDeleteSymbolicLink( &deviceLinkUnicodeString );
    IoDeleteDevice( DriverObject->DeviceObject );

    return;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DrvObj, PUNICODE_STRING RegPath)
{
	PDEVICE_OBJECT DevObj;
	NTSTATUS status;

	status = IoCreateDevice(DrvObj, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN,
	                        FALSE, &DevObj);
	if(NT_SUCCESS(status)) {
		status = IoCreateSymbolicLink (&deviceLink, &deviceName);
		DrvObj->MajorFunction[IRP_MJ_CREATE] = DtraceOpen;
		DrvObj->MajorFunction[IRP_MJ_CLOSE] = DtraceClose;
		DrvObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DtraceIoctl;
		DrvObj->DriverUnload  = DtraceUnload;
	}
	if (!NT_SUCCESS(status)) {
		IoDeleteSymbolicLink(&deviceLink);
		if(DevObj)
			IoDeleteDevice( DevObj);
		return status;
	}
	status = IoCreateSymbolicLink(&deviceHelperLink, &deviceName);
	if (!NT_SUCCESS(status))
		dprintf("DriverEntry: dtrace helper creation failed\n");
		
	DtraceGetSystemHertz();
	DtraceWinOSKernelModuleInfo();
	DtraceWinOSInitFunctions();
	if (DtraceWinOSHackData() == 0)
		dprintf("DriverEntry: DtraceWinOSPortData() hack data failure\n");
	
	if (PsSetLoadImageNotifyRoutine(ProcKernelModuleLoaded) != STATUS_SUCCESS) 
		dprintf("DriverEntry: failed to register PsSetLoadImageNotifyRoutine\n");
	

	WorkItem1 = IoAllocateWorkItem(DevObj);
	WorkItem2 = IoAllocateWorkItem(DevObj);

	int_morecore();
	
	(void) dtrace_load((void *) RegPath);

	return status;
}

VOID
ParUnload(
    IN  PDRIVER_OBJECT  DriverObject
)

/*++

Routine Description:

    This routine loops through the device list and cleans up after
    each of the devices.

Arguments:

    DriverObject    - Supplies the driver object.

Return Value:

    None.

--*/

{
    PDEVICE_OBJECT                      currentDevice;
    PDEVICE_EXTENSION                   extension;
    KEVENT                              event;
    PARALLEL_INTERRUPT_SERVICE_ROUTINE  interruptService;
    PIRP                                irp;
    IO_STATUS_BLOCK                     ioStatus;

    while (currentDevice = DriverObject->DeviceObject) {

        extension = currentDevice->DeviceExtension;

        if (extension->CreatedSymbolicLink) {
            IoDeleteSymbolicLink(&extension->SymbolicLinkName);
            ExFreePool(extension->SymbolicLinkName.Buffer);
        }

        IoDeleteDevice(currentDevice);
    }
}

NTSTATUS
DestroySoundDevice(
    IN  PDEVICE_OBJECT DeviceObject,
    IN  PCWSTR WideDosDeviceName,
    IN  UCHAR Index)
{
    NTSTATUS Status;
    UNICODE_STRING DosDeviceName;

    /* Check for NULL parameters */
    if ( ( ! WideDosDeviceName ) || ( ! DeviceObject ) )
    {
        DPRINT("Unexpected NULL parameter");
        return STATUS_INVALID_PARAMETER;
    }

    /* Range-check */
    if ( Index >= SOUND_MAX_DEVICES )
    {
        DPRINT("Device %d exceeds maximum", Index);
        return STATUS_INVALID_PARAMETER;
    }

    Status = ConstructDeviceName(WideDosDeviceName, Index, &DosDeviceName);

    if ( ! NT_SUCCESS(Status) )
    {
        return Status;
    }

    DPRINT("Deleting symlink %ws\n", DosDeviceName.Buffer);

    Status = IoDeleteSymbolicLink(&DosDeviceName);
    DPRINT("Status of symlink deletion is 0x%08x\n", Status);
/*
    ASSERT(NT_SUCCESS(Status));
*/

    IoDeleteDevice(DeviceObject);

    return STATUS_SUCCESS;
}

int XMountDrive(char driveLetter, char *directoryName)
{
#ifdef DEBUG
	debugPrint("XMountDrive driveLetter=%c directoryName=%s\n", driveLetter, directoryName);
#endif

	ANSI_STRING drive, device; 

	char driveBuffer[10];
	sprintf(driveBuffer, "\\??\\%c:", driveLetter);
	
	char *deviceBuffer;

	// we allocate some memory here that never gets deallocated.  Hopefully
	// that won't be a problem because it only small and shouldn't happen often
	deviceBuffer = (char *)malloc(200);
	int rc = XConvertDOSFilenameToXBOX(directoryName, deviceBuffer);
	if (rc != STATUS_SUCCESS)
		return rc;

	// we need to make sure it has a trailing slash
	int len = strlen(deviceBuffer);
	if (deviceBuffer[len-1] != '\\')
	{
		deviceBuffer[len] = '\\';
		deviceBuffer[len+1] = 0;
	}

	RtlInitAnsiString(&drive, driveBuffer); 
	RtlInitAnsiString(&device, deviceBuffer); 

	IoDeleteSymbolicLink(&drive); 

	NTSTATUS status = IoCreateSymbolicLink(&drive, &device); 
	if (!NT_SUCCESS(status))
		return RtlNtStatusToDosError(status);
	else
	{
		setPartitionString(driveLetter, deviceBuffer); 
		return STATUS_SUCCESS;
	}
}

//------------------------------------------------------------------------------------------------------------------- 
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject) 
{ 
	UNICODE_STRING deviceLinkUnicodeString; 
	PDEVICE_EXTENSION extension; 
	PIRP pNewIrp = NULL; 
	ULONG m_size; 
	NTSTATUS ntStatus; 
	extension = DriverObject->DeviceObject->DeviceExtension; 

	// Create counted string version of our Win32 device name. 
	RtlInitUnicodeString(&deviceLinkUnicodeString, DOS_DEVICE_NAME); 


	// Delete the link from our device name to a name in the Win32 namespace. 
	IoDeleteSymbolicLink(&deviceLinkUnicodeString); 


	// Finally delete our device object 
	IoDeleteDevice(DriverObject->DeviceObject); 
} 

//
// 删除一个设备
//
VOID
XFilter_Delete(
	IN	PDEVICE_OBJECT		pDeviceObject
)
{
	PXPACKET_DEVICE_EXTENSION pDeviceExtension;
	UNICODE_STRING SymbolicLinkName;

	pDeviceExtension = (PXPACKET_DEVICE_EXTENSION)pDeviceObject->DeviceExtension;

	RtlInitUnicodeString(&SymbolicLinkName, XPACKET_XFILTER_DOS_DEVICE_NAME);
	IoDeleteSymbolicLink( &SymbolicLinkName );

	pDeviceExtension->ulNodeType = 0;
	pDeviceExtension->ulNodeSize = 0;

	IoDeleteDevice( pDeviceObject );

	dprintf(("XFilter_Delete Success\n"));
}

//
// Delete the associated device and return
//
static STDCALL void RwPortsUnload(IN PDRIVER_OBJECT DriverObject)
{
  UNICODE_STRING DeviceLinkUnicodeString;
  NTSTATUS ntStatus=STATUS_SUCCESS;
  OutputDebugString ("rwports: entering RwPortsUnload");
  OutputDebugString ("rwports: unmapping remaining memory");
  
  RtlInitUnicodeString (&DeviceLinkUnicodeString, L"\\DosDevices\\rwports");
  ntStatus = IoDeleteSymbolicLink (&DeviceLinkUnicodeString);

  if (NT_SUCCESS(ntStatus))
  {
    IoDeleteDevice (DriverObject->DeviceObject);
  }
  else 
  {
    OutputDebugString ("rwports: IoDeleteSymbolicLink failed");
  }
  OutputDebugString ("rwports: leaving RwPortsUnload");
}

VOID UnloadDriver(PDRIVER_OBJECT DriverObject)
{
	UNICODE_STRING  uniLinkName;
	PDEVICE_OBJECT  CurrentDeviceObject;
	PDEVICE_OBJECT  NextDeviceObject;

	RtlInitUnicodeString(&uniLinkName,LINK_NAME);
	IoDeleteSymbolicLink(&uniLinkName);
	if (DriverObject->DeviceObject!=NULL)
	{
		CurrentDeviceObject = DriverObject->DeviceObject;
		while(CurrentDeviceObject!=NULL)
		{
			NextDeviceObject  = CurrentDeviceObject->NextDevice;
			IoDeleteDevice(CurrentDeviceObject);
			CurrentDeviceObject = NextDeviceObject;
		}
	}
	DbgPrint("UnloadDriver\r\n");
}

/******************************************************************************
 *                            Driver unload handler                           *
 ******************************************************************************/
static VOID DDKAPI
my_unload(PDRIVER_OBJECT DriverObject)
{
  ANSI_STRING SymbolicLinkNameA;
  UNICODE_STRING SymbolicLinkNameW;
  DbgPrint("DriverUnload called\r\n");

  PsSetCreateProcessNotifyRoutine(create_process_watcher, TRUE);
  PsRemoveLoadImageNotifyRoutine(load_image_watcher);

  RtlInitString(&SymbolicLinkNameA, MY_DOSDEVICE_NAME);
  RtlAnsiStringToUnicodeString(&SymbolicLinkNameW, &SymbolicLinkNameA, TRUE);

  IoDeleteSymbolicLink(&SymbolicLinkNameW);
  IoDeleteDevice(DriverObject->DeviceObject);

  for (int i = 0; i < ENT_CNT; ++i)
    if(g_proc_table[i].pid)
      DbgPrint("Registered process stays: %d\r\n", g_proc_table[i].pid);
}

VOID
AWEAllocUnload(IN PDRIVER_OBJECT DriverObject)
{
  PDEVICE_OBJECT device_object = DriverObject->DeviceObject;
  UNICODE_STRING sym_link;

  KdPrint(("AWEAlloc: Unload.\n"));

  PAGED_CODE();

  RtlInitUnicodeString(&sym_link, AWEALLOC_SYMLINK_NAME);
  IoDeleteSymbolicLink(&sym_link);

  while (device_object != NULL)
    {
      PDEVICE_OBJECT next_device = device_object->NextDevice;
      IoDeleteDevice(device_object);
      device_object = next_device;
    }
}

VOID DDK_Unload (IN PDRIVER_OBJECT pDriverObject)
{ 
  PDEVICE_OBJECT pDev;//用来取得要删除设备对象
  UNICODE_STRING symLinkName; // 
  UnHook();
  if (ishook)
  {//unhook


  __asm //去掉页面保护
  {
	  cli
		  mov eax,cr0
		  and eax,not 10000h //and eax,0FFFEFFFFh
		  mov cr0,eax

  }

 
 pcur->E9= oldCode.E9;//1字节
 pcur->JMPADDR= oldCode.JMPADDR;//4字节
  __asm //恢复页保护
  {
	  mov eax,cr0
		  or  eax,10000h //or eax,not 0FFFEFFFFh
		  mov cr0,eax
		  sti
  }
  } //end unhook
  pDev=pDriverObject->DeviceObject;
  IoDeleteDevice(pDev); //删除设备
  
  //取符号链接名字
   RtlInitUnicodeString(&symLinkName,L"\\??\\My_DriverLinkName");
  //删除符号链接
   IoDeleteSymbolicLink(&symLinkName);
 KdPrint(("驱动成功被卸载...OK-----------")); //sprintf,printf
 //取得要删除设备对象
//删掉所有设备
 DbgPrint("卸载成功");
}

VOID
DokanUnload(
	__in PDRIVER_OBJECT DriverObject
	)
/*++

Routine Description:

	This routine gets called to remove the driver from the system.

Arguments:

	DriverObject	- the system supplied driver object.

Return Value:

	NTSTATUS

--*/

{

	PDEVICE_OBJECT	deviceObject = DriverObject->DeviceObject;
	WCHAR			symbolicLinkBuf[] = DOKAN_GLOBAL_SYMBOLIC_LINK_NAME;
	UNICODE_STRING	symbolicLinkName;

	PAGED_CODE();
	DDbgPrint("==> DokanUnload\n");

	if (GetIdentifierType(deviceObject->DeviceExtension) == DGL) {
		DDbgPrint("  Delete Global DeviceObject\n");
		RtlInitUnicodeString(&symbolicLinkName, symbolicLinkBuf);
		IoDeleteSymbolicLink(&symbolicLinkName);
		IoDeleteDevice(deviceObject);
	}

	ExDeleteNPagedLookasideList(&DokanIrpEntryLookasideList);

	DDbgPrint("<== DokanUnload\n");
	return;
}

VOID
ioctlUnloadDriver(__in PDRIVER_OBJECT DriverObject)
{
    PDEVICE_OBJECT deviceObject = DriverObject->DeviceObject;

    UNICODE_STRING uniWin32NameString;
    UNREFERENCED_PARAMETER(deviceObject);

    netmap_fini();
    keexit_GST();

    RtlInitUnicodeString(&uniWin32NameString, NETMAP_DOS_DEVICE_NAME);

    // Delete the link from our device name to a name in the Win32 namespace.
    IoDeleteSymbolicLink(&uniWin32NameString);

    if (deviceObject != NULL) {
	IoDeleteDevice(deviceObject);
    }	
    return;
}

VOID CRARKSYS_DriverUnload(
	IN PDRIVER_OBJECT		DriverObject
	)
{
	PDEVICE_OBJECT pdoNextDeviceObj = pdoGlobalDrvObj->DeviceObject;
    //为安全考虑
    UnhookFunction(KeInsertQueueApc, KeInsertQueueApcJumpBack);
    ProtectCleanup();

	IoDeleteSymbolicLink(&usSymlinkName);

	// Delete all the device objects
	while(pdoNextDeviceObj)
	{
		PDEVICE_OBJECT pdoThisDeviceObj = pdoNextDeviceObj;
		pdoNextDeviceObj = pdoThisDeviceObj->NextDevice;
		IoDeleteDevice(pdoThisDeviceObj);
	}

    KdPrint(("CrArkSys Unload.\n"));
}

//////////////////////////////////////////////////////////////////////////////////////////////////////////////
//	Description :
//		Driver unload callback. Removes hooks, callbacks, and communication stuff.
//	Parameters :
//	Process :
//		Removes hooks, callbacks, device driver symbolic link / device, and cleans the monitored
//		processes linked list.
//////////////////////////////////////////////////////////////////////////////////////////////////////////////
VOID Unload(PDRIVER_OBJECT pDriverObject)
{
	if(is_xp)
		unhook_ssdt_entries();
	else
		unhook_ssdt_entries_7();
			
	CmUnRegisterCallback(cookie);
	PsRemoveLoadImageNotifyRoutine(imageCallback);
	
	IoDeleteSymbolicLink(&usDosDeviceName);
	IoDeleteDevice(pDriverObject->DeviceObject);
	
	cleanMonitoredProcessList();	
	cleanHiddenProcessList();
	
	if (cuckooPath)
	{
		ExFreePool(cuckooPath);
	}
}

VOID USBPcapDeleteRootHubControlDevice(IN PDEVICE_OBJECT controlDevice)
{
    UNICODE_STRING     symbolicLinkName;
    PWCHAR             symbolicNameBuffer[MAX_SYMBOLIC_LEN];
    USHORT             id;
    PDEVICE_EXTENSION  pDevExt;
    NTSTATUS           status;

    pDevExt = ((PDEVICE_EXTENSION)controlDevice->DeviceExtension);

    ASSERT(pDevExt->deviceMagic == USBPCAP_MAGIC_CONTROL);

    id = pDevExt->context.control.id;

    symbolicLinkName.Length = 0;
    symbolicLinkName.MaximumLength = MAX_SYMBOLIC_LEN;
    symbolicLinkName.Buffer = (PWSTR)symbolicNameBuffer;

    status = RtlUnicodeStringPrintf(&symbolicLinkName,
                                    SYMBOLIC_PREFIX L"%hu", id);

    IoAcquireRemoveLock(&pDevExt->removeLock, NULL);
    IoReleaseRemoveLockAndWait(&pDevExt->removeLock, NULL);

    IoReleaseRemoveLock(pDevExt->parentRemoveLock, NULL);

    ASSERT(NT_SUCCESS(status));
    if (NT_SUCCESS(status))
    {
        IoDeleteSymbolicLink(&symbolicLinkName);
        IoDeleteDevice(controlDevice);
    }
    else
    {
        /* Very bad */
        KdPrint(("Failed to init symbolic link name\n"));

        pDevExt->context.control.pRootHubObject = NULL;
    }
}

///////////////////////////////////////////////////////////////////////////////
///
///  Handle driver unloading. All this driver needs to do 
///  is to delete the device object and the symbolic link between our 
///  device name and the Win32 visible name.
///
///////////////////////////////////////////////////////////////////////////////
VOID
TdDeviceUnload(
_In_ PDRIVER_OBJECT DriverObject
)
{
	NTSTATUS Status = STATUS_SUCCESS;
	UNICODE_STRING DosDevicesLinkName = RTL_CONSTANT_STRING(QD_DOS_DEVICES_LINK_NAME);

	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_TRACE_LEVEL, "QuietDragon: TdDeviceUnload\n");

	// Unregister process notify routines.
	if (gProcessNotifyRoutine_isSet == TRUE)
	{
		Status = PsSetCreateProcessNotifyRoutineEx(
			MyCreateProcessNotifyRoutine,
			TRUE
			);

		TD_ASSERT(Status == STATUS_SUCCESS);

		gProcessNotifyRoutine_isSet = FALSE;
	}

	// TODO Need to clean up lists and locks

	// Free allocated mem
	PQD_COMM_CONTROL_DEVICE_EXTENSION controlExt = (PQD_COMM_CONTROL_DEVICE_EXTENSION)g_CommDeviceObject->DeviceExtension;
	ExFreePoolWithTag(controlExt->DecisionData, 'SRdd');

	// Delete the link from our device name to a name in the Win32 namespace.
	Status = IoDeleteSymbolicLink(&DosDevicesLinkName);
	if (Status != STATUS_INSUFFICIENT_RESOURCES) 
	{
		// IoDeleteSymbolicLink can fail with STATUS_INSUFFICIENT_RESOURCES.
		TD_ASSERT(NT_SUCCESS(Status));
	}

	// Delete our device object.
	IoDeleteDevice(DriverObject->DeviceObject);
}