VOID DriverUnload(PDRIVER_OBJECT DriverObject)                //卸载函数，应该更完善
{
   DbgPrint("successful!");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath) //入口函数
{

PDRIVER_OBJECT kbdDriverObject;
UNICODE_STRING uniNtNameString;
NTSTATUS status=NULL;
NTSTATUS ObReferenceObjectByName(PUNICODE_STRING ObjectName,                          //先声明
         ULONG Attributes,
         PACCESS_STATE AccessState,
         ACCESS_MASK DesiredAccess,
         POBJECT_TYPE ObjectType,
         KPROCESSOR_MODE AccessMode,
         PVOID ParseContext,
         PVOID *Object);

RtlInitUnicodeString(&uniNtNameString,KBD_DRIVER_NAME);                       //初始化为0
status=ObReferenceObjectByName(                                            //得到并打开设备
       &uniNtNameString,
       OBJ_CASE_INSENSITIVE,
       NULL,
       0,
       IoDriverObjectType,
       KernelMode,
       NULL,
       &kbdDriverObject);
if(!NT_SUCCESS(status))
{
    DbgPrint("cannot get the kbd object/n");
    return STATUS_UNSUCCESSFUL;
}
else
{
   ULONG i;
   //PDRIVER_DISPATCH OldDispatchFunctions[IRP_MJ_MAXIMUM_FUNCTION+1];
   OldDispatchRead = kbdDriverObject->MajorFunction[IRP_MJ_READ];//保存原IRP_MJ_READ函数的入口地址
   InterlockedExchangePointer(&kbdDriverObject->MajorFunction[IRP_MJ_READ],NewDispatchRead);//替换为自定义的新分发函数的地址
   ObDereferenceObject(kbdDriverObject);                //不要忘记解除调用
}

DriverObject->DriverUnload=DriverUnload;
return STATUS_SUCCESS;
}