therealdreg/masm32-kernel-programmingmasm32 kernel programming, drivers, tutorials, examples, and tools (credits Four-F)
Dreg's repo for his own needs
masm32 kernel programming, drivers, tutorials, examples, and tools (credits Four-F)
At this moment a .sys is created in C:\
load driver:
w2k_load.exe or osrloader.exe gives an error loading beeper.sys, just ignore it.
This error is generated by driver code itself when it finish its own execution (with this trick you dont need unload it)
mov eax, STATUS_DEVICE_CONFIGURATION_ERROR
ret
So, if beep.sys is correctly loaded in kernel you should listen a beep in your speakers (driver code generates a beep)
When you need unload a driver use:
I modified w2k_load.exe by Sven B. Schreiber to work for windows 2000 to windows 10 (manifest...)
unzip osrloaderv30.zip and use this GUI program:
for older windows just use DbgView.exe attached in this repo. Btw, I modified it (manifest...)
For modern windows use the last dbgview.exe form sysinternal web site, and check this for troubleshooting:
Read .pdf files in this repo and look examples at KmdKit18/examples directory
WARNING: ALL source ASM code are inside .bat files (batch + asm code mixed in the same file)
Example with advanced\FindShadowTable\FindShadowTable.bat
;@echo off
;goto make
ASM DRIVER CODE GOES HERE
:make
set drv=FindShadowTable
\masm32\bin\ml /nologo /c /coff %drv%.bat
\masm32\bin\link /nologo /driver /base:0x10000 /align:32 /out:%drv%.sys /subsystem:native %drv%.obj
del %drv%.obj
echo.
pause
This file contains BATCH code which generates a .sys and also contains the own driver source code, So, yes, very tricky, the build script and source code are together
This is an example how to find ServiceDescriptorTableShadow.
It just scans threads whith ID 80h-400h trying to find a thread which KTHREAD.ServiceTable not equal to KeServiceDescriptorTable. If such a thread is found its KTHREAD.ServiceTable holds ServiceDescriptorTableShadow address.
Watch driver's debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.
This is an example of a simple legacy (non PnP) PS/2-keyboard filter driver. WARNING: You will fail to attach it to USB-keyboard stack.
Tested under: Windows 2000, XP and Server 2003.
Four-F, [email protected] macro files is from my package cocomac.
This is an example of a simple legacy (non PnP) PS/2-mouse filter driver. WARNING: You will fail to attach it to USB-mouse stack.
Tested under: Windows 2000, XP and Server 2003.
This is an example how to apply particular security settings to named device object by calling IoCreateDeviceSecure instead of IoCreateDevice.
Since IoCreateDeviceSecure routine is not a part of the operating system, we link wdmsec.lib, which contains all needed routines.
The wdmsec.lib library you will find here is not one shipped with the DDK. I had to rebuild it to reduce its size, removing not needed members.
This is an example how to create, write to, read from and delete the file.
Use KmdManager to register/unregister and start it. Watch its debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.
This is an example how to pack the driver into resources.
Tested under: Windows 2000, XP and Server 2003.
The way you know whether the system is running in safe mode or not.
Use KmdManager to register/unregister and start it. Watch its debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.
basic/MemoryWorks/LookasideList
This is an example how to use lookaside list and doubly linked list to manage the memory blocks allocated from lookaside list.
Use KmdManager to register/unregister and start/stop it. Watch its debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.
This is an example how to handle exceptions with SEH. But remember. YOU CAN'T HANDLE ALL EXCEPTIONS WITH SEH IN KERNEL MODE !
Use KmdManager to register/unregister and start/stop it. Watch its debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.
basic/MemoryWorks/SharedSection
This is an example how to use named section object to share memory between user mode process and kernel mode driver.
Tested under: Windows 2000, XP and Server 2003.
basic/MemoryWorks/SharingMemory
This is an example of one possible way to share the memory buffer between user and kernel mode.
Tested under: Windows 2000, XP and Server 2003.
basic/MemoryWorks/SystemModules
This is an example how to allocate memory in kernel mode. To not allocate it useless we fill it with some system info.
Use KmdManager to register/unregister and start/stop it. Watch its debug output with the DbgView (www.sysinternals.com) or use SoftICE.
Tested under: Windows 2000, XP and Server 2003.