Kernel Mode Driver Framework >> Pascal (PNP)
Hello, world!
參考資訊:
1. Source Code
main.pas
unit main; interface uses DDDK; const DEV_NAME = '\Device\MyDriver'; function __DriverEntry(pOurDriver:PDRIVER_OBJECT; pOurRegistry:PUNICODE_STRING):NTSTATUS; stdcall; implementation function AddDevice(pOurDriver:WDFDRIVER; pDeviceInit:PWDFDEVICE_INIT):NTSTATUS; stdcall; var device: WDFDEVICE; suDevName: UNICODE_STRING; begin DbgPrint('Hello, world!', []); RtlInitUnicodeString(@suDevName, DEV_NAME); WdfDeviceInitAssignName(pDeviceInit, @suDevName); WdfDeviceCreate(@pDeviceInit, WDF_NO_OBJECT_ATTRIBUTES, @device); Result:= STATUS_SUCCESS; end; function __DriverEntry(pOurDriver:PDRIVER_OBJECT; pOurRegistry:PUNICODE_STRING):NTSTATUS; stdcall; var config: WDF_DRIVER_CONFIG; begin WDF_DRIVER_CONFIG_INIT(@config, AddDevice); WdfDriverCreate(pOurDriver, pOurRegistry, WDF_NO_OBJECT_ATTRIBUTES, @config, WDF_NO_HANDLE); Result:= STATUS_SUCCESS; end; end.
DriverEntry()產生WDF Driver Object並且註冊AddDevice Callback
AddDevice()產生WDF Device Object並且輸出Debug字串,另外,得助於編譯器的幫助,DEV_NAME會被展開成WCHAR型態,而非CHAR型態。
loader.asm
.386p .model flat, stdcall option casemap:none include c:\masm32\Macros\Strings.mac include c:\masm32\include\w2k\ntdef.inc include c:\masm32\include\w2k\ntstatus.inc include c:\masm32\include\w2k\ntddk.inc include c:\masm32\include\w2k\ntoskrnl.inc include c:\masm32\include\w2k\ntddkbd.inc include c:\masm32\include\wdf\umdf\1.9\wudfddi_types.inc include c:\masm32\include\wdf\kmdf\1.9\wdf.inc include c:\masm32\include\wdf\kmdf\1.9\wdftypes.inc include c:\masm32\include\wdf\kmdf\1.9\wdfglobals.inc include c:\masm32\include\wdf\kmdf\1.9\wdffuncenum.inc include c:\masm32\include\wdf\kmdf\1.9\wdfobject.inc include c:\masm32\include\wdf\kmdf\1.9\wdfdevice.inc include c:\masm32\include\wdf\kmdf\1.9\wdfdriver.inc includelib c:\masm32\lib\wxp\i386\BufferOverflowK.lib includelib c:\masm32\lib\wdf\kmdf\i386\1.9\wdfldr.lib includelib c:\masm32\lib\wdf\kmdf\i386\1.9\wdfdriverentry.lib public DriverEntry extern _DriverEntry:proc DriverEntry proc pOurDriver:PDRIVER_OBJECT, pOurRegistry:PUNICODE_STRING push pOurRegistry push pOurDriver call _DriverEntry ret DriverEntry endp end DriverEntry .end
由於dcc32.exe缺少Buffer Security Check編譯選項,因此,司徒使用MASM32寫了一個Loader,當作中間媒介。
main.inf
[Version] Signature=$CHICAGO$ Class=Unknown Provider=%MFGNAME% DriverVer=8/21/2019,1.0.0.0 [Manufacturer] %MFGNAME%=DeviceList [DeviceList] %DESCRIPTION%=DriverInstall, *MyDriver [DestinationDirs] DefaultDestDir=10,System32\Drivers [SourceDisksFiles] main.sys=1,,, [SourceDisksNames] 1=%INSTDISK%,,, [DriverInstall.NT] CopyFiles=DriverCopyFiles [DriverCopyFiles] main.sys,,,2 [DriverInstall.NT.Services] AddService=FILEIO,2,DriverService [DriverService] ServiceType=1 StartType=3 ErrorControl=1 ServiceBinary=%10%\system32\drivers\main.sys [DriverInstall.NT.HW] AddReg=DriverHwAddReg [DriverHwAddReg] HKR,,SampleInfo,,"" [DriverInstall] AddReg=DriverAddReg CopyFiles=DriverCopyFiles [DriverAddReg] HKR,,DevLoader,,*ntkern HKR,,NTMPDriver,,main.sys [DriverInstall.HW] AddReg=DriverHwAddReg [Strings] MFGNAME="MyDriver" INSTDISK="MyDriver Disc" DESCRIPTION="MyDriver"
INF內容也是很制式的,我們先知道如何使用就可以,司徒之後會教導大家如何寫INF檔案
編譯程式:
del /s /q main.sys c:\masm32\bin\ml /c /coff /Cp "loader.asm" c:\dddk\bin\dcc32.exe -Uc:\dddk\inc -B -CG -JP -$A-,C-,D-,G-,H-,I-,L-,P-,V-,W+,Y- main.pas c:\dddk\bin\omf2d.exe main.obj c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEWdfFunctions=_WdfFunctions 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEWdfDriverGlobals=_WdfDriverGlobals 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEZwClose=_ZwClose@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEDbgPrint=_DbgPrint 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEExFreePool=_ExFreePool@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeSetTimer=_KeSetTimer@16 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoStopTimer=_IoStopTimer@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCallDriver=_IoCallDriver@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoStartTimer=_IoStartTimer@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeSetTimerEx=_KeSetTimerEx@20 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEProbeForRead=_ProbeForRead@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CERtlZeroMemory=_RtlZeroMemory@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeCancelTimer=_KeCancelTimer@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoStartPacket=_IoStartPacket@16 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEZwOpenProcess=_ZwOpenProcess@16 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoDetachDevice=_IoDetachDevice@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoDeleteDevice=_IoDeleteDevice@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEExAllocatePool=_ExAllocatePool@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeReleaseMutex=_KeReleaseMutex@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCsqInsertIrp=_IoCsqInsertIrp@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCreateDevice=_IoCreateDevice@28 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeInitializeDpc=_KeInitializeDpc@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCsqInitialize=_IoCsqInitialize@28 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoStartNextPacket=_IoStartNextPacket@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCompleteRequest=_IoCompleteRequest@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeInitializeMutex=_KeInitializeMutex@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeInitializeTimer=_KeInitializeTimer@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeReleaseSpinLock=_KeReleaseSpinLock@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoInitializeTimer=_IoInitializeTimer@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEObDereferenceObject=_ObDereferenceObject@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoGetCurrentProcess=_IoGetCurrentProcess@0 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEInterlockedExchange=@InterlockedExchange@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeInitializeSpinLock=_KeInitializeSpinLock@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoCreateSymbolicLink=_IoCreateSymbolicLink@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoDeleteSymbolicLink=_IoDeleteSymbolicLink@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CERtlInitUnicodeString=_RtlInitUnicodeString@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEPsCreateSystemThread=_PsCreateSystemThread@28 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeWaitForSingleObject=_KeWaitForSingleObject@20 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEExAllocatePoolWithTag=_ExAllocatePoolWithTag@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeDelayExecutionThread=_KeDelayExecutionThread@12 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEKeServiceDescriptorTable=_KeServiceDescriptorTable 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEExAllocatePoolWithQuota=_ExAllocatePoolWithQuota@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEPsTerminateSystemThread=_PsTerminateSystemThread@4 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEObReferenceObjectByHandle=_ObReferenceObjectByHandle@24 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEIoAttachDeviceToDeviceStack=_IoAttachDeviceToDeviceStack@8 2>nul c:\dddk\bin\omf2d.exe c:\dddk\inc\dddk.obj /U- /CEMmMapLockedPagesSpecifyCache=_MmMapLockedPagesSpecifyCache@24 2>nul c:\dddk\bin\link.exe /entry:FxDriverEntry@8 /NOLOGO /ALIGN:64 /BASE:0x10000 /SUBSYSTEM:NATIVE /DRIVER /FORCE:UNRESOLVED /FORCE:MULTIPLE c:\dddk\inc\DDDK.obj c:\dddk\lib\ntoskrnl.lib c:\dddk\lib\wdf\kmdf\i386\1.9\wdfdriverentry.lib c:\dddk\lib\wdf\kmdf\i386\1.9\wdfldr.lib main.obj loader.obj /out:main.sys del /s /q main.dcu del /s /q main.obj del /s /q loader.obj
安裝程式:
在開始安裝驅動程式之前,我們需要先下載除錯工具,讓驅動程式的Debug訊息可以顯示在除錯工具上面,目前在Kernel Mode以及User Mode上,最佳的Debug輸出訊息工具是DbgView,該公司目前已經被Microsoft併購,所以可以從Microsoft網站下載,下載完後執行DbgView並將Capture > Capture Kernel和Enable Verbose Kernel Output選項打勾,接著重啟DbgView
對於驅動程式的安裝工具,司徒目前先使用NuMega公司製作的安裝工具EzDriverInstaller,請將main.sys和main.inf放在同一個目錄並執行EzDriverInstaller,選擇File > Open...(開啟main.inf檔案),接著按Add New Device就可以在DbgView上面看到輸出訊息
Device Manager
Device
司徒接著說明一下為了需要這個Loader?因為在Link階段,FxDriverEntryWorker()無法找到對應的DriverEntry(),即使司徒已經確定Export成_DriverEntry@8,而另一個問題則是Security Cookie Check,這部份尚不知如何從dcc32.exe設定,因此,司徒只好提供一個Loader,讓這個Loader可以跟FxDriverEntryWork()連結,順便解掉Cookie問題
wdfdriverentry.lib(stub.obj) : error LNK2019: unresolved external symbol _DriverEntry@8 referenced in function _FxDriverEntryWorker@8 wdfdriverentry.lib(stub.obj) : error LNK2019: unresolved external symbol ___security_init_cookie referenced in function _FxDriverEntry@8
當然,如果強制安裝使用,必定產生BSOD,原因如下:
原本要指到security_init_cookie()的地方,變成指到PE Header,雖然司徒嘗試手動Patch修復,但是,安裝後還是有點問題,於是,司徒最後只好使用一個簡單的Loader替代。