Steward

分享是一種喜悅、更是一種幸福

驅動程式 - Windows Driver Model (WDM) - 使用範例 - Assembly (ObjAsm) - Hello, world!

---

參考資訊：
https://wasm.in/
http://four-f.narod.ru/
https://github.com/steward-fu/wadk

main.asm

%include @Environ(OBJASM_PATH)/Code/Macros/Model.inc

SysSetup OOP, WDK_WDM, ANSI_STRING

MakeObjects Primer, KDriver, KPnpDevice, KPnpLowerDevice

Object MyDriver, , KDriver
    RedefineMethod Unload
    RedefineMethod AddDevice, PDEVICE_OBJECT
    RedefineMethod DriverEntry, PUNICODE_STRING
    RedefineMethod DriverIrpDispatch, PIRP
ObjectEnd

Object MyDevice, , KPnpDevice
    RedefineMethod Init, PDEVICE_OBJECT
    RedefineMethod DefaultPnp, PKIrp
    RedefineMethod DeviceIrpDispatch, PIRP

    Embed m_pMyLowerDevice, KPnpLowerDevice
ObjectEnd

DECLARE_DRIVER_CLASS MyDriver, NULL

Method MyDriver.DriverEntry, uses esi, pMyRegistry : PUNICODE_STRING
    mov eax, STATUS_SUCCESS
MethodEnd

Method MyDriver.AddDevice, uses esi, pPhyDevice : PDEVICE_OBJECT
    T $OfsCStr("Hello, world%c"), 21h

    New MyDevice
    push eax
    OCall eax::MyDevice.Init, pPhyDevice
    pop eax
MethodEnd

Method MyDriver.DriverIrpDispatch, uses esi, pMyIrp : PIRP
    SetObject esi

    OCall DriverObject
    mov eax, (DRIVER_OBJECT ptr [eax]).DeviceObject
    mov eax, (DEVICE_OBJECT ptr [eax]).DeviceExtension
    OCall eax::MyDevice.DeviceIrpDispatch, pMyIrp
MethodEnd

Method MyDriver.Unload, uses esi
    ACall Unload
MethodEnd

Method MyDevice.Init, uses esi, pPhyDevice : PDEVICE_OBJECT
    ACall Init, \
        $OfsCStrW("\Device\MyDriver"), \
        FILE_DEVICE_UNKNOWN, \
        NULL, \
        0, \
        DO_BUFFERED_IO

    SetObject esi
    OCall [esi].m_pMyLowerDevice::KPnpLowerDevice.Initialize, \
        [esi].m_pMyDevice, \
        pPhyDevice

    OCall SetLowerDevice, addr [esi].m_pMyLowerDevice
MethodEnd

Method MyDevice.DeviceIrpDispatch, uses esi, pMyIrp : PIRP
    ACall DeviceIrpDispatch, pMyIrp
MethodEnd

Method MyDevice.DefaultPnp, uses esi, I : PKIrp
    SetObject esi
    OCall I::KIrp.ForceReuseOfCurrentStackLocationInCalldown
    OCall [esi].m_pMyLowerDevice::KLowerDevice.PnpCall, I
MethodEnd
end

main.inf

[Version]
Signature="$WINDOWS NT$"
Class=Unknown
Provider=%MFGNAME%
DriverVer=10/01/2026,1.0.0.0

[Manufacturer]
%MFGNAME%=DeviceList
%MFGNAME%=DeviceList,NTamd64

[DeviceList]
%DESCRIPTION%=DriverInstall.NTamd64,*MyDriver

[DeviceList.NTamd64]
%DESCRIPTION%=DriverInstall.NTamd64,*MyDriver

[DestinationDirs]
DriverCopyFiles=12

[SourceDisksNames]
1=%INSTDISK%

[SourceDisksFiles]
main.sys=1

[DriverInstall.NTamd64]
CopyFiles=DriverCopyFiles

[DriverCopyFiles]
main.sys

[DriverInstall.NTamd64.Services]
AddService=FILEIO,0x00000002,DriverService

[DriverService]
DisplayName=%SERVICE_DESC%
ServiceType=1
StartType=3
ErrorControl=1
ServiceBinary=%12%\main.sys

[DriverInstall.NTamd64.HW]
AddReg=DriverHwAddReg

[DriverHwAddReg]
HKR,,SampleInfo,,""

[Strings]
MFGNAME="MyDriver"
INSTDISK="MyDriver Disc"
DESCRIPTION="MyDriver"
SERVICE_DESC="MyDriver Kernel Driver"

autorun.inf

[autorun]
open=run.bat

run.bat

e:\devcon.exe install e:\main.inf *mydriver
e:\devcon.exe remove e:\main.inf *mydriver

fix.py

import os
import sys
import pefile

if len(sys.argv) != 2:
    print('Usage: {} xxx'.format(sys.argv[0]))
    sys.exit()

fname = sys.argv[1]
pe = pefile.PE(fname);
pe.OPTIONAL_HEADER.CheckSum = pe.generate_checksum();
pe.write(fname);

Makefile

all:
	uasm -coff -c -q -less -nomlib -FwNUL -Zi -Zd main.asm
	lld-link main.o /driver /base:0x10000 /subsystem:native /entry:DriverEntry /safeseh:no "/opt/wadk/masm32/lib/wxp/i386/ntoskrnl.lib" /out:main.sys
	python3 fix.py main.sys

run:
	genisoimage -R -J -o cdrom.iso autorun.inf main.sys main.inf run.bat /opt/wadk/tools/devcon.exe
	myqemu winxp

clean:
	rm -rf main.sys main.o main.pdb cdrom.iso

編譯

$ make
$ make run

完成


裝置管理員


DeviceObject