Fundamentals of Windows 64-bit driver programming

Source: Internet
Author: User

New start: The goal is to Win64 driver programming with rootkits, plug-in technology from 32bit to 64bit. Windows vulnerability Analysis and Mining, PHP code audit

Win64 programming

32-bit systems are phased out, and it is important to go to 64-bit programming. But suffering from 64-bit drive programming on-line data comparison clutter

Here is going to write about 64-bit driver programming content, of course, most of the content is collected from the Internet, and then come together to learn.

    1. Get ready

Dual-Machine Debug, load Driver tool, Debgview tool, disable driver signature after win10 restart. Load driver after reboot

Dual-Machine Commissioning:

In the Win7 virtual machine state, add a serial port based on the named pipe, then set the application at the other end, and then

Execute the following command

64 The system began to have a driver signature mechanism, not through the Microsoft signature driver cannot be loaded, we need to disable it when debugging.

After pressing F8, there is a disable driver signature startup option, select it to start.

Bcdedit/dbgsettings serial baudrate:115200 Debugport:1 (last 1 represents the COM1 set in the virtual machine)

bcdedit/copy {current}/d debug (remember the ID number returned here, used below)

Bcdedit/displayorder {current} {ID} Here the ID is set to the ID returned by the 2nd command

Bcdedit/debug {ID} on here the ID is set to the ID returned by the 2nd command

Reboot.

    1. Code

Automatic conversion to ULONG64 for ulong at 64 compile time

If it's ulong_ptr, the compiler automatically helps us convert

The untyped pointer uses PVOID64.

When printing via Kdprint,%x does not use%p.

Structures such as XP to Windows7 64-bit like eprocess also change, and comparisons can be viewed through WinDbg.

For driver code, because those data types have 2 versions: End with 32 and end with 64, it automatically goes to the target type by compiling at different environments

    1. PatchGuard

Frankly speaking, is Microsoft in order to make the system more secure, can not casually hook and inline, can not casually be able to modify eprocess to hide the process.

This guy every once in a while to the System key files, memory area of CRC check, found not immediately 0x109 blue screen.

And it hides itself in memory bad by solving it to bypass PatchGuard.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x109---critical-structure-corruption

The above Web site has content that is listed as protected by it.

To be continued .....

Fundamentals of Windows 64-bit driver programming

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.