Fundamentals of Windows 64-bit driver programming

New start: The goal is to Win64 driver programming with rootkits, plug-in technology from 32bit to 64bit. Windows vulnerability Analysis and Mining, PHP code audit

Win64 programming

32-bit systems are phased out, and it is important to go to 64-bit programming. But suffering from 64-bit drive programming on-line data comparison clutter

Here is going to write about 64-bit driver programming content, of course, most of the content is collected from the Internet, and then come together to learn.

1. Get ready

Dual-Machine Debug, load Driver tool, Debgview tool, disable driver signature after win10 restart. Load driver after reboot

Dual-Machine Commissioning:

In the Win7 virtual machine state, add a serial port based on the named pipe, then set the application at the other end, and then

Execute the following command

64 The system began to have a driver signature mechanism, not through the Microsoft signature driver cannot be loaded, we need to disable it when debugging.

After pressing F8, there is a disable driver signature startup option, select it to start.

Bcdedit/dbgsettings serial baudrate:115200 Debugport:1 (last 1 represents the COM1 set in the virtual machine)

bcdedit/copy {current}/d debug (remember the ID number returned here, used below)

Bcdedit/displayorder {current} {ID} Here the ID is set to the ID returned by the 2nd command

Bcdedit/debug {ID} on here the ID is set to the ID returned by the 2nd command

Reboot.

1. Code

Automatic conversion to ULONG64 for ulong at 64 compile time

If it's ulong_ptr, the compiler automatically helps us convert

The untyped pointer uses PVOID64.

When printing via Kdprint,%x does not use%p.

Structures such as XP to Windows7 64-bit like eprocess also change, and comparisons can be viewed through WinDbg.

For driver code, because those data types have 2 versions: End with 32 and end with 64, it automatically goes to the target type by compiling at different environments

1. PatchGuard

Frankly speaking, is Microsoft in order to make the system more secure, can not casually hook and inline, can not casually be able to modify eprocess to hide the process.

This guy every once in a while to the System key files, memory area of CRC check, found not immediately 0x109 blue screen.

And it hides itself in memory bad by solving it to bypass PatchGuard.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x109---critical-structure-corruption

The above Web site has content that is listed as protected by it.

To be continued .....

Fundamentals of Windows 64-bit driver programming