Windows Kernel (WRK) compilation

Introduction

WRK is part of the source code for the Windows kernel that Microsoft opened in 2006 for education and academia.

WRK (Windows Research Kernel) is the Windows study kernel,

Not only does it provide some code for the Windows kernel modules in WRK , it also provides a compilation tool,

That is, with this compilation tool, you can compile your WRK into an EXE file,

That is, the kernel executable module, then you can use this EXE file to replace the operating system itself kernel,

In this case, the next time the operating system loaded the kernel is the one you compiled the EXE .

Tool Software

Intel x86 CPU;

VMware 6.5;

Windows Server 2003 SP1 (for testing WRK compilation results);

Windows 7 (used to compile WRK);

WRK 1.2;

Overview WRK

First we find the kernel module files under the current Windows operating system,

The so-called kernel module files, in fact, can be seen as the kernel of Windows ,

It consists of an actuator and a micro-core, which is named Ntoskrnl.exe , a binary module,

The file is located at:C:\Windows\System32;

And our WRK compiled results should also be a kernel module file,

Which means that the result of our compilation should be this Ntoskrnl.exe ,

Of course the compiled name can be different,

The default compilation is Wrkx86.exe (this is the default compilation result name under the x86 environment),

The following is an analysis of the directory structure in WRK:

First look at the Ws03sp1hals directory:

Ws03sp1hals represents the meaning of Windows Server 2003 SP1 HALS,

That is , the HAL (Hardware abstraction Layer)under Windows Server 2003 SP1 .

In the Windows operating system,Hal is actually a standalone DLL (here you can simply think of Hal as a DLL) ,

The HAL can be used to isolate the differences between hardware, that is, the upper module does not need to consider the difference between the underlying real hardware,

Because the upper module does not have direct access to the hardware, it accesses the hardware through the HAL ,

So for the difference of hardware, in the HAL can be solved, and do not need the upper module to solve,

The advantage of this is that it is obvious that our upper modules are the same, that is, when the hardware changes do not need to change,

As long as we provide HAL for different hardware, we can implement our upper modules on different hardware.

Because of inconsistent hardware on our PC , there must be more than one HAL .

For example, my pc 's processor is Intel , and your PC 's processor is AMD ,

My processor is single-core, and your processor is four-core,

So this will result in inconsistent hardware, in order to resolve this inconsistency,

Windows packs multiple Hal in when it is packaged, such as a Hal for a single core, a Hal for Multicore,

Windows automatically identifies whether your processor is AMD or Intel , whether it's multicore or a single-core processor, when it's installed.

Windows will then automatically select a suitable hal for you to install and, at the same time, modify the Hal name to HAL. DLL,

And in the ws03sp1hals directory is these HAL ,

For example, my PC 's processor is a dual-core processor of the Intel x86 series,

Naturally when installing Windows , the appropriate Hal is automatically selected, such as Halmps.dll as Hal ,

Then, when installing Windows , copy this HAL into my C Drive directory,

Renamed this halmps.dll to Hal.dll (for the sake of unification),

So that we can get what we see below in the C:\Windows\System32\hal.dll .

Then look at the public directory:

In this directory is a number of header files, which is the . h file, and these files are shared by various components, that is, public,

It contains DDK, internal and so on, where internal is used internally, which is the header file that the kernel itself needs to use.

Then look at the Tools directory:

As mentioned earlier,WRK contains not only some of the source code that Microsoft exposes about the Windows kernel,

It also includes tools to compile this part of the source code, which is naturally in the Tools directory .

We will use the tools in this tool directory when we compile the WRK source code later.

finally look at the Base directory, where The ntos directory under the Base directory is the home directory for the Windows kernel module:

Here are the meanings of the files in each of these directories:

Build	WRK only exposes part of the source code, and those that are not exposed are present in this directory in the form of binary target code.
Cache	The source file for the implementation of the cache manager.
Config	The source file for the implementation of the registry.
Dbgk	Debug the source file for the kernel mode portion of the subsystem.
Ex	The source file that executes the body layer function (kernel heap, synchronization, timer, etc.).
FsRtl	The source file for the file system runtime.
Fstub	The file system boot interface.
Io	I/O manager, excluding the Plug and Play manager and Power Manager sections.
Ke	(micro) kernel, including thread scheduler,CPU management, and underlying synchronization semantics
Lpc	Implementation of the local procedure call (LPC) mechanism.
Mm	Memory manager.
Ob	Kernel Object Manager.
Perf	The performance logging feature of the kernel.
Ps	Processes and threads.
Se	Security reference Monitor.
Wmi	Windows Management Instrumentation.
Inc	Applies only to the include file for the ntos section.
Raw	source file for the implementation of the RAW file system driver.
Rtl	Kernel run-time library support.
Init	The code for the kernel boot section.
Vdm	Virtual DOS machine.
Verifier	Driver Verifier.

Compiling WRK

The first is to set the x86 subdirectory in the Tools subdirectory of the WRK root directory into the Path environment variable,

First, under the console, enter the ntos directory under the Base directory under the WRK root directory,

Then enter the command:Nmake–nologo x86=;

(If the CPU is AMD, the command will be different, and the settings for the environment variable may vary)

Then you start compiling the entire WRK .

Compile Complete:

At this point, you can find the compiled EXE file under the directory : Wrk-v1.2\base\ntos\build .

The compilation is complete.

Load the WRK compiled kernel module

We have compiled the kernel executable module in front of WRK .

Next we need to let the operating system boot up to load the compiled kernel executable module.

The environment we use is the installation of Windows Server 2003 SP1 in VMware 6.5.

First, we'll copy the wrkx86.exe compiled by WRK into the virtual machine,

and place this file in the directory (that is, the directory where Ntoskrnl.exe is located):

Then locate the boot. ini file (hidden by default) under its system installation directory (typically C: disk).

The first thing you need to do is remove the read-only attribute from this file and change the file to read-write.

Then open the boot. ini file with Notepad

Before you modify the boot. ini file:

Then add the following line to boot. INI:

multi (0) disk (0) rdisk (0) partition (1) \windows= "WINDOWS Server 2003, WRK"/kernel=wrkx86.exe/hal=hal.dll

Modified boot. ini file:

Restart Windows Server 2003 SP1 After you have set up all of the above .

You can then see the following screen in the splash screen:

We select Windows Server 2003, WRK start the Windows operating system,

So loading the kernel executable module is the wrkx86.exe that we compiled from WRK .

Summarize

The process of compiling the WRK and loading the kernel modules compiled by WRK is described in detail above.

What is the effect on WRK ? Of course it is used to learn, that is, through WRK Learning,

More in-depth understanding of the Windows kernel, until that day has the strength,

You can modify the WRK source code and then compile it into a kernel module.

Then let the operating system load your own kernel module, of course, this is not very easy to reach the realm of!!!

In fact, for the WRK , there is a debugging environment collocation, through this debugging environment,

You can debug the kernel outside (referring to the virtual machine) through WinDbg .

But because of this in the later introduction of the driver, I will explain again, so here is not a mess.

Http://www.cnblogs.com/BoyXiao/archive/2011/01/08/1930904.html

Windows Kernel (WRK) compilation