summaryrefslogtreecommitdiff
path: root/security/elam/README.md
diff options
context:
space:
mode:
authorBarry Golden <[email protected]>2019-09-25 07:54:18 -0700
committerGitHub <[email protected]>2019-09-25 07:54:18 -0700
commit2e237713e298495b141560a5e7c76d6b1efa0153 (patch)
tree552f09c62562d62e3b8f2701f223f6f53792403e /security/elam/README.md
parent16022c593787aef040b8a37ef697316e07f1322e (diff)
Diffstat (limited to 'security/elam/README.md')
-rw-r--r--security/elam/README.md24
1 files changed, 7 insertions, 17 deletions
diff --git a/security/elam/README.md b/security/elam/README.md
index db28ffb6..e6bf44a6 100644
--- a/security/elam/README.md
+++ b/security/elam/README.md
@@ -8,19 +8,9 @@ products:
- windows-wdk
---
-
-<!---
- name: Early Launch Anti-Malware Driver
- platform: KMDF
- language: cpp
- category: Security
- description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver.
- samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617954
---->
-
# Early Launch Anti-Malware Driver
-This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers.
+This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](https://docs.microsoft.com/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-ioregisterbootdrivercallback) and [**IoUnRegisterBootDriverCallback**](https://docs.microsoft.com/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-iounregisterbootdrivercallback) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers.
This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment.
@@ -34,13 +24,13 @@ Early Launch drivers are required to be signed with a code-signing certificate t
1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine.
-2. Use the sc.exe tool present in Windows to install the driver:
+1. Use the sc.exe tool present in Windows to install the driver:
+
+ `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch`
- `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch`
-
-3. Enable test signing:
+1. Enable test signing:
- `bcdedit /set testsigning on`
+ `bcdedit /set testsigning on`
## Code tour
@@ -124,4 +114,4 @@ ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3
ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f
ElamSample reports that all Boot Start drivers have been initialized and that ElamSample is about to be unloaded ElamSample is being unloaded.
-``` \ No newline at end of file
+```