diff options
| author | Barry Golden <[email protected]> | 2019-09-25 07:54:18 -0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2019-09-25 07:54:18 -0700 |
| commit | 2e237713e298495b141560a5e7c76d6b1efa0153 (patch) | |
| tree | 552f09c62562d62e3b8f2701f223f6f53792403e /security/elam | |
| parent | 16022c593787aef040b8a37ef697316e07f1322e (diff) | |
Update README.md (#424)87280872798727887277872768727587274872738727287271872708726987268872678726687265872648726387262872618726087259872588725787255872548725387252
Diffstat (limited to 'security/elam')
| -rw-r--r-- | security/elam/README.md | 24 |
1 files changed, 7 insertions, 17 deletions
diff --git a/security/elam/README.md b/security/elam/README.md index db28ffb6..e6bf44a6 100644 --- a/security/elam/README.md +++ b/security/elam/README.md @@ -8,19 +8,9 @@ products: - windows-wdk --- - -<!--- - name: Early Launch Anti-Malware Driver - platform: KMDF - language: cpp - category: Security - description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver. - samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617954 ----> - # Early Launch Anti-Malware Driver -This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers. +This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](https://docs.microsoft.com/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-ioregisterbootdrivercallback) and [**IoUnRegisterBootDriverCallback**](https://docs.microsoft.com/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-iounregisterbootdrivercallback) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers. This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment. @@ -34,13 +24,13 @@ Early Launch drivers are required to be signed with a code-signing certificate t 1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine. -2. Use the sc.exe tool present in Windows to install the driver: +1. Use the sc.exe tool present in Windows to install the driver: + + `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch` - `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch` - -3. Enable test signing: +1. Enable test signing: - `bcdedit /set testsigning on` + `bcdedit /set testsigning on` ## Code tour @@ -124,4 +114,4 @@ ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3 ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f ElamSample reports that all Boot Start drivers have been initialized and that ElamSample is about to be unloaded ElamSample is being unloaded. -```
\ No newline at end of file +``` |
