Initial publish

7 files changed, 968 insertions, 0 deletions

diff --git a/security/elam/ReadMe.md b/security/elam/ReadMe.md
new file mode 100644
index 00000000..64fa0308
--- /dev/null
+++ b/security/elam/ReadMe.md
@@ -0,0 +1,111 @@
+Early Launch Anti-Malware Driver
+================================
+
+This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers.
+
+The building and installation instructions given here apply to Windows® 8 and later operating systems.
+
+This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment.
+
+SIGNING THE SAMPLE
+
+Early Launch drivers are required to be signed with a code-signing certificate that also contains the Early Launch EKU "1.3.6.1.4.1.311.61.4.1". In a production environment, Early Launch drivers are signed by Microsoft for qualifying Anti-Malware vendors with a WHQL certificate that contains this EKU. The makecert.exe tool can be used to generate a self-signed test certificate that contains both the Early Launch EKU and the “1.3.6.1.5.5.7.3.3” Code Signing EKU. Once a certificate of this form has been created, signtool.exe can be used to sign elamsample.sys.
+
+
+Run the sample
+--------------
+
+INSTALLING THE SAMPLE
+
+1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine.
+
+2. Use the sc.exe tool present in Windows to install the driver:
+
+sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch
+
+3. Enable test signing:
+
+bcdedit /set testsigning on
+
+CODE TOUR
+
+DriverEntry - Creates a framework driver object and calls IoRegisterBootDriverCallback to register to boot driver status callbacks.
+
+ElamSampleEvtDriverUnload: Calls IoUnregisterBootDriverCallback to unregister for callbacks when elamsample.sys is about to be unloaded.
+
+ElamSampleBootDriverCallback: Dispatches to other functions to process the specific callback types.
+
+ElamSampleProcessStatusUpdate: Displays callback BdCbStatusUpdate information, such as when dependencies and drivers are about to be initialized, or when the ELAM driver is about to be unload.
+
+ElamSampleProcessInitializeImage: Displays callback BdCbInitializeImage information, such as the driver image name and the name of the entity that signed the driver.
+
+ElamSamplePrintHex: A utility function to display a buffer in hexadecimal form.
+
+TESTING
+
+After installing the driver, attach the Kernel Debugger and reboot your test machine. If ELAMSAMPLE\_TRACE\_LEVEL is set to DPFLTR\_ERROR\_LEVEL, traces will be output to the debugger automatically. For example:
+
+ElamSample is being initialized.
+
+ElamSample reports the following dependency is about to be initialized: ElamSample:
+
+Image name "\\FileSystem\\RAW"
+
+ElamSample: Not signed.
+
+ElamSample reports that Boot Start driver dependencies are being initialized.
+
+ElamSample reports the following dependency is about to be initialized:
+
+ElamSample: Image name "\\SystemRoot\\system32\\PSHED.dll"
+
+ElamSample: Image hash algorithm = 0x0000800c.
+
+ElamSample: Image hash:
+
+ElamSample: 21 29 88 ca 88 ab dc 0f c3 f1 c0 74 df e0 29 58
+
+ElamSample: 2e cd 41 5e 56 bd 77 53 39 9b d9 d7 f4 47 65 d8
+
+ElamSample: Image is signed by "Microsoft Windows".
+
+ElamSample: Certificate issued by "MSIT Test CodeSign CA 3".
+
+ElamSample: Certificate thumb print algorithm = 0x0000800c.
+
+ElamSample: Certificate thumb print:
+
+ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3
+
+ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f
+
+ElamSample reports that Boot Start drivers are about to be initialized.
+
+ElamSample reports the following Boot Start driver is about to be initialized:
+
+ElamSample: Image name "\\SystemRoot\\System32\\drivers\\rdyboost.sys"
+
+ElamSample: Registry path "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\rdyboost"
+
+ElamSample: Image hash algorithm = 0x0000800c.
+
+ElamSample: Image hash:
+
+ElamSample: 9e 91 b2 e1 29 97 af e9 ac 6c 48 24 01 43 c8 b4
+
+ElamSample: f6 81 bf 57 df 80 0b 05 4d 58 bb e6 d9 83 a9 08
+
+ElamSample: Image is signed by "Microsoft Windows".
+
+ElamSample: Certificate issued by "MSIT Test CodeSign CA 3".
+
+ElamSample: Certificate thumb print algorithm = 0x0000800c.
+
+ElamSample: Certificate thumb print:
+
+ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3
+
+ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f
+
+ElamSample reports that all Boot Start drivers have been initialized and that ElamSample is about to be unloaded ElamSample is being unloaded.
+
diff --git a/security/elam/elam.sln b/security/elam/elam.sln
new file mode 100644
index 00000000..7e7fff34
--- /dev/null
+++ b/security/elam/elam.sln
@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0
+MinimumVisualStudioVersion = 12.0
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "elamsample", "elamsample.vcxproj", "{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+		Debug|x64 = Debug|x64
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Debug|Win32.ActiveCfg = Debug|Win32
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Debug|Win32.Build.0 = Debug|Win32
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Release|Win32.ActiveCfg = Release|Win32
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Release|Win32.Build.0 = Release|Win32
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Debug|x64.ActiveCfg = Debug|x64
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Debug|x64.Build.0 = Debug|x64
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Release|x64.ActiveCfg = Release|x64
+		{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}.Release|x64.Build.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/security/elam/elamsample.c b/security/elam/elamsample.c
new file mode 100644
index 00000000..13654d6e
--- /dev/null
+++ b/security/elam/elamsample.c
@@ -0,0 +1,473 @@
+// THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
+// ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO
+// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
+// PARTICULAR PURPOSE.
+//
+// Copyright (c) Microsoft Corporation. All rights reserved
+//
+// Module Name:
+//
+//     elamsample.c
+//
+// Abstract:
+//
+//     This driver demonstrates how to use the Boot Driver Callback APIs
+//     IoRegisterBootDriverCallback and IoUnRegisterBootDriverCallback and
+//     the callback type PBOOT_DRIVER_CALLBACK_FUNCTION.
+//
+// Environment:
+//
+//     Kernel mode only.
+//
+
+#include <elamsample.h>
+
+#ifdef ALLOC_PRAGMA
+#pragma alloc_text(INIT, DriverEntry)
+#endif // ALLOC_PRAGMA
+
+//
+// Trace level to use for kernel debugger DbgPrintEx output.
+//
+
+#define ELAMSAMPLE_TRACE_LEVEL DPFLTR_TRACE_LEVEL
+
+//
+// Callback handle returned by IoRegisterBootDriverCallback.
+//
+
+static PVOID g_IoRegisterBootDriverCallbackHandle = NULL;
+
+//
+// Current status update type from the callback.
+//
+
+static BDCB_STATUS_UPDATE_TYPE g_CurrentBcdCallbackContextType =
+                                    BdCbStatusPrepareForDependencyLoad;
+
+NTSTATUS
+DriverEntry(
+    _In_ PDRIVER_OBJECT  DriverObject,
+    _In_ PUNICODE_STRING RegistryPath
+    )
+/*++
+
+Routine Description:
+
+    This routine is called by the Operating System to initialize the driver.
+
+    It creates the device object, fills in the dispatch entry points and
+    completes the initialization.
+
+Arguments:
+
+    DriverObject - Supplies a pointer to the object that represents this device
+         driver.
+
+    RegistryPath - Supplies a pointer to the Services key in the registry.
+
+Return Value:
+
+    STATUS_SUCCESS if initialized successfully.
+
+    Error status if the driver could not be initialized.
+
+--*/
+{
+    WDF_OBJECT_ATTRIBUTES Attributes;
+    WDF_DRIVER_CONFIG Config;
+    WDFDRIVER Driver;
+    NTSTATUS Status;
+
+    DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+               ELAMSAMPLE_TRACE_LEVEL,
+               "ElamSample is being initialized.\r\n");
+
+    //
+    // Initialize a non-PnP driver with the framework.
+    //
+
+    WDF_DRIVER_CONFIG_INIT(&Config, WDF_NO_EVENT_CALLBACK);
+
+    Config.DriverInitFlags |= WdfDriverInitNonPnpDriver;
+
+    //
+    // Non-PnP drivers must register an unload routine.
+    //
+
+    Config.EvtDriverUnload = ElamSampleEvtDriverUnload;
+
+    //
+    // Create a framework driver object.
+    //
+
+    WDF_OBJECT_ATTRIBUTES_INIT(&Attributes);
+
+    Status = WdfDriverCreate(DriverObject,
+                             RegistryPath,
+                             &Attributes,
+                             &Config,
+                             &Driver);
+
+    if (!NT_SUCCESS(Status))
+    {
+        return Status;
+    }
+
+    //
+    // Register for the boot driver callback.
+    //
+
+    g_IoRegisterBootDriverCallbackHandle = IoRegisterBootDriverCallback(
+                                                ElamSampleBootDriverCallback,
+                                                NULL);
+
+    if (g_IoRegisterBootDriverCallbackHandle == NULL)
+    {
+        return STATUS_UNSUCCESSFUL;
+    }
+
+    return STATUS_SUCCESS;
+}
+
+VOID
+ElamSampleEvtDriverUnload(
+    _In_ WDFDRIVER Driver
+    )
+/*++
+
+Routine Description:
+
+    This routine is called by the I/O subsystem before unloading the driver.
+
+    It creates the device object, fills in the dispatch entry points and
+    completes the initialization.
+
+Arguments:
+
+    Driver - Supplies a handle to a framework driver object.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    UNREFERENCED_PARAMETER(Driver);
+
+    if (g_IoRegisterBootDriverCallbackHandle != NULL)
+    {
+        IoUnregisterBootDriverCallback(g_IoRegisterBootDriverCallbackHandle);
+        g_IoRegisterBootDriverCallbackHandle = NULL;
+    }
+
+    DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+               ELAMSAMPLE_TRACE_LEVEL,
+               "ElamSample is being unloaded.\r\n");
+}
+
+VOID
+ElamSampleBootDriverCallback(
+    _In_opt_ PVOID CallbackContext,
+    _In_ BDCB_CALLBACK_TYPE Classification,
+    _Inout_ PBDCB_IMAGE_INFORMATION ImageInformation
+    )
+/*++
+
+Routine Description:
+
+    This routine is called by the Operating System when boot start drivers are
+    being initialized.
+
+Arguments:
+
+    CallbackContext - Supplies the opaque context specified during callback
+         registration.
+
+    Classification - Supplies the type of the callback, including status update
+         or image initialized.
+
+    ImageInformation - Supplies a pointer to information about the next boot
+         driver that is about to be initialized.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    PBDCB_STATUS_UPDATE_CONTEXT StatusUpdate;
+
+    //
+    // IoRegisterBootDriverCallback was called with a null context. Ensure that
+    // is passed here.
+    //
+
+    if (CallbackContext != NULL)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample has been passed an unexpected callback context.\r\n");
+    }
+
+    switch (Classification)
+    {
+    case BdCbStatusUpdate:
+        StatusUpdate = (PBDCB_STATUS_UPDATE_CONTEXT)ImageInformation;
+
+        ElamSampleProcessStatusUpdate(StatusUpdate->StatusType);
+        break;
+
+    case BdCbInitializeImage:
+        ElamSampleProcessInitializeImage(ImageInformation);
+        break;
+
+    default:
+        //
+        // Do nothing. If new classifications are supported we should just
+        // ignore them.
+        //
+        break;
+    }
+}
+
+VOID
+ElamSampleProcessStatusUpdate(
+    _In_ BDCB_STATUS_UPDATE_TYPE StatusType
+    )
+/*++
+
+Routine Description:
+
+    This routine processes the BdCbStatusUpdate callback type.
+
+Arguments:
+
+    StatusType - Supplies the type of status that is being reported.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    switch (StatusType)
+    {
+    case BdCbStatusPrepareForDependencyLoad:
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports that Boot Start driver dependencies are being initialized.\r\n\r\n");
+        break;
+
+    case BdCbStatusPrepareForDriverLoad:
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports that Boot Start drivers are about to be initialized.\r\n\r\n");
+        break;
+
+    case BdCbStatusPrepareForUnload:
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports that all Boot Start drivers have been initialized "
+                   "and that ElamSample is about to be unloaded\r\n\r\n");
+        break;
+
+    default:
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports an unknown status type.\r\n\r\n");
+        break;
+    }
+
+    g_CurrentBcdCallbackContextType = StatusType;
+}
+
+VOID
+ElamSampleProcessInitializeImage(
+    _Inout_ PBDCB_IMAGE_INFORMATION ImageInformation
+    )
+/*++
+
+Routine Description:
+
+    This routine processes the BdCbInitializeImage callback type.
+
+Arguments:
+
+    ImageInformation - Supplies a pointer to information about the next boot
+         driver that is about to be initialized.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    //
+    // Is this a dependency or a boot start driver?
+    //
+
+    if (g_CurrentBcdCallbackContextType == BdCbStatusPrepareForDependencyLoad)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports the following dependency is about to be initialized:\r\n");
+    }
+    else if (g_CurrentBcdCallbackContextType == BdCbStatusPrepareForDriverLoad)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports the following Boot Start driver is about to be initialized:\r\n");
+    }
+    else
+    {
+        NT_ASSERT(g_CurrentBcdCallbackContextType == BdCbStatusPrepareForDependencyLoad ||
+                  g_CurrentBcdCallbackContextType == BdCbStatusPrepareForDriverLoad);
+
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample reports an invalid status type for image initialization:\r\n");
+    }
+
+    //
+    // Display the image name and any associated registry path.
+    //
+
+    DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+               ELAMSAMPLE_TRACE_LEVEL,
+               "ElamSample:    Image name \"%wZ\"\r\n",
+               &ImageInformation->ImageName);
+
+    if (ImageInformation->RegistryPath.Buffer != NULL)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    Registry path \"%wZ\"\r\n",
+                   &ImageInformation->RegistryPath);
+    }
+
+    //
+    // Did this image fail Code Integrity checks?
+    //
+
+    if ((ImageInformation->ImageFlags & BDCB_IMAGEFLAGS_FAILED_CODE_INTEGRITY) != 0)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    FAILED Code Integrity checks but boot policy allowed it to be loaded.\r\n");
+    }
+
+    //
+    // Display the image's hash.
+    //
+
+    if (ImageInformation->ImageHash != NULL &&
+        ImageInformation->ImageHashLength != 0)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    Image hash algorithm = 0x%08x.\r\n",
+                   ImageInformation->ImageHashAlgorithm);
+
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    Image hash:");
+
+        ElamSamplePrintHex(ImageInformation->ImageHash,
+                           ImageInformation->ImageHashLength);
+    }
+
+    //
+    // Display who signed the image (if at all).
+    //
+
+    if (ImageInformation->CertificatePublisher.Buffer != NULL)
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    Image is signed by \"%wZ\".\r\n",
+                   &ImageInformation->CertificatePublisher);
+
+        if (ImageInformation->CertificateIssuer.Buffer != NULL)
+        {
+            DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                       ELAMSAMPLE_TRACE_LEVEL,
+                       "ElamSample:    Certificate issued by \"%wZ\".\r\n",
+                       &ImageInformation->CertificateIssuer);
+        }
+
+        if (ImageInformation->CertificateThumbprint != NULL &&
+            ImageInformation->CertificateThumbprintLength != 0)
+        {
+            DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                       ELAMSAMPLE_TRACE_LEVEL,
+                       "ElamSample:    Certificate thumb print algorithm = 0x%08x.\r\n",
+                       ImageInformation->ThumbprintHashAlgorithm);
+
+            DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                       ELAMSAMPLE_TRACE_LEVEL,
+                       "ElamSample:    Certificate thumb print:");
+
+            ElamSamplePrintHex(ImageInformation->CertificateThumbprint,
+                               ImageInformation->CertificateThumbprintLength);
+        }
+    }
+    else
+    {
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "ElamSample:    Not signed.\r\n");
+    }
+
+    DbgPrintEx(DPFLTR_IHVDRIVER_ID, ELAMSAMPLE_TRACE_LEVEL, "\r\n");
+
+    //
+    // Report that we don't know the authenticity of this image.
+    //
+
+    ImageInformation->Classification = BdCbClassificationUnknownImage;
+}
+
+VOID
+ElamSamplePrintHex(
+    _In_reads_bytes_(DataSize) PVOID Data,
+    _In_ ULONG DataSize
+    )
+/*++
+
+Routine Description:
+
+    This routine prints out the supplied data in hexadecimal form.
+
+Arguments:
+
+    Data - Supplies a pointer to the data to be printed.
+
+    DataSize - Supplies the length in bytes of the data to be printed.
+
+Return Value:
+
+    None.
+
+--*/
+{
+    PCUCHAR Bytes;
+    ULONG Index;
+
+    for (Bytes = (PCUCHAR)Data, Index = 0; Index < DataSize; Index++)
+    {
+        if ((Index & 15) == 0)
+        {
+            DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                       ELAMSAMPLE_TRACE_LEVEL,
+                       "\r\nElamSample:    ");
+        }
+
+        DbgPrintEx(DPFLTR_IHVDRIVER_ID,
+                   ELAMSAMPLE_TRACE_LEVEL,
+                   "%02x ",
+                   Bytes[Index]);
+    }
+
+    DbgPrintEx(DPFLTR_IHVDRIVER_ID, ELAMSAMPLE_TRACE_LEVEL, "\r\n");
+}
diff --git a/security/elam/elamsample.h b/security/elam/elamsample.h
new file mode 100644
index 00000000..10dc21f9
--- /dev/null
+++ b/security/elam/elamsample.h
@@ -0,0 +1,174 @@
+/*++
+
+  THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
+  ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO
+  THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
+  PARTICULAR PURPOSE.
+
+  Copyright (c) Microsoft Corporation. All rights reserved
+
+Module Name:
+
+    elamsample.h
+
+Abstract:
+
+    Contains function prototypes and includes other neccessary header files.
+
+Environment:
+
+    Kernel mode only.
+
+--*/
+
+//
+// ------------------------------------------------------------------- Includes
+//
+
+#include <ntddk.h>
+#include <wdf.h>
+
+//
+// -------------------------------------------------------- Function Prototypes
+//
+
+DRIVER_INITIALIZE
+DriverEntry;
+/*++
+
+Routine Description:
+
+    This routine is called by the Operating System to initialize the driver.
+
+    It creates the device object, fills in the dispatch entry points and
+    completes the initialization.
+
+Arguments:
+
+    DriverObject - Supplies a pointer to the object that represents this device
+         driver.
+
+    RegistryPath - Supplies a pointer to the Services key in the registry.
+
+Return Value:
+
+    STATUS_SUCCESS if initialized successfully.
+
+    Error status if the driver could not be initialized.
+
+--*/
+
+EVT_WDF_DRIVER_UNLOAD
+ElamSampleEvtDriverUnload;
+/*++
+
+Routine Description:
+
+    This routine is called by the I/O subsystem before unloading the driver.
+
+    It creates the device object, fills in the dispatch entry points and
+    completes the initialization.
+
+Arguments:
+
+    Driver - Supplies a handle to a framework driver object.
+
+Return Value:
+
+    None.
+
+--*/
+
+VOID
+ElamSampleBootDriverCallback(
+    _In_opt_ PVOID CallbackContext,
+    _In_ BDCB_CALLBACK_TYPE Classification,
+    _Inout_ PBDCB_IMAGE_INFORMATION ImageInformation
+    );
+/*++
+
+Routine Description:
+
+    This routine is called by the Operating System when boot start drivers are
+    being initialized.
+
+Arguments:
+
+    CallbackContext - Supplies the opaque context specified during callback
+         registration.
+
+    Classification - Supplies the type of the callback, including status update
+         or image initialized.
+
+    ImageInformation - Supplies a pointer to information about the next boot
+         driver that is about to be initialized.
+
+Return Value:
+
+    None.
+
+--*/
+
+VOID
+ElamSampleProcessStatusUpdate(
+    _In_ BDCB_STATUS_UPDATE_TYPE StatusType
+    );
+/*++
+
+Routine Description:
+
+    This routine processes the BdCbStatusUpdate callback type.
+
+Arguments:
+
+    StatusType - Supplies the type of status that is being reported.
+
+Return Value:
+
+    None.
+
+--*/
+
+VOID
+ElamSampleProcessInitializeImage(
+    _Inout_ PBDCB_IMAGE_INFORMATION ImageInformation
+    );
+/*++
+
+Routine Description:
+
+    This routine processes the BdCbInitializeImage callback type.
+
+Arguments:
+
+    ImageInformation - Supplies a pointer to information about the next boot
+         driver that is about to be initialized.
+
+Return Value:
+
+    None.
+
+--*/
+
+VOID
+ElamSamplePrintHex(
+    _In_reads_bytes_(DataSize) PVOID Data,
+    _In_ ULONG DataSize
+    );
+/*++
+
+Routine Description:
+
+    This routine prints out the supplied data in hexadecimal form.
+
+Arguments:
+
+    Data - Supplies a pointer to the data to be printed.
+
+    DataSize - Supplies the length in bytes of the data to be printed.
+
+Return Value:
+
+    None.
+
+--*/
diff --git a/security/elam/elamsample.rc b/security/elam/elamsample.rc
new file mode 100644
index 00000000..ea17d2f4
--- /dev/null
+++ b/security/elam/elamsample.rc
@@ -0,0 +1,10 @@
+#include <windows.h>
+
+#include <ntverp.h>
+
+#define VER_FILETYPE             VFT_DRV
+#define VER_FILESUBTYPE          VFT2_DRV_SYSTEM
+#define VER_FILEDESCRIPTION_STR  "Sample Early Launch Anti-Malware Driver using WDF"
+#define VER_INTERNALNAME_STR     "elamsample.sys"
+
+#include "common.ver"
diff --git a/security/elam/elamsample.vcxproj b/security/elam/elamsample.vcxproj
new file mode 100644
index 00000000..e490e121
--- /dev/null
+++ b/security/elam/elamsample.vcxproj
@@ -0,0 +1,141 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{C71588A8-91B3-4830-A8BC-EE0CADD1F74F}</ProjectGuid>
+    <RootNamespace>$(MSBuildProjectName)</RootNamespace>
+    <KMDF_VERSION_MAJOR>1</KMDF_VERSION_MAJOR>
+    <Configuration Condition="'$(Configuration)' == ''">Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+    <SampleGuid>{E8CB1907-B783-4529-86E1-12F5415AB9D2}</SampleGuid>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>False</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>KMDF</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>True</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>KMDF</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>False</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>KMDF</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>True</UseDebugLibraries>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <DriverType>KMDF</DriverType>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <PropertyGroup>
+    <OutDir>$(IntDir)</OutDir>
+  </PropertyGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" />
+  </ImportGroup>
+  <ItemGroup Label="WrappedTaskItems" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <TargetName>elamsample</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <TargetName>elamsample</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <TargetName>elamsample</TargetName>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <TargetName>elamsample</TargetName>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <TreatWarningAsError>true</TreatWarningAsError>
+      <WarningLevel>Level4</WarningLevel>
+      <ExceptionHandling>
+      </ExceptionHandling>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="elamsample.c" />
+    <ResourceCompile Include="elamsample.rc" />
+  </ItemGroup>
+  <ItemGroup>
+    <Inf Exclude="@(Inf)" Include="*.inf" />
+    <FilesToPackage Include="$(TargetPath)" Condition="'$(ConfigurationType)'=='Driver' or '$(ConfigurationType)'=='DynamicLibrary'" />
+    <FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Exclude="@(None)" Include="*.txt;*.htm;*.html" />
+    <None Exclude="@(None)" Include="*.ico;*.cur;*.bmp;*.dlg;*.rct;*.gif;*.jpg;*.jpeg;*.wav;*.jpe;*.tiff;*.tif;*.png;*.rc2" />
+    <None Exclude="@(None)" Include="*.def;*.bat;*.hpj;*.asmx" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>
\ No newline at end of file
diff --git a/security/elam/elamsample.vcxproj.Filters b/security/elam/elamsample.vcxproj.Filters
new file mode 100644
index 00000000..3683aaec
--- /dev/null
+++ b/security/elam/elamsample.vcxproj.Filters
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx;*</Extensions>
+      <UniqueIdentifier>{3A878DCA-5746-41B2-9BE4-9535E3608E01}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Header Files">
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+      <UniqueIdentifier>{531B9233-20AD-48D5-9E0F-A34ECBD0BBCF}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Resource Files">
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms;man;xml</Extensions>
+      <UniqueIdentifier>{A70EFA76-F255-4C79-A344-617EEEFE6F2A}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Driver Files">
+      <Extensions>inf;inv;inx;mof;mc;</Extensions>
+      <UniqueIdentifier>{8CE83F1F-76AF-4984-A91B-7054E133CD6C}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="elamsample.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="elamsample.rc">
+      <Filter>Resource Files</Filter>
+    </ResourceCompile>
+  </ItemGroup>
+</Project>
\ No newline at end of file