summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorBarry Golden <[email protected]>2019-03-12 14:02:43 -0700
committerAdonais Romero González <[email protected]>2019-03-12 14:02:43 -0700
commitef7ec4ec9ff7ce3c53d60e1c8906915966e17e01 (patch)
tree3017523a73c6552c27947d402afa6062f4df2706 /security
parent35bff356ac249057f4d673d39c7f28ed348cbf0f (diff)
Update README.md for samples portal (#358)
* Update README.md for samples portal * Update README.md for samples portal * Removed installwdf * Update fork (#2) * Fix typo ture -> true * Remove InstallWdf sample * Fix typo (#340) ture -> true * Readme typo fix (#349) * Update langid
Diffstat (limited to 'security')
-rw-r--r--security/elam/README.md32
-rw-r--r--security/elam/security-elam.yml12
2 files changed, 19 insertions, 25 deletions
diff --git a/security/elam/README.md b/security/elam/README.md
index bbd5b772..ff09abf2 100644
--- a/security/elam/README.md
+++ b/security/elam/README.md
@@ -1,3 +1,13 @@
+---
+topic: sample
+name: Early Launch Anti-Malware Driver
+description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver.
+languages:
+ - cpp
+products:
+ - windows
+---
+
<!---
name: Early Launch Anti-Malware Driver
platform: KMDF
@@ -7,35 +17,31 @@
samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617954
--->
-
-Early Launch Anti-Malware Driver
-================================
+# Early Launch Anti-Malware Driver
This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers.
This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment.
-**SIGNING THE SAMPLE**
+## Signing the sample
Early Launch drivers are required to be signed with a code-signing certificate that also contains the Early Launch EKU "1.3.6.1.4.1.311.61.4.1". In a production environment, Early Launch drivers are signed by Microsoft for qualifying Anti-Malware vendors with a WHQL certificate that contains this EKU. The makecert.exe tool can be used to generate a self-signed test certificate that contains both the Early Launch EKU and the "1.3.6.1.5.5.7.3.3" Code Signing EKU. Once a certificate of this form has been created, signtool.exe can be used to sign elamsample.sys.
+## Run the sample
-Run the sample
---------------
-
-**INSTALLING THE SAMPLE**
+### Installing the sample
1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine.
2. Use the sc.exe tool present in Windows to install the driver:
- `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch`
+ `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch`
3. Enable test signing:
- `bcdedit /set testsigning on`
+ `bcdedit /set testsigning on`
-**CODE TOUR**
+## Code tour
**DriverEntry:** Creates a framework driver object and calls IoRegisterBootDriverCallback to register to boot driver status callbacks.
@@ -49,11 +55,11 @@ Run the sample
**ElamSamplePrintHex:** A utility function to display a buffer in hexadecimal form.
-**TESTING**
+## Testing
After installing the driver, attach the Kernel Debugger and reboot your test machine. If ELAMSAMPLE\_TRACE\_LEVEL is set to DPFLTR\_ERROR\_LEVEL, traces will be output to the debugger automatically. For example:
-```
+```cmd
ElamSample is being initialized.
ElamSample reports the following dependency is about to be initialized: ElamSample:
diff --git a/security/elam/security-elam.yml b/security/elam/security-elam.yml
deleted file mode 100644
index 8a338784..00000000
--- a/security/elam/security-elam.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-### YamlMime:Sample
-sample:
-- name: Early Launch Anti-Malware Driver
- description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver.
- generateZip: true
- preserveParentHierarchy: true
- author: windows-driver-samples
- languages:
- - cpp
- technologies:
- - windows
- vssolution: /security/elam/elam.sln