diff options
| author | Barry Golden <[email protected]> | 2019-03-12 14:02:43 -0700 |
|---|---|---|
| committer | Adonais Romero González <[email protected]> | 2019-03-12 14:02:43 -0700 |
| commit | ef7ec4ec9ff7ce3c53d60e1c8906915966e17e01 (patch) | |
| tree | 3017523a73c6552c27947d402afa6062f4df2706 /security | |
| parent | 35bff356ac249057f4d673d39c7f28ed348cbf0f (diff) | |
Update README.md for samples portal (#358)
* Update README.md for samples portal
* Update README.md for samples portal
* Removed installwdf
* Update fork (#2)
* Fix typo
ture -> true
* Remove InstallWdf sample
* Fix typo (#340)
ture -> true
* Readme typo fix (#349)
* Update langid
Diffstat (limited to 'security')
| -rw-r--r-- | security/elam/README.md | 32 | ||||
| -rw-r--r-- | security/elam/security-elam.yml | 12 |
2 files changed, 19 insertions, 25 deletions
diff --git a/security/elam/README.md b/security/elam/README.md index bbd5b772..ff09abf2 100644 --- a/security/elam/README.md +++ b/security/elam/README.md @@ -1,3 +1,13 @@ +--- +topic: sample +name: Early Launch Anti-Malware Driver +description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver. +languages: + - cpp +products: + - windows +--- + <!--- name: Early Launch Anti-Malware Driver platform: KMDF @@ -7,35 +17,31 @@ samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617954 ---> - -Early Launch Anti-Malware Driver -================================ +# Early Launch Anti-Malware Driver This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers. This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment. -**SIGNING THE SAMPLE** +## Signing the sample Early Launch drivers are required to be signed with a code-signing certificate that also contains the Early Launch EKU "1.3.6.1.4.1.311.61.4.1". In a production environment, Early Launch drivers are signed by Microsoft for qualifying Anti-Malware vendors with a WHQL certificate that contains this EKU. The makecert.exe tool can be used to generate a self-signed test certificate that contains both the Early Launch EKU and the "1.3.6.1.5.5.7.3.3" Code Signing EKU. Once a certificate of this form has been created, signtool.exe can be used to sign elamsample.sys. +## Run the sample -Run the sample --------------- - -**INSTALLING THE SAMPLE** +### Installing the sample 1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine. 2. Use the sc.exe tool present in Windows to install the driver: - `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch` + `sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch` 3. Enable test signing: - `bcdedit /set testsigning on` + `bcdedit /set testsigning on` -**CODE TOUR** +## Code tour **DriverEntry:** Creates a framework driver object and calls IoRegisterBootDriverCallback to register to boot driver status callbacks. @@ -49,11 +55,11 @@ Run the sample **ElamSamplePrintHex:** A utility function to display a buffer in hexadecimal form. -**TESTING** +## Testing After installing the driver, attach the Kernel Debugger and reboot your test machine. If ELAMSAMPLE\_TRACE\_LEVEL is set to DPFLTR\_ERROR\_LEVEL, traces will be output to the debugger automatically. For example: -``` +```cmd ElamSample is being initialized. ElamSample reports the following dependency is about to be initialized: ElamSample: diff --git a/security/elam/security-elam.yml b/security/elam/security-elam.yml deleted file mode 100644 index 8a338784..00000000 --- a/security/elam/security-elam.yml +++ /dev/null @@ -1,12 +0,0 @@ -### YamlMime:Sample -sample: -- name: Early Launch Anti-Malware Driver - description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver. - generateZip: true - preserveParentHierarchy: true - author: windows-driver-samples - languages: - - cpp - technologies: - - windows - vssolution: /security/elam/elam.sln |
