- -

ELAMSAMPLE

- -

SUMMARY

- -

This -sample demonstrates how to use the APIs IoRegisterBootDriverCallback -and IoUnRegisterBootDriverCallback from an Early -Launch Anti-Malware driver, to receive notifications about the initialization -of regular boot start drivers

- -

The -building and installation instructions given here apply to Windows® 8 and later -operating systems.

- -

This -sample driver is a minimal driver meant to demonstrate the usage of the APIs -mentioned above. It is not intended for use in a production environment.

- -

BUILDING THE SAMPLE

- -

Click the -Free Build Environment or Checked Build Environment icon under Development Kits -program group to set basic environment variables.

- -

Change to -the directory containing the device source code, such as “src\security\elam”.

- -

Run build --ceZ, or use the macro BLD. This command -invokes the Microsoft make routines to build the components. If the build succeeds, you will -find the driver, elamsample.sys, in the binary output directory specified for -the build environment. You can get the output path from the buildxxx.log file. -If it fails you can find errors and warnings in the buildxxx.err -and buildxxx.wrn respectively.

- -

SIGNING THE SAMPLE

- -

Early Launch -drivers are required to be signed with a code-signing certificate that also -contains the Early Launch EKU "1.3.6.1.4.1.311.61.4.1". -In a production environment, Early Launch drivers are signed by Microsoft for -qualifying Anti-Malware vendors with a WHQL certificate that contains this EKU. -The makecert.exe tool can be used to generate a self-signed test certificate -that contains both the Early Launch EKU and the “1.3.6.1.5.5.7.3.3” Code -Signing EKU. Once a certificate of this form has been created, signtool.exe can -be used to sign elamsample.sys.

- -

INSTALLATION

- -

1. -Copy -the signed elamsample.sys file to the %WINDIR%\System32\Drivers directory on -your test machine.

- -

2. -Use -the sc.exe tool present in Windows to install the driver:

- -

sc create ElamSample binpath=%windir%\system32\drivers\elamsample.sys type=kernel start=boot error=critical group=Early-Launch

- -

3. -Enable -test signing:

- -

bcdedit /set testsigning -on

- -

CODE -TOUR

- -

DriverEntry - Creates a framework driver object and -calls IoRegisterBootDriverCallback to register to -boot driver status callbacks.

- -

ElamSampleEvtDriverUnload: Calls IoUnregisterBootDriverCallback -to unregister for callbacks when elamsample.sys is about to be unloaded.

- -

ElamSampleBootDriverCallback: Dispatches to other -functions to process the specific callback types.

- -

ElamSampleProcessStatusUpdate: Displays callback BdCbStatusUpdate information, such as when dependencies and -drivers are about to be initialized, or when the ELAM driver is about to be -unload.

- -

ElamSampleProcessInitializeImage: Displays callback BdCbInitializeImage information, such as the driver image -name and the name of the entity that signed the driver.

- -

ElamSamplePrintHex: A utility function to display a -buffer in hexadecimal form.

- -

TESTING

- -

After installing the driver, attach the Kernel -Debugger and reboot your test machine. If ELAMSAMPLE_TRACE_LEVEL is set to DPFLTR_ERROR_LEVEL, -traces will be output to the debugger automatically. For example:

- -

ElamSample is being initialized.

- -

ElamSample reports the following dependency is about to be initialized:

- -

ElamSample: Image name "\FileSystem\RAW"

- -

ElamSample: Not signed.

- -

ElamSample reports that Boot Start driver dependencies are being initialized.

- -

ElamSample reports the following dependency is about to be initialized:

- -

ElamSample: Image name "\SystemRoot\system32\PSHED.dll"

- -

ElamSample: Image hash algorithm = -0x0000800c.

- -

ElamSample: Image hash:

- -

ElamSample: 21 29 88 ca 88 ab dc 0f c3 f1 c0 74 df e0 29 58

- -

ElamSample: 2e cd 41 5e 56 bd 77 53 39 9b d9 d7 f4 47 65 d8

- -

ElamSample: Image is signed by -"Microsoft Windows".

- -

ElamSample: Certificate issued by -"MSIT Test CodeSign CA 3".

- -

ElamSample: Certificate thumb print -algorithm = 0x0000800c.

- -

ElamSample: Certificate thumb print:

- -

ElamSample: 93 29 d5 f2 e2 7a c9 79 41 -b2 6d c0 78 35 2a d3

- -

ElamSample: da 2d 7e 72 f0 05 5f 8b 63 -8c 7b a2 6b 37 5c 4f

- -

ElamSample reports that Boot Start drivers are about to be initialized.

- -

ElamSample reports the following Boot Start driver is about to be initialized:

- -

ElamSample: Image name "\SystemRoot\System32\drivers\rdyboost.sys"

- -

ElamSample: Registry path -"\Registry\Machine\System\CurrentControlSet\Services\rdyboost"

- -

ElamSample: Image hash algorithm = -0x0000800c.

- -

ElamSample: Image hash:

- -

ElamSample: 9e 91 b2 e1 29 97 af e9 ac 6c 48 24 01 43 c8 b4

- -

ElamSample: f6 81 bf 57 df 80 0b 05 4d 58 bb e6 d9 83 a9 -08

- -

ElamSample: Image is signed by -"Microsoft Windows".

- -

ElamSample: Certificate issued by -"MSIT Test CodeSign CA 3".

- -

ElamSample: Certificate thumb print -algorithm = 0x0000800c.

- -

ElamSample: Certificate thumb print:

- -

ElamSample: 93 29 d5 f2 e2 7a c9 79 41 -b2 6d c0 78 35 2a d3

- -

ElamSample: da 2d 7e 72 f0 05 5f 8b 63 -8c 7b a2 6b 37 5c 4f

- -

ElamSample reports that all Boot Start drivers have been initialized and that ElamSample is about to be unloaded

- -

ElamSample is being unloaded.

- -

File Manifest

- -

File                           Description

ElamSample.htm                 Documentation for this sample (this file).

ElamSample.c                   DriverEntry and Callback processing.

ElamSample.h                   Header file with definitions and prototypes.

ElamSample.rc                  Resource file for the sample.

Sources                        Generic file that lists source files and all the build options.

- -

Top -of page -

- - - - - -

- -