blob: ee82e0dafdd88f4364481223bc016ba5bf10007c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
---
page_type: sample
description: "Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver."
languages:
- cpp
products:
- windows
---
<!---
name: Early Launch Anti-Malware Driver
platform: KMDF
language: cpp
category: Security
description: Demonstrates how to receive notifications about the initialization of regular boot start drivers in an Early Launch Anti-Malware driver.
samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617954
--->
# Early Launch Anti-Malware Driver
This sample demonstrates how to use the [**IoRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439379) and [**IoUnRegisterBootDriverCallback**](http://msdn.microsoft.com/en-us/library/windows/hardware/hh439394) DDIs from an Early Launch Anti-Malware driver, to receive notifications about the initialization of regular boot start drivers.
This sample driver is a minimal driver meant to demonstrate the usage of the APIs mentioned above. It is not intended for use in a production environment.
## Signing the sample
Early Launch drivers are required to be signed with a code-signing certificate that also contains the Early Launch EKU "1.3.6.1.4.1.311.61.4.1". In a production environment, Early Launch drivers are signed by Microsoft for qualifying Anti-Malware vendors with a WHQL certificate that contains this EKU. The makecert.exe tool can be used to generate a self-signed test certificate that contains both the Early Launch EKU and the "1.3.6.1.5.5.7.3.3" Code Signing EKU. Once a certificate of this form has been created, signtool.exe can be used to sign elamsample.sys.
## Run the sample
### Installing the sample
1. Copy the signed elamsample.sys file to the %WINDIR%\\System32\\Drivers directory on your test machine.
2. Use the sc.exe tool present in Windows to install the driver:
`sc create ElamSample binpath=%windir%\\system32\\drivers\\elamsample.sys type=kernel start=boot error=critical group=Early-Launch`
3. Enable test signing:
`bcdedit /set testsigning on`
## Code tour
**DriverEntry:** Creates a framework driver object and calls IoRegisterBootDriverCallback to register to boot driver status callbacks.
**ElamSampleEvtDriverUnload:** Calls IoUnregisterBootDriverCallback to unregister for callbacks when elamsample.sys is about to be unloaded.
**ElamSampleBootDriverCallback**: Dispatches to other functions to process the specific callback types.
**ElamSampleProcessStatusUpdate:** Displays callback BdCbStatusUpdate information, such as when dependencies and drivers are about to be initialized, or when the ELAM driver is about to be unload.
**ElamSampleProcessInitializeImage:** Displays callback BdCbInitializeImage information, such as the driver image name and the name of the entity that signed the driver.
**ElamSamplePrintHex:** A utility function to display a buffer in hexadecimal form.
## Testing
After installing the driver, attach the Kernel Debugger and reboot your test machine. If ELAMSAMPLE\_TRACE\_LEVEL is set to DPFLTR\_ERROR\_LEVEL, traces will be output to the debugger automatically. For example:
```cmd
ElamSample is being initialized.
ElamSample reports the following dependency is about to be initialized: ElamSample:
Image name "\\FileSystem\\RAW"
ElamSample: Not signed.
ElamSample reports that Boot Start driver dependencies are being initialized.
ElamSample reports the following dependency is about to be initialized:
ElamSample: Image name "\\SystemRoot\\system32\\PSHED.dll"
ElamSample: Image hash algorithm = 0x0000800c.
ElamSample: Image hash:
ElamSample: 21 29 88 ca 88 ab dc 0f c3 f1 c0 74 df e0 29 58
ElamSample: 2e cd 41 5e 56 bd 77 53 39 9b d9 d7 f4 47 65 d8
ElamSample: Image is signed by "Microsoft Windows".
ElamSample: Certificate issued by "MSIT Test CodeSign CA 3".
ElamSample: Certificate thumb print algorithm = 0x0000800c.
ElamSample: Certificate thumb print:
ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3
ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f
ElamSample reports that Boot Start drivers are about to be initialized.
ElamSample reports the following Boot Start driver is about to be initialized:
ElamSample: Image name "\\SystemRoot\\System32\\drivers\\rdyboost.sys"
ElamSample: Registry path "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\rdyboost"
ElamSample: Image hash algorithm = 0x0000800c.
ElamSample: Image hash:
ElamSample: 9e 91 b2 e1 29 97 af e9 ac 6c 48 24 01 43 c8 b4
ElamSample: f6 81 bf 57 df 80 0b 05 4d 58 bb e6 d9 83 a9 08
ElamSample: Image is signed by "Microsoft Windows".
ElamSample: Certificate issued by "MSIT Test CodeSign CA 3".
ElamSample: Certificate thumb print algorithm = 0x0000800c.
ElamSample: Certificate thumb print:
ElamSample: 93 29 d5 f2 e2 7a c9 79 41 b2 6d c0 78 35 2a d3
ElamSample: da 2d 7e 72 f0 05 5f 8b 63 8c 7b a2 6b 37 5c 4f
ElamSample reports that all Boot Start drivers have been initialized and that ElamSample is about to be unloaded ElamSample is being unloaded.
```
|
