Re: Can we link a windows driver (.sys) with our own code ?...
- From: "Carl Woodward" <news@themonkey*removemeplease*alliance.com>
- Date: Mon, 28 Nov 2005 10:18:41 GMT
If you want to intercept calls to the kernel, then you could just hook
imports via modifing the Import Address Table of the driver you wish to
modify the behaviour of. Set the IAT entry to point at a function in your
driver and then modify the call/pass it on/reject/block the call. That
should cover most of your requirements.
That said, there are many ways of filtering devices that might achieve your
goals in a more orthadox (and probably more stable) way. What are you trying
to achieve?
Carly
"zhiyuan" <gis93536@xxxxxxxxxxxxxxx> wrote in message
news:OE7ZiBA9FHA.808@xxxxxxxxxxxxxxxxxxxxxxx
> Hi,
>
> Do anybody know how to link a windows driver (.sys) file with our own
> object file ?
>
> Our goal is to intercept the function calls that the driver invokes to
> the windows kernel.
> Once a function call is intercepted, we can do some preprocessing jobs,
> such as logging the
> number of invocations, etc.
>
> For example, if a driver invokes a function foo() provided by the windows
> kernel, we can implement a fake foo() and
> link it with the driver so as to intercept the function call. The fake
> foo() performs the following 2 jobs.
> First, it does some preprocessing job. Second, it calls the real foo() of
> the windows kernel.
>
> So, we need to ...
>
> 1. Obtain the symbols of the .sys driver to get the names of the functions
> that called by the driver to the kernel.
> Note: We don't have the source code of the driver, only the .sys file is
> available.
>
> 2. Link our interception code (i.e., fake functions) with the .sys driver.
>
> The question is that is it possible to achieve the above jobs. If it is
> possible, how ?
>
> Thanks very much for your help!
>
.
- Follow-Ups:
- References:
- Prev by Date: Re: how to implement a virtual video driver base on testcap?
- Next by Date: Re: help needed for system crash
- Previous by thread: Can we link a windows driver (.sys) with our own code ?...
- Next by thread: Re: Can we link a windows driver (.sys) with our own code ?...
- Index(es):
Relevant Pages
|
|
