[SecConnex]

I was wondering what would be a good idea to get started on antivirus driver development?

What routines are used in the driver?

[a_d_13]

Specifically what kind of AV driver are you talking about here? If you're talking about a driver to do on-access scanning, then check out the "scanner" sample in the Windows Driver Development Kit for a great example.

If you're talking about self-protection, please check out the recent thread here.

If you're talking about detecting kernel-mode rootkits, then you may want to take a look at some well-known source code for stuff like:
- Hidden Process Detection
- Hidden Driver Detection

Does that answer your question?


Thanks,
--AD

[SecConnex]

Thanks very much.

Another question...would those all be separate drivers?

1. On-access scanning
2. Self-protection
3. Detecting kernel-mode rootkits

[a_d_13]

That's entirely up to the discretion of the developer. You may find it easier to make one separate driver for each function, or just have one driver for everything. From a development point of view, though, the on-access scanning component should always be in own driver, as it needs to be as fast as possible.

Thanks,
--AD

[SecConnex]

Great. I will see what the developers say on my end. :) Thanks.

[__Genius__]

@ DragonMaster Jay ,
You can say thanks by using give reputation to who answered you correctly :)
regards.