A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #8307  by madaboo
 Sat Aug 27, 2011 9:02 pm
Hi.


1. Got legacy driver (installed via SCManager) -nothing compliacated - two defined ioclts supported - it is working. Lets call'm 'Reg' it is creating device RegDev0
2. Now I've prepare filter driver for driver A - RegFlt that is creating devce object RegDev0Flt in this driver I'm calling IoAttachToDeviceStack and simply logging all irp communicaiton.

Here is inf file:

;-------------------------------------------------------------------------
; RegDev0Flt.INF -- driver filter
;-------------------------------------------------------------------------
[version]
Signature = "$Windows NT$"
;WHAT CLASS?
; WHAT GUIDCLASS
Provider = %Mews%
DriverVer = 13/07/2011,6.0.5019.0

;-------------------------------------------------------------------------
; Installation Section
;-------------------------------------------------------------------------
[Install]
AddReg=Inst_Flt
Copyfiles = RegDev0Flt.copyfiles.sys

[SourceDisksNames]
1=%RegDev0Flt_Desc%,"",,

[SourceDisksFiles]
RegDev0Flt.sys=1

[DestinationDirs]
DefaultDestDir=12
RegDev0Flt.copyfiles.sys=12

[RegDev0Flt.copyfiles.sys]
RegDev0Flt.sys,,,2


[Inst_Flt]
;Here probably I should use UpperFilter - but
;I dont know how to do this

;-------------------------------------------------------------------------
; Service installation support
;-------------------------------------------------------------------------
[Install.Services]
AddService=RegDev0Flt,,RegDev0Flt_Service_Inst

[RegDev0Flt_Service_Inst]
DisplayName = %RegDev0Flt_Desc%
ServiceType = 1 ;SERVICE_KERNEL_DRIVER
StartType = 3
ErrorControl = 1 ;SERVICE_ERROR_NORMAL
ServiceBinary = %12%\RegDev0Flt.sys
;LoadOrderGroup = NDIS
Description = %RegDev0Flt_Desc%
;AddReg = Common.Params.reg

[Install.Remove.Services]
DelService=RegDev0Flt,0x200


[Strings]
Mews = "MewsInc"
RegDev0Flt_Desc = "RegDev0Flt"
RegDev0Flt_HelpText = "blah blah"


I don;t even know if chkinf will parse it propely - so there can be a lot of mistakes.
I just would like to know how can I make my filter driver installed properly?
I've found following article:
http://www.osronline.com/ddkx/install/specinst_2bxj.htm
that is probably usefull BUT I'm not sure how Addreg with Upperfilter really works.

I mean - where is information that RegFlt is filter exactly for RegDev0 device?
How can I achieve this?
Assumption here is made that filter driver should be installed BEFORE Reg driver is loaded.


Thank you for joining to discussion and please be patient since I'm n00b in this area.