Windows Kernel Programming

Windows Internals quick overview

• Processes and threads

• System architecture

• User / kernel transitions

• Thread synchronization

• Virtual memory

• Objects and handles

• Summary

The I/O System

• I/O System overview

• Device Drivers

• The Windows Driver Model (WDM)

• The Kernel Mode Driver Framework (KMDF)

• Other device driver models

• Driver types

• Software drivers

• Driver and device objects

• I/O Processing and Data Flow

• Accessing devices

• Asynchronous I/O

• Summary

Kernel programming basics

• Installing the tools: Visual Studio, SDK, WDK

• C++ in a kernel driver

• Creating a driver project

• Building and deploying

• The kernel API

• Strings

• Linked Lists

• The DriverEntry function

• The Unload routine

• Installation, Deployment

• Summary

• Lab: create a simple driver; deploy a driver

Building a simple driver

• Creating a device object

• Exporting a device name

• Building a driver client

• Driver dispatch routines

• Introduction to I/O Request Packets (IRPs)

• Completing IRPs

• Handling DeviceIoControl calls

• Testing the driver

• Debugging the driver

• Using WinDbg with a virtual machine

• Summary

• Lab: open a process for any access; zero driver; debug a driver

Kernel mechanisms

• Interrupt Request Levels (IRQLs)

• Interrupts

• Deferred Procedure Calls (DPCs)

• Asynchronous Procedure Calls (APCs)

• Dispatcher objects

• Low IRQL Synchronization

• Spin locks

• Work items

• Summary

Process and thread monitoring

• Motivation

• Process creation/destruction callback

• Specifying process creation status

• Thread creation/destruction callback

• Notifying user mode

• Writing a user mode client

• Preventing potentially malicious processes from executing

• Summary

• Lab: monitoring process/thread activity; prevent specific processes from running

Object and registry notifications

• Lab continuation from day 3

• Process/thread object notifications

• Pre and post callbacks

• Registry notifications

• Performance considerations

• Reporting results to user mode

• Summary

• Lab: protect specific process from termination; simple registry monitor

File system mini filters

• File system model

• Filters vs. mini filters

• The Filter Manager

• Filter registration

• Pre and Post callbacks

• File name information

• Contexts

• File system operations

• Filter to user mode communication

• Debugging mini-filters

• Summary

• Lab: protect a directory from write; hide a directory; backup file before deletion