This is just a little starter for people interested in starting Kernel-Mode Development
By following an good thread on UIC forum, opened by a beginner that wanted to know how to start with Device Driver Development, I remembered that long time ago published a similar blog post on that subject.
Now I'm going to Reload and Expand it.
Development Tools
1. WDK/DDK - this is the proper Driver Development SDK given by Microsoft, latest edition can be dowloaded 62bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6p5k6i4k6f1L8$3!0D9M7#2)9J5c8W2N6p5d9#2)9J5c8W2N6p5d9%4m8C8k6#2)9J5k6h3#2K6M7s2R3`.
2. Visual Studio 2008/2010 - you can also develop without VS, but I always prefer all the Comforts given by a such advanced IDE, especially in presence of complex device drivers.
3. DDKWizard - DDKWizard is a so-called project creation wizard (for VisualStudio) that allows you to create projects that use the DDKBUILD scripts from OSR (also available in the download section from this site). The wizard will give you several options to configure your project prior to the creation. You can download it 973K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8V1K9%4N6A6P5X3q4J5k6q4)9J5k6h3q4K6M7$3q4J5j5X3q4V1i4K6u0W2L8X3g2@1i4K6u0r3
4. VisualAssist - (Optional Tool) Visual Assist X provides productivity enhancements that help you read, write, navigate and refactor code with blazing speed in all Microsoft IDEs. You can Try/Buy it f1eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6Z5L8$3I4W2N6r3!0E0j5i4c8G2i4K6u0W2j5$3!0E0i4K6u0r3
5. VisualDDK - Develop and Debug drivers directly from VS, enjoy debugging your driver directly from Visual Studio, speeding up debugging ~18x for VMWare and ~48x for VirtualBox. Download and Step by Step Quick Start Guide 51eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4k6A6M7%4g2S2L8r3c8V1K9#2)9J5k6i4y4&6M7%4m8J5L8$3N6K6i4K6u0W2L8%4u0Y4i4K6u0r3M7i4g2A6j5$3E0K6N6r3q4J5N6q4)9J5c8R3`.`.
6. Virtual Machine - You need a Virtual Machine to perform efficient Driver Debugging, best options are VMWare or VirtualBox.
Building a Driver Development Environment
As you can see, a good comfortable Driver Development station is composed by a good amount of components, so we need an installation order.
1. Install your IDE - VisualStudio2008 or VisualStudio2010
2. Install WDK package
3. Install DDKWizard
4. Download and place ( usually into C:\WinDDK ) ddkbuild.cmd
5. By following DDKWizard pdf you will be driven to add an new Envirnment Variable directly releated to the OS version in which you are developing and successively add a reference of ddkbuild.cmd into VS IDE. DDWizard Manual is very well written.
6. After finishing DDKWizard integration you can test if your environment is correctly installed, by compilig your first driver. Steps are easy open VS and select DDKWizard templare (not EmptyDriver), you will see the skeleton of a Driver, all what you have to do is to Build Solution and Verify if No Compiling Errors occur, your station is correctly installed.
7. Install VirtualMachine
8. Integrate Debugging help of VisualDDK by following step by step quick start guide
9. Install Visual Assist (this can be done in every moment after VS Installation)
Additional Tools
* DeviceTree - This utility has two views: (a) one view that will show you the entire PnP enumeration tree of device objects, including relationships among objects and all the device's reported PnP characteristics, and (b) a second view that shows you the device objects created, sorted by driver name. There is nothing like this utility available anywhere else. Download it e46K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3!0K6M7X3!0F1L8r3W2F1k6g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3X3g2U0k6X3#2Q4x3@1k6S2M7Y4c8A6j5$3I4W2i4K6y4p5z5e0M7`.
* IrpTracker - IrpTracker allows you to monitor all I/O request packets (IRPs) on a system without the use of any filter drivers and with no references to any device objects, leaving the PnP system entirely undisturbed. In addition to being able to see the path the IRP takes down the driver stack and its ultimate completion status, a detailed view is available that allows you to see the entire contents of static portion of the IRP and an interpreted view of the current and previous stack locations. Download it 5afK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3!0K6M7X3!0F1L8r3W2F1k6g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3X3g2U0k6X3#2Q4x3@1k6S2M7Y4c8A6j5$3I4W2i4K6y4p5x3e0V1&6
* DebugMon - Displays DbgPrint messages generated by any driver in the system (or the OS itself) in the application window. Can be used either in local mode or can send the DbgPrint messages to another system via TCP/IP. Download it ffdK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3!0K6M7X3!0F1L8r3W2F1k6g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3X3g2U0k6X3#2Q4x3@1k6S2M7Y4c8A6j5$3I4W2i4K6y4p5z5e0V1`.
* DriverLoader - This GUI-based tool will make all the appropriate registry entries for your driver, and even allow you to start your driver without rebooting. It's even got a help file, for goodness sakes! If you write drivers, this is another one of those utilities that's a must have for your tool chest. x86 architecture. Dowload it 328K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3!0K6M7X3!0F1L8r3W2F1k6g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2Q4x3X3g2U0k6X3#2Q4x3@1k6S2M7Y4c8A6j5$3I4W2i4K6y4p5x3e0f1%4
Now you have a full working Develop and Debug Station.
As you should imagine, dealing with driver development implies working with at Kernel Mode, a task pretty challenging, delicate and complex. A badly written driver lead to OS Crash and/or dangerous bugs, just think about a driver used in mission-critical applications like Surgery, a bug or a crash could lead to extremely big dangers. The driver need to be:
* Bug Free
* Fault Tolerant
* Ready to Endure all Stress Situations
This could be done, only by the driver coder, with a large knowledge of following fields:
* Hardware Architecture
* Operating System Architecture
* Kernel and User Mode Architecture
* Rock Solid C language knowledge
* Debugging Ability
Here i'm going to enumerate necessary Documentation/Book/Etc. necessary to acheive a *good and solid* background and advanced knowledge about driver coding.
Microsoft WDK Page: c0eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6V1k6i4k6@1L8$3!0D9M7#2)9J5c8W2N6p5d9#2)9J5c8X3c8W2k6X3q4#2L8s2c8Q4x3X3g2E0M7%4m8^5
PC Fundamentals: 648K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1k6h3k6S2N6h3I4@1i4K6u0W2L8i4y4H3P5l9`.`.
This will give you an large view of 'what mean developing a driver' which components are touched and which aspects you need to know.
It's also obviously necessary to have a Reference about kernel mode involved Functions and Mechanisms, the first best resource is always MSDN, here the starter link to follow MSDN->DDK
As pointed out in the previous blog post, one of the best starting point, that will give you an on-fly-view of development topics is the Toby Opferman set of articles:
Driver Development Part 1: Introduction to Drivers
1c3K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4k6Q4x3X3g2S2M7%4m8^5
Driver Development Part 2: Introduction to Implementing IOCTLs
c15K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4j5J5i4K6u0W2j5i4y4H3P5l9`.`.
Driver Development Part 3: Introduction to driver contexts
8c5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4j5K6i4K6u0W2j5i4y4H3P5l9`.`.
Driver Development Part 4: Introduction to device stacks
e00K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4j5@1j5i4y4H3i4K6u0W2j5i4y4H3P5l9`.`.
Driver Development Part 5: Introduction to the Transport Device Interface
15aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4j5#2j5i4y4H3i4K6u0W2j5i4y4H3P5l9`.`.
Driver Development Part 6: Introduction to Display Drivers
619K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2H3M7X3!0B7k6h3y4@1i4K6u0W2j5$3!0E0i4K6u0r3d9@1u0Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6V1M7X3W2$3k6i4u0V1k6i4j5$3j5i4y4H3i4K6u0W2j5i4y4H3P5l9`.`.
It's really important to put in evicence MemoryManagement at KernelMode, the best starting point for these aspects are tutorials written by four-f;
Handling IRPs: What Every Driver Writer Needs to Know
ee3K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8G2N6$3&6D9L8$3q4V1i4K6u0W2L8h3W2U0M7X3!0K6L8$3k6@1i4K6u0W2j5$3!0E0i4K6u0r3k6r3!0%4L8X3I4G2j5h3c8Q4x3V1j5`. ... a/IRPs.doc
Book Resources
Tutorial are a great starting point, but a solid understanding is given by a set of 'abstracts', emerges the necessity of a good Book Collection:
Windows NT Device Driver Development (OSR Classic Reprints)
a4cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4E0j5i4A6G2L8W2)9J5k6h3y4G2L8g2)9J5c8W2N6A6L8X3c8G2N6%4y4Q4x3X3c8p5k6i4k6A6j5$3g2Q4x3X3c8p5k6b7`.`. ... 242&sr=8-2
The Windows 2000 device driver book: a guide for programmers
55cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4E0j5i4A6G2L8W2)9J5k6h3y4G2L8g2)9J5c8W2N6A6L8X3c8G2N6%4y4Q4x3X3b7J5x3o6l9H3i4K6u0V1c8r3g2$3K9b7`.`. ... 0130204315
Windows NT/2000 Native API Reference
349K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4E0j5i4A6G2L8W2)9J5k6h3y4G2L8g2)9J5c8W2N6A6L8X3c8G2N6%4y4Q4x3X3b7J5x3o6l9H3i4K6u0V1e0X3q4@1K9b7`.`. ... 201&sr=8-1
Undocumented Windows 2000 Secrets
decK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4g2F1k6r3!0U0N6h3#2W2L8Y4c8W2k6q4)9J5k6i4u0S2N6$3!0D9i4K6u0W2j5$3!0E0i4K6u0r3
Developing Drivers with WDF
f3eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6V1M7X3W2$3k6i4u0Q4x3V1k6%4k6r3k6Q4x3V1k6%4k6r3k6T1L8$3!0C8i4K6u0W2L8i4y4H3P5l9`.`.
Windows NT File System Internals, A Developer's Guide
445K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3!0J5k6h3W2D9L8s2W2Q4x3X3g2U0L8$3#2Q4x3V1k6U0j5i4c8S2L8r3!0Y4i4K6u0r3z5e0M7^5x3e0f1$3y4e0V1J5x3U0b7&6y4b7`.`.
Web Resources
The first and most important resource about Windows Driver Development is OSROnline:
Information, Articles, and Free Downloads
e8cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3S2G2L8r3I4A6M7%4c8W2j5$3S2Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6i4y4G2N6i4u0U0k6i4y4Q4x3X3g2Z5N6r3@1`.
The Undocumented Functions
6dfK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4g2F1k6r3!0U0N6h3#2W2L8Y4c8W2k6q4)9J5k6h3&6@1K9h3&6@1k6i4u0F1j5h3I4K6i4K6u0W2L8X3g2@1
Blog MSDN
76fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6K6i4K6u0W2L8i4y4V1L8W2)9J5k6h3y4G2L8g2)9J5c8X3W2D9K9h3q4K6N6l9`.`.
Windows Vista Kernel Structures
d8dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3&6A6M7Y4y4G2k6Y4c8Q4x3X3g2F1k6i4c8Q4x3V1k6C8k6i4u0F1k6h3I4Q4y4h3k6K6N6s2u0#2j5%4c8Q4x3V1k6$3K9i4y4@1j5g2)9J5c8R3`.`.
Peter Wieland's thoughts on Windows driver development
610K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6K6i4K6u0W2L8i4y4V1L8W2)9J5k6h3y4G2L8g2)9J5c8X3u0Q4x3V1k6H3k6i4c8W2M7Y4N6A6k6g2)9J5c8R3`.`.
USB Driver Development
b53K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6K6i4K6u0W2L8i4y4V1L8W2)9J5k6h3y4G2L8g2)9J5c8X3u0Q4x3V1k6#2M7$3u0U0L8%4u0W2j5X3I4G2k6#2)9J5c8R3`.`.
Hardware and Driver Developer Blogs
d77K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6J5k6i4y4G2N6i4u0U0k6i4y4Q4x3V1k6T1L8r3!0Y4M7#2)9J5k6h3#2K6M7s2R3`.
j00ru//vx tech blog Coding, reverse engineering, OS internals Blog
32bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3Z5H3x3s2u0#2i4K6u0W2N6X3g2^5K9h3I4D9K9i4g2E0i4K6u0W2L8%4u0Y4i4K6u0r3
Transport Driver Interface (TDI)
3bcK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8X3#2K6z5o6p5&6y4K6b7H3i4K6u0W2j5i4y4H3P5l9`.`.
System Internals
c8aK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8Y4N6Z5k6r3y4Q4x3V1k6K6P5i4y4@1k6h3#2Q4x3V1k6e0P5i4y4A6L8Y4c8W2M7X3&6S2L8s2y4Q4x3V1k6V1k6h3k6S2N6h3I4@1i4K6u0W2L8i4y4H3P5l9`.`.
Driver development needs too many time patience and experience to be fully understood, in my opinion the best approach remains LbD ( Learning by Doing ) so, read, study and develop as many experience you build less BSODs and "trange behavior" you will obtain
See you to the next post,
Giuseppe 'Evilcry' Bonfa
