-
-
利用OLLVM编译windows驱动
-
发表于: 2022-10-28 16:34
-
OLLVM的坑多的离谱，所以请100%按照本文搭建。
链接：faaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4d9V1A6#2g2@1W2&6M7q4m8E0h3X3p5^5y4X3E0p5x3W2)9#2k6W2q4e0K9#2k6c8i4K6y4r3M7s2N6V1i4K6y4p5P5s2Z5$3x3l9`.`.
提取码：xz60
--来自百度网盘超级会员V99999999999999的分享
在系统变量中加两个变量：LLVMInstallDir、LLVMToolsVersion。分别是LLVM根目录及 12.0.0
找到PlatformToolsets目录，直接搜就行，找到X64路径的那个版本（如果你是其他平台驱动就找对应平台的）。
复制一份WindowsKernelModeDriver10.0。
修改复制后的WindowsKernelModeDriver10.0中的Toolset.props及Toolset.targets，具体如下：
Toolset.props
Toolset.targets
随便创建个driver项目，vs的配置这样弄：
常规
LLVM：Use lld-link 选为否。否则编译时候会提示各种参数错误。
C/C++
命令行
从父级或项目默认设置继承 取消勾选！！！
其他选项：
连接器
其余正常开发驱动时怎么设置就怎么设置，C/C++部分去掉继承后就不用再设置其他的了。
然后正常编译就行了。
如果开启了字符串加密，确保所有源码文件中不要出现两个内容完全相同的字符串即可，如果相同字符串在两个地方用到了，要么写一个函数去返回，要么extern。
下面这个会报错：
下面这个则不会报错
下面这个也不会报错
<PropertyGroup> <V141PropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v141\Toolset.props</V141PropsFile>
<V142PropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.props</V142PropsFile>
<ClangPropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.props</ClangPropsFile>
</PropertyGroup>
<Import Condition="Exists('$(ClangPropsFile)')" Project="$(ClangPropsFile)" />
<Import Condition="!Exists('$(V142PropsFile)')" Project="$(V142PropsFile)" />
<Import Condition="!Exists('$(V142PropsFile)')" Project="$(V141PropsFile)" />
<PropertyGroup> <V141PropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v141\Toolset.props</V141PropsFile>
<V142PropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.props</V142PropsFile>
<ClangPropsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.props</ClangPropsFile>
</PropertyGroup>
<Import Condition="Exists('$(ClangPropsFile)')" Project="$(ClangPropsFile)" />
<Import Condition="!Exists('$(V142PropsFile)')" Project="$(V142PropsFile)" />
<Import Condition="!Exists('$(V142PropsFile)')" Project="$(V141PropsFile)" />
<PropertyGroup> <V141TargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v141\Toolset.targets</V141TargetsFile>
<V142TargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.targets</V142TargetsFile>
<ClangTargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.targets</ClangTargetsFile>
</PropertyGroup>
<Import Project="$(WDKContentRoot)\build\WindowsDriver.common.targets" Condition="Exists('$(WDKContentRoot)\build\WindowsDriver.common.targets')"/>
<Import Condition="Exists('$(ClangTargetsFile)')" Project="$(ClangTargetsFile)" />
<Import Condition="!Exists('$(V142TargetsFile)')" Project="$(V142TargetsFile)" />
<Import Condition="!Exists('$(V142TargetsFile)')" Project="$(V141TargetsFile)" />
<PropertyGroup> <V141TargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v141\Toolset.targets</V141TargetsFile>
<V142TargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.targets</V142TargetsFile>
<ClangTargetsFile>$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.targets</ClangTargetsFile>
</PropertyGroup>
<Import Project="$(WDKContentRoot)\build\WindowsDriver.common.targets" Condition="Exists('$(WDKContentRoot)\build\WindowsDriver.common.targets')"/>
<Import Condition="Exists('$(ClangTargetsFile)')" Project="$(ClangTargetsFile)" />
<Import Condition="!Exists('$(V142TargetsFile)')" Project="$(V142TargetsFile)" />
<Import Condition="!Exists('$(V142TargetsFile)')" Project="$(V141TargetsFile)" />
-mno-sse -mno-mmx -D__CUDACC__ -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH -mllvm -sobf -mllvm -bcf -mllvm -bcf_prob=99 -mllvm -bcf_loop=1 -mllvm -sub -mllvm -sub_loop=5 -mllvm -fla -mllvm -split_num=5 -mllvm -aesSeed=DEADBEEFDEADCODEDEADBEEFDEADCODE
-mno-sse -mno-mmx -D__CUDACC__ -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH -mllvm -sobf -mllvm -bcf -mllvm -bcf_prob=99 -mllvm -bcf_loop=1 -mllvm -sub -mllvm -sub_loop=5 -mllvm -fla -mllvm -split_num=5 -mllvm -aesSeed=DEADBEEFDEADCODEDEADBEEFDEADCODE
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { //代码
char * gjg1 = "dasdasdasdasda";
char * gjg2 = "dasdasdasdasda";
DbgPrintEx(77, 0, gjg1);
DbgPrintEx(77, 0, gjg2);
return STATUS_UNSUCCESSFUL;
}EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { //代码
char * gjg1 = "dasdasdasdasda";
char * gjg2 = "dasdasdasdasda";
DbgPrintEx(77, 0, gjg1);
DbgPrintEx(77, 0, gjg2);
return STATUS_UNSUCCESSFUL;
}EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { //代码
char * gjg1 = "dasdasdasdasda";
char * gjg2 = "dasdasdasdasda1";
DbgPrintEx(77, 0, gjg1);
DbgPrintEx(77, 0, gjg2);
return STATUS_UNSUCCESSFUL;
}EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {[培训]科锐软件逆向54期预科班、正式班开始火爆招生报名啦！！！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
老哥，你解决这个问题了嘛，我也是这样 |
|
|
sub_loop是2的话，bcf_loop这个超过3就会卡住，这是为啥？ |
|
|
可能是指数级的增长吧，数字不需要太大，差不多就行 |
|
|
|
