driverscope.c File Reference

#include <ntoskrnl.h>
#include <initguid.h>
#include <debug.h>

Include dependency graph for driverscope.c:

Go to the source code of this file.

Macros
#define	KSEP_DEBUG_EVENTS   0x0001
#define	KSEP_DEBUG_MESSAGES   0x0002
#define	KSEP_DEBUG_GENERAL   0x0100
#define	KSEP_DEBUG_PNP   0x0200
#define	KSEP_DEBUG_POWER   0x0400
#define	KSEP_DEBUG_IRP   0x0800
#define	KSEP_DEBUG_POOL   0x1000
#define	KSEP_DEBUG_UNLOAD   0x2000

Functions
static NTSTATUS NTAPI	ShimDriverInit (_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
static VOID NTAPI	ShimDriverStartIo (_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp)
static VOID NTAPI	ShimDriverUnload (_In_ PDRIVER_OBJECT DriverObject)
static NTSTATUS NTAPI	ShimDriverAddDevice (_In_ PDRIVER_OBJECT DriverObject, _In_ PDEVICE_OBJECT PhysicalDeviceObject)
static NTSTATUS NTAPI	ShimIoCreateDevice (_In_ PDRIVER_OBJECT DriverObject, _In_ ULONG DeviceExtensionSize, _In_ PUNICODE_STRING DeviceName, _In_ DEVICE_TYPE DeviceType, _In_ ULONG DeviceCharacteristics, _In_ BOOLEAN Exclusive, _Out_ PDEVICE_OBJECT *DeviceObject)
static NTSTATUS NTAPI	ShimPoRequestPowerIrp (_In_ PDEVICE_OBJECT DeviceObject, _In_ UCHAR MinorFunction, _In_ POWER_STATE PowerState, _In_ PREQUEST_POWER_COMPLETE CompletionFunction, _In_ PVOID Context, _Out_ PIRP *Irp)
static PVOID NTAPI	ShimExAllocatePoolWithTag (_In_ POOL_TYPE PoolType, _In_ SIZE_T NumberOfBytes, _In_ ULONG Tag)
static VOID NTAPI	ShimExFreePoolWithTag (_In_ PVOID p, _In_ ULONG Tag)
static PVOID NTAPI	ShimExAllocatePool (_In_ POOL_TYPE PoolType, _In_ SIZE_T NumberOfBytes)
static VOID NTAPI	ShimExFreePool (_In_ PVOID p)
static NTSTATUS NTAPI	ShimIrpComplete (_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp, _In_ PVOID Context)
static NTSTATUS NTAPI	ShimIrp (_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp)
static NTSTATUS NTAPI	ShimIrpPnpComplete (_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp, _In_ PVOID Context)
static NTSTATUS NTAPI	ShimIrpPnp (_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp)
	DEFINE_GUID (KmDsShimGuid, 0xbc04ab45, 0xea7e, 0x4a11, 0xa7, 0xbb, 0x97, 0x76, 0x15, 0xf4, 0xca, 0xae)
NTSTATUS NTAPI	KseDriverScopeInitialize (VOID)

Variables
KSE_SHIM	KmDsShim = { sizeof(KSE_SHIM), &KmDsShimGuid, L"DriverScope", NULL, NULL, NULL, KmDsShimCollections }
static ULONG	KsepDebugFlags = ~0
static KSE_HOOK	KmDsShimHooksNT []
static KSE_HOOK	KmDsShimHooksCB []
static KSE_HOOK_COLLECTION	KmDsShimCollections []

Macro Definition Documentation

KSEP_DEBUG_EVENTS

#define KSEP_DEBUG_EVENTS   0x0001

Definition at line 19 of file driverscope.c.

KSEP_DEBUG_GENERAL

#define KSEP_DEBUG_GENERAL   0x0100

Definition at line 21 of file driverscope.c.

KSEP_DEBUG_IRP

#define KSEP_DEBUG_IRP   0x0800

Definition at line 24 of file driverscope.c.

KSEP_DEBUG_MESSAGES

#define KSEP_DEBUG_MESSAGES   0x0002

Definition at line 20 of file driverscope.c.

KSEP_DEBUG_PNP

#define KSEP_DEBUG_PNP   0x0200

Definition at line 22 of file driverscope.c.

KSEP_DEBUG_POOL

#define KSEP_DEBUG_POOL   0x1000

Definition at line 25 of file driverscope.c.

KSEP_DEBUG_POWER

#define KSEP_DEBUG_POWER   0x0400

Definition at line 23 of file driverscope.c.

KSEP_DEBUG_UNLOAD

#define KSEP_DEBUG_UNLOAD   0x2000

Definition at line 26 of file driverscope.c.

Function Documentation

DEFINE_GUID()

DEFINE_GUID	(	KmDsShimGuid	,
		0xbc04ab45	,
		0xea7e	,
		0x4a11	,
		0xa7	,
		0xbb	,
		0x97	,
		0x76	,
		0x15	,
		0xf4	,
		0xca	,
		0xae
	)

KseDriverScopeInitialize()

NTSTATUS NTAPI KseDriverScopeInitialize

(

VOID

)

Definition at line 353 of file driverscope.c.

{
    NTSTATUS Status;
 
    Status = KseRegisterShim(&KmDsShim, NULL, 0);
    if (NT_SUCCESS(Status))
        DPRINT("KSE: driver scope shim registered.\n");
 
    return Status;
}

Referenced by KseInitialize().

ShimDriverAddDevice()

static NTSTATUS NTAPI ShimDriverAddDevice ( _In_ PDRIVER_OBJECT  DriverObject, _In_ PDEVICE_OBJECT  PhysicalDeviceObject  )

static

Definition at line 81 of file driverscope.c.

{
    PDRIVER_ADD_DEVICE OriginalFunction;
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->AddDevice;
    Status = OriginalFunction(DriverObject, PhysicalDeviceObject);
 
    if (KsepDebugFlags & KSEP_DEBUG_GENERAL)
    {
        DPRINT1("[DriverScopeGeneral] DriverObject=%p [%wZ] Pdo=%p Status=0x%08x\n",
            DriverObject, &DriverObject->DriverName, PhysicalDeviceObject, Status);
    }
    return Status;
}

ShimDriverInit()

static NTSTATUS NTAPI ShimDriverInit ( _In_ PDRIVER_OBJECT  DriverObject, _In_ PUNICODE_STRING  RegistryPath  )

static

Definition at line 30 of file driverscope.c.

{
    PDRIVER_INITIALIZE OriginalFunction;
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->DriverInit;
    Status = OriginalFunction(DriverObject, RegistryPath);
 
    if (KsepDebugFlags & KSEP_DEBUG_GENERAL)
    {
        DPRINT1("[DriverScopeGeneral] DriverObject=%p [%wZ] RegistryPath=%wZ Status=0x%08x\n",
            DriverObject, &DriverObject->DriverName, RegistryPath, Status);
    }
    return Status;
}

ShimDriverStartIo()

static VOID NTAPI ShimDriverStartIo ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ PIRP  Irp  )

static

Definition at line 49 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    PDRIVER_STARTIO OriginalFunction;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->DriverStartIo;
    if (KsepDebugFlags & KSEP_DEBUG_GENERAL)
    {
        DPRINT1("[DriverScopeGeneral] DriverObject=%p [%wZ] Fdo=%p Irp=%p\n",
            DriverObject, &DriverObject->DriverName, DeviceObject, Irp);
    }
    OriginalFunction(DeviceObject, Irp);
}

ShimDriverUnload()

static VOID NTAPI ShimDriverUnload ( _In_ PDRIVER_OBJECT  DriverObject )

static

Definition at line 66 of file driverscope.c.

{
    PDRIVER_UNLOAD OriginalFunction;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->DriverUnload;
    if (KsepDebugFlags & KSEP_DEBUG_GENERAL)
    {
        DPRINT1("[DriverScopeGeneral] DriverObject=%p [%wZ]\n",
            DriverObject, &DriverObject->DriverName);
    }
    OriginalFunction(DriverObject);
}

ShimExAllocatePool()

static PVOID NTAPI ShimExAllocatePool ( _In_ POOL_TYPE  PoolType, _In_ SIZE_T  NumberOfBytes  )

static

Definition at line 184 of file driverscope.c.

{
    PVOID p;
    PVOID (NTAPI *OriginalFunction)(POOL_TYPE, SIZE_T);
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[4].OriginalFunction;
 
    p = OriginalFunction(PoolType, NumberOfBytes);
    if (KsepDebugFlags & KSEP_DEBUG_POOL)
    {
        DPRINT1("[DriverScopePool] ExAllocatePool: Address=%p Caller=%p Type=%d Size=%u Tag=0x%08x\n",
            p, _ReturnAddress(), PoolType, (ULONG)NumberOfBytes, 0);
    }
 
    return p;
}

ShimExAllocatePoolWithTag()

static PVOID NTAPI ShimExAllocatePoolWithTag ( _In_ POOL_TYPE  PoolType, _In_ SIZE_T  NumberOfBytes, _In_ ULONG  Tag  )

static

Definition at line 146 of file driverscope.c.

{
    PVOID p;
    PVOID (NTAPI *OriginalFunction)(POOL_TYPE, SIZE_T, ULONG);
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[2].OriginalFunction;
 
    p = OriginalFunction(PoolType, NumberOfBytes, Tag);
    if (KsepDebugFlags & KSEP_DEBUG_POOL)
    {
        DPRINT1("[DriverScopePool] ExAllocatePool: Address=%p Caller=%p Type=%d Size=%u Tag=0x%08x\n",
            p, _ReturnAddress(), PoolType, (ULONG)NumberOfBytes, Tag);
    }
    return p;
}

ShimExFreePool()

static VOID NTAPI ShimExFreePool ( _In_ PVOID  p )

static

Definition at line 204 of file driverscope.c.

{
    VOID (NTAPI *OriginalFunction)(PVOID);
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[5].OriginalFunction;
 
    if (KsepDebugFlags & KSEP_DEBUG_POOL)
    {
        DPRINT1("[DriverScopePool] ExFreePool: Address=%p Caller=%p Tag=0x%08x\n",
            p, _ReturnAddress(), 0);
    }
 
    OriginalFunction(p);
}

ShimExFreePoolWithTag()

static VOID NTAPI ShimExFreePoolWithTag ( _In_ PVOID  p, _In_ ULONG  Tag  )

static

Definition at line 166 of file driverscope.c.

{
    VOID (NTAPI *OriginalFunction)(PVOID, ULONG);
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[3].OriginalFunction;
 
    if (KsepDebugFlags & KSEP_DEBUG_POOL)
    {
        DPRINT1("[DriverScopePool] ExFreePool: Address=%p Caller=%p Tag=0x%08x\n",
            p, _ReturnAddress(), Tag);
    }
 
    OriginalFunction(p, Tag);
}

ShimIoCreateDevice()

static NTSTATUS NTAPI ShimIoCreateDevice ( _In_ PDRIVER_OBJECT  DriverObject, _In_ ULONG  DeviceExtensionSize, _In_ PUNICODE_STRING  DeviceName, _In_ DEVICE_TYPE  DeviceType, _In_ ULONG  DeviceCharacteristics, _In_ BOOLEAN  Exclusive, _Out_ PDEVICE_OBJECT *  DeviceObject  )

static

Definition at line 100 of file driverscope.c.

{
    NTSTATUS (NTAPI *OriginalFunction)(PDRIVER_OBJECT, ULONG, PUNICODE_STRING, DEVICE_TYPE, ULONG, BOOLEAN, PDEVICE_OBJECT*);
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[0].OriginalFunction;
    Status = OriginalFunction(DriverObject, DeviceExtensionSize, DeviceName, DeviceType, DeviceCharacteristics, Exclusive, DeviceObject);
    if (KsepDebugFlags & KSEP_DEBUG_GENERAL)
    {
        DPRINT1("[DriverScopeGeneral] DriverObject=%p [%wZ] Fdo=%p DeviceType=%d DeviceCharacteristics=0x%x Exclusive=%d Status=0x%08x\n",
            DriverObject, &DriverObject->DriverName, *DeviceObject, DeviceType, DeviceCharacteristics, Exclusive, Status);
    }
    return Status;
}

ShimIrp()

static NTSTATUS NTAPI ShimIrp ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ PIRP  Irp  )

static

Definition at line 240 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    PDRIVER_DISPATCH OriginalFunction;
    ULONG MajorFunction = IoGetCurrentIrpStackLocation(Irp)->MajorFunction;
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->MajorFunction[MajorFunction];
    KmDsShim.KseCallbackRoutines->KseSetCompletionHookRoutine(DeviceObject, Irp, ShimIrpComplete, NULL);
    Status = OriginalFunction(DeviceObject, Irp);
 
    if (KsepDebugFlags & KSEP_DEBUG_IRP)
    {
        if (Status == STATUS_PENDING)
        {
            DPRINT1("[DriverScopeIrps] DriverObject=%p [%wZ] Fdo=%p Irp=%p\n",
                DriverObject, &DriverObject->DriverName, DeviceObject, Irp);
        }
        else
        {
            DPRINT1("[DriverScopeIrps] DriverObject=%p [%wZ] Fdo=%p Irp=%p MajorCode=0x%02x Status=0x%08x\n",
                DriverObject, &DriverObject->DriverName, DeviceObject, Irp, MajorFunction, Status);
        }
    }
    return Status;
}

ShimIrpComplete()

static NTSTATUS NTAPI ShimIrpComplete ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ PIRP  Irp, _In_ PVOID  Context  )

static

Definition at line 221 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    ULONG MajorFunction = IoGetCurrentIrpStackLocation(Irp)->MajorFunction;
    NTSTATUS Status = Irp->IoStatus.Status;
 
    if (KsepDebugFlags & KSEP_DEBUG_IRP)
    {
        DPRINT1("[DriverScopeIrps] DriverObject=%p [%wZ] Fdo=%p Irp=%p MajorCode=0x%02x Status=0x%08x\n",
            DriverObject, &DriverObject->DriverName, DeviceObject, Irp, MajorFunction, Status);
    }
 
    return STATUS_SUCCESS;
}

Referenced by ShimIrp().

ShimIrpPnp()

static NTSTATUS NTAPI ShimIrpPnp ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ PIRP  Irp  )

static

Definition at line 288 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    PDRIVER_DISPATCH OriginalFunction;
    ULONG MajorFunction = IoGetCurrentIrpStackLocation(Irp)->MajorFunction;
    ULONG MinorFunction = IoGetCurrentIrpStackLocation(Irp)->MinorFunction;
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.KseCallbackRoutines->KseGetIoCallbacksRoutine(DriverObject)->MajorFunction[MajorFunction];
    KmDsShim.KseCallbackRoutines->KseSetCompletionHookRoutine(DeviceObject, Irp, ShimIrpPnpComplete, NULL);
    Status = OriginalFunction(DeviceObject, Irp);
 
    if (KsepDebugFlags & KSEP_DEBUG_PNP)
    {
        if (Status == STATUS_PENDING)
        {
            DPRINT1("[DriverScopePnp] DriverObject=%p [%wZ] Fdo=%p Irp=%p\n",
                DriverObject, &DriverObject->DriverName, DeviceObject, Irp);
        }
        else
        {
            DPRINT1("[DriverScopePnp] DriverObject=%p [%wZ] Fdo=%p Irp=%p MinorCode=0x%02x Status=0x%08x\n",
                DriverObject, &DriverObject->DriverName, DeviceObject, Irp, MinorFunction, Status);
        }
    }
 
    return Status;
}

ShimIrpPnpComplete()

static NTSTATUS NTAPI ShimIrpPnpComplete ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ PIRP  Irp, _In_ PVOID  Context  )

static

Definition at line 270 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    NTSTATUS Status = Irp->IoStatus.Status;
 
    if (KsepDebugFlags & KSEP_DEBUG_PNP)
    {
        DPRINT1("[DriverScopePnp] DriverObject=%p [%wZ] Fdo=%p Irp=%p Status=0x%08x\n",
            DriverObject, &DriverObject->DriverName, DeviceObject, Irp, Status);
    }
 
    return STATUS_SUCCESS;
}

Referenced by ShimIrpPnp().

ShimPoRequestPowerIrp()

static NTSTATUS NTAPI ShimPoRequestPowerIrp ( _In_ PDEVICE_OBJECT  DeviceObject, _In_ UCHAR  MinorFunction, _In_ POWER_STATE  PowerState, _In_ PREQUEST_POWER_COMPLETE  CompletionFunction, _In_ PVOID  Context, _Out_ PIRP *  Irp  )

static

Definition at line 123 of file driverscope.c.

{
    PDRIVER_OBJECT DriverObject = DeviceObject->DriverObject;
    NTSTATUS (NTAPI *OriginalFunction)(PDEVICE_OBJECT, UCHAR, POWER_STATE, PREQUEST_POWER_COMPLETE, PVOID, PIRP*);
    NTSTATUS Status;
 
    OriginalFunction = KmDsShim.HookCollectionsArray->HookArray[1].OriginalFunction;
    Status = OriginalFunction(DeviceObject, MinorFunction, PowerState, CompletionFunction, Context, Irp);
    if (KsepDebugFlags & KSEP_DEBUG_POWER)
    {
        DPRINT1("[DriverScopePower] DriverObject=%p Fdo=%p Irp=%p MinorCode=0x%02x PowerState=%u Status=0x%08x\n",
            DriverObject, DeviceObject, *Irp, MinorFunction, PowerState, Status);
    }
    return Status;
}

Variable Documentation

KmDsShim

KSE_SHIM KmDsShim = { sizeof(KSE_SHIM), &KmDsShimGuid, L"DriverScope", NULL, NULL, NULL, KmDsShimCollections }

Definition at line 348 of file driverscope.c.

Referenced by KseDriverScopeInitialize(), ShimDriverAddDevice(), ShimDriverInit(), ShimDriverStartIo(), ShimDriverUnload(), ShimExAllocatePool(), ShimExAllocatePoolWithTag(), ShimExFreePool(), ShimExFreePoolWithTag(), ShimIoCreateDevice(), ShimIrp(), ShimIrpPnp(), and ShimPoRequestPowerIrp().

KmDsShimCollections

KSE_HOOK_COLLECTION KmDsShimCollections[]

static

Initial value:

= {
    { KseCollectionNtExport, NULL, KmDsShimHooksNT },
    { KseCollectionCallback, NULL, KmDsShimHooksCB },
    { KseCollectionInvalid },
}

Definition at line 340 of file driverscope.c.

KmDsShimHooksCB

KSE_HOOK KmDsShimHooksCB[]

static

Initial value:

= {
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)KseHookCallbackDriverInit }, (PVOID)(ULONG_PTR)ShimDriverInit },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)KseHookCallbackDriverStartIo }, (PVOID)(ULONG_PTR)ShimDriverStartIo },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)KseHookCallbackDriverUnload }, (PVOID)(ULONG_PTR)ShimDriverUnload },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)KseHookCallbackAddDevice }, (PVOID)(ULONG_PTR)ShimDriverAddDevice },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)(KseHookCallbackMajorFunction + IRP_MJ_CREATE) }, (PVOID)(ULONG_PTR)ShimIrp },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)(KseHookCallbackMajorFunction + IRP_MJ_CLOSE) }, (PVOID)(ULONG_PTR)ShimIrp },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)(KseHookCallbackMajorFunction + IRP_MJ_POWER) }, (PVOID)(ULONG_PTR)ShimIrp },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)(KseHookCallbackMajorFunction + IRP_MJ_PNP) }, (PVOID)(ULONG_PTR)ShimIrpPnp },
    { KseHookIRPCallback, { (PCHAR)(ULONG_PTR)(KseHookCallbackMajorFunction + IRP_MJ_DEVICE_CONTROL) }, (PVOID)(ULONG_PTR)ShimIrp },
    { KseHookInvalid },
}

Definition at line 328 of file driverscope.c.

KmDsShimHooksNT

KSE_HOOK KmDsShimHooksNT[]

static

Initial value:

= {
    { KseHookFunction, { "IoCreateDevice" }, (PVOID)(ULONG_PTR)ShimIoCreateDevice },
    { KseHookFunction, { "PoRequestPowerIrp" }, (PVOID)(ULONG_PTR)ShimPoRequestPowerIrp },
    { KseHookFunction, { "ExAllocatePoolWithTag" }, (PVOID)(ULONG_PTR)ShimExAllocatePoolWithTag },
    { KseHookFunction, { "ExFreePoolWithTag" }, (PVOID)(ULONG_PTR)ShimExFreePoolWithTag },
    { KseHookFunction, { "ExAllocatePool" }, (PVOID)(ULONG_PTR)ShimExAllocatePool },
    { KseHookFunction, { "ExFreePool" }, (PVOID)(ULONG_PTR)ShimExFreePool },
    { KseHookInvalid },
}

Definition at line 319 of file driverscope.c.

KsepDebugFlags

ULONG KsepDebugFlags = ~0

static

Definition at line 27 of file driverscope.c.

Referenced by ShimDriverAddDevice(), ShimDriverInit(), ShimDriverStartIo(), ShimDriverUnload(), ShimExAllocatePool(), ShimExAllocatePoolWithTag(), ShimExFreePool(), ShimExFreePoolWithTag(), ShimIoCreateDevice(), ShimIrp(), ShimIrpComplete(), ShimIrpPnp(), ShimIrpPnpComplete(), and ShimPoRequestPowerIrp().