Search code examples
driverwdk

running custom WIN kernel driver

first time building driver, i've built this driver and i got .sys and other files but i can't manage to run it, i register it with driver loader or sc.exe and i see it in registry but upon sc start command i get error

this driver has been blocked from loading

machine is win7 x64 but i build driver as 32-bit

again, beginner regarding drivers, hope someone has some solution to this,

thanks

EDIT:

if i try building 64 bit version i have errors like this i don't know how to solve:

BUILD: Compiling and Linking c:\winddk\7600.16385.1\src\hades directory

         Configuring OACR for 'WDKSamples:amd64chk' - <OACR on>
         Compiling - hades.c
         1>errors in directory c:\winddk\7600.16385.1\src\hades
     1>c:\winddk\7600.16385.1\src\hades\hades.c(44): error C4235: nonstandard extension used : '_asm' keyword not supported on this architecture
     1>c:\winddk\7600.16385.1\src\hades\hades.c(46): error C2065: 'push' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(46): error C2146: syntax error : missing ';' before identifier 'eax'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(47): error C2065: 'eax' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(47): error C2146: syntax error : missing ';' before identifier 'mov'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(47): error C2065: 'mov' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(47): error C2146: syntax error : missing ';' before identifier 'eax'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(47): error C2065: 'eax' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(48): error C2065: 'edx' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(48): error C2146: syntax error : missing ';' before identifier 'mov'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(48): error C2065: 'mov' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(48): error C2146: syntax error : missing ';' before identifier 'gORIG_ESP'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(50): error C2065: 'eax' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(50): error C2146: syntax error : missing ';' before identifier 'sub'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(50): error C2065: 'sub' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(50): error C2146: syntax error : missing ';' before identifier 'eax'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(50): error C2065: 'eax' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(51): error C2146: syntax error : missing ';' before identifier 'mov'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(51): error C2065: 'mov' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(51): error C2146: syntax error : missing ';' before identifier 'eax'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(51): error C2065: 'eax' : undeclared identifier
     1>c:\winddk\7600.16385.1\src\hades\hades.c(51): error C2059: syntax error : '['
     1>c:\winddk\7600.16385.1\src\hades\hades.c(96): error C2143: syntax error : missing ';' before 'type'
     1>c:\winddk\7600.16385.1\src\hades\hades.c(176): error C4013: 'hook_syscalls' undefined; assuming extern returning int
         Compiling - support.c
         Compiling - debugger.c
     1>c:\winddk\7600.16385.1\src\hades\debugger.c(52): error C2485: 'naked' : unrecognized extended attribute
     1>c:\winddk\7600.16385.1\src\hades\debugger.c(54): error C4235: nonstandard extension used : '_asm' keyword not supported on this architecture 
... ETC
Solution

  • You cannot run 32-bit drivers on 64-bit machines.

    You need to build a 64-bit version of your driver, sign it with a testsigning certificate and configure your machine to start in testsigning mode. Only then you'll be able to start your driver.

    A word of advice, though. If you don't want to suffer from frequent BSODs due to bugs in your first driver, consider installing a virtual machine app, such as VirtualBox and testing the drivers from there.