flat assembler
Message board for the users of flat assembler.

Index > Tutorials and Examples > Building kernel-mode driver for Windows with correct Imports

Author
Thread Post new topic Reply to topic
386



Joined: 11 Nov 2023
Posts: 28
Location: Ukraine (Ruthenia)
386 14 Nov 2023, 22:11
I was trying hard to understand how to make a kernel-mode driver for 32-bit Windows XP SP3 with correct Imports.

Here is the import section from the official FASM PEDEMO example:
Code:
section '.idata' import data readable writeable

  dd 0,0,0,RVA kernel_name,RVA kernel_table
  dd 0,0,0,RVA user_name,RVA user_table
  dd 0,0,0,0,0

  dd 0,0

  kernel_table:
    ExitProcess dd RVA _ExitProcess
    dd 0
  user_table:
    MessageBoxA dd RVA _MessageBoxA
    dd 0

  kernel_name db 'KERNEL32.DLL',0
  user_name db 'USER32.DLL',0

  _ExitProcess dw 0
    db 'ExitProcess',0
  _MessageBoxA dw 0
    db 'MessageBoxA',0    
I adapted this section for my kernel-mode driver and "received a bunch of phrases in a standard VGA video with the poor palette" (BSOD).

I spent several days digging the Internet to find out, what's going on.

And I found: Import Address Table (Thunk Table) should be registered in PE header.

So the solutions is to use the data 12 directive:
Code:
section '.idata' import data readable writeable

  dd 0,0,0,RVA kernel_name,RVA kernel_table
  dd 0,0,0,RVA user_name,RVA user_table
  dd 0,0,0,0,0

  dd 0,0

data 12

  kernel_table:
    ExitProcess dd RVA _ExitProcess
    dd 0
  user_table:
    MessageBoxA dd RVA _MessageBoxA
    dd 0

end data

  kernel_name db 'KERNEL32.DLL',0
  user_name db 'USER32.DLL',0

  _ExitProcess dw 0
    db 'ExitProcess',0
  _MessageBoxA dw 0
    db 'MessageBoxA',0    
And here is the source of my simple driver which works with data 12 directive and BSODs without it:
Code:
format PE native at 10000h

    call [VidResetDisplay]
    push text
    call [VidDisplayString]
    jmp $

    text db "Please, use 'data 12' directive in your imports!",0

data import

  dd 0,0,0,RVA bootvid_name,RVA bootvid_table
  dd 0,0,0,0,0

  data 12

  bootvid_table:
    VidDisplayString dd RVA _VidDisplayString
    VidResetDisplay  dd RVA _VidResetDisplay
    dd 0

  end data

  bootvid_name db 'BOOTVID.DLL',0

  _VidDisplayString dw 0
    db 'VidDisplayString',0
  _VidResetDisplay dw 0
    db 'VidResetDisplay',0

end data

data fixups
end data    
P. S.
I don't know why dd 0,0 was there. I haven't fond those zeros neither in official PE-COFF Format File Specification nor in Microsoft's original kernel-mode drivers, which I inspected with hex editors. So I simply removed them.
Post 14 Nov 2023, 22:11
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.