I was trying hard to understand how to make a kernel-mode driver for 32-bit Windows XP SP3 with correct Imports.
Here is the import section from the official FASM
PEDEMO example:
section '.idata' import data readable writeable
dd 0,0,0,RVA kernel_name,RVA kernel_table
dd 0,0,0,RVA user_name,RVA user_table
dd 0,0,0,0,0
dd 0,0
kernel_table:
ExitProcess dd RVA _ExitProcess
dd 0
user_table:
MessageBoxA dd RVA _MessageBoxA
dd 0
kernel_name db 'KERNEL32.DLL',0
user_name db 'USER32.DLL',0
_ExitProcess dw 0
db 'ExitProcess',0
_MessageBoxA dw 0
db 'MessageBoxA',0
I adapted this section for my kernel-mode driver and "received a bunch of phrases in a standard VGA video with the poor palette" (BSOD).
I spent several days digging the Internet to find out, what's going on.
And I found: Import Address Table (Thunk Table)
should be registered in PE header.
So the solutions is to use the
data 12 directive:
section '.idata' import data readable writeable
dd 0,0,0,RVA kernel_name,RVA kernel_table
dd 0,0,0,RVA user_name,RVA user_table
dd 0,0,0,0,0
dd 0,0
data 12
kernel_table:
ExitProcess dd RVA _ExitProcess
dd 0
user_table:
MessageBoxA dd RVA _MessageBoxA
dd 0
end data
kernel_name db 'KERNEL32.DLL',0
user_name db 'USER32.DLL',0
_ExitProcess dw 0
db 'ExitProcess',0
_MessageBoxA dw 0
db 'MessageBoxA',0
And here is the source of my simple driver which works with
data 12 directive and BSODs without it:
format PE native at 10000h
call [VidResetDisplay]
push text
call [VidDisplayString]
jmp $
text db "Please, use 'data 12' directive in your imports!",0
data import
dd 0,0,0,RVA bootvid_name,RVA bootvid_table
dd 0,0,0,0,0
data 12
bootvid_table:
VidDisplayString dd RVA _VidDisplayString
VidResetDisplay dd RVA _VidResetDisplay
dd 0
end data
bootvid_name db 'BOOTVID.DLL',0
_VidDisplayString dw 0
db 'VidDisplayString',0
_VidResetDisplay dw 0
db 'VidResetDisplay',0
end data
data fixups
end data
P. S.
I don't know why
dd 0,0 was there. I haven't fond those zeros neither in official PE-COFF Format File Specification nor in Microsoft's original kernel-mode drivers, which I inspected with hex editors. So I simply removed them.