vscode development wdk

findwdk

https://github.com/SergiusTheBest/FindWDK.git

Copy the FindWdk.cmake module to the following path

CMake\share\cmake-3.22\Modules

Pay attention to defining system variables or modifying the following path to ensure that the wdk tool path can be found
Insert image description here

Build project

Building projects in cmake is implemented through wdk_add_driver

wdk_add_driver(simple simple.c)

Configure vmware environment

msconfig, modify the virtual machine to run in debug mode
Add a serial port to the virtual machine and use the \.\pipe\com_1 command channel to connect to com1

vs plugin

Install the vs windows driver kit plug-
Insert image description here
in. Add the vmare virtual machine configuration in the plug-in as follows

. Start device debugging by attaching a remote target (only after the device is added in the plug-in can it be directly searched by name)

Install

Turn on debugging mode, turn off digital signature and restart
bcdedit /debug on
bcdedit /dbgsettings serial debugport:n baudrate:115200
bcdedit /set testsigning on
bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit /set nointegritychecks on

cmd to execute the installation and enter the sys file

@echo off
sc create %~n1 binpath= "%~f1" type= kernel start= demand type= kernel start=demand
sc start %~n1
pause
sc stop %~n1
sc delete %~n1

Use windbg to debug sys files, set the pdb path to the symbol path in the virtual machine, and then debug breakpoints can be broken.

irp

Applications and the kernel communicate through IRP packets, irp five commonly used packet types

#define IRP_MJ_CREATE 0X00 //Corresponds to the user layer function CreateFile()
#define IRP_MJ_CLOSE 0X02 //Corresponds to the user layer function CloseHandle()
#define IRP_MJ_READ 0X03 //Corresponds to the user layer function ReadFile()
#define IRP_MJ_WRITE 0X04 //Corresponds to the user layer function WirteFile ()
#define IRP_MJ_DEVICE_CONTROL 0X0e //DeviceIoControl(), writable and readable

IRP is divided into linear IRP (synchronous IRP, the IRP is automatically canceled when the thread exits) and non-linear IRP (asynchronous IRP, not associated with any thread, data is transferred between the driver and the driver, and needs to be manually released in the completion function)

IoBuildSynchronousFsdRequest, IoBuildDeviceIoControlRequest, synchronous
IoBuildAsynchronousFsdRequest, IoAllocateIrp, asynchronous

Spin lock, infinite loop waiting, occupying a lot of CPU resources
page_code, the driver layer is in physical memory and accesses the application layer memory using page_code to page the memory.

IRQL >= DISPATCH_LEVEL triggers page_code assertion, detects kernel memory
DriverEntry, and IRP dispatch functions generally run at PASSIVE_LEVEL