├── .gitattributes ├── .gitignore ├── ClangTest.sln ├── ClangTest ├── ClangTest.inf ├── ClangTest.vcxproj ├── ClangTest.vcxproj.filters ├── DriverEntry.cpp └── DriverEntry.h ├── WindowsKernelModeDriver10.0_LLVM ├── Toolset.props └── Toolset.targets └── readme.md /.gitattributes: -------------------------------------------------------------------------------- 1 | ############################################################################### 2 | # Set default behavior to automatically normalize line endings. 3 | ############################################################################### 4 | * text=auto 5 | 6 | ############################################################################### 7 | # Set default behavior for command prompt diff. 8 | # 9 | # This is need for earlier builds of msysgit that does not have it on by 10 | # default for csharp files. 11 | # Note: This is only used by command line 12 | ############################################################################### 13 | #*.cs diff=csharp 14 | 15 | ############################################################################### 16 | # Set the merge driver for project and solution files 17 | # 18 | # Merging from the command prompt will add diff markers to the files if there 19 | # are conflicts (Merging from VS is not affected by the settings below, in VS 20 | # the diff markers are never inserted). Diff markers may cause the following 21 | # file extensions to fail to load in VS. An alternative would be to treat 22 | # these files as binary and thus will always conflict and require user 23 | # intervention with every merge. To do so, just uncomment the entries below 24 | ############################################################################### 25 | #*.sln merge=binary 26 | #*.csproj merge=binary 27 | #*.vbproj merge=binary 28 | #*.vcxproj merge=binary 29 | #*.vcproj merge=binary 30 | #*.dbproj merge=binary 31 | #*.fsproj merge=binary 32 | #*.lsproj merge=binary 33 | #*.wixproj merge=binary 34 | #*.modelproj merge=binary 35 | #*.sqlproj merge=binary 36 | #*.wwaproj merge=binary 37 | 38 | ############################################################################### 39 | # behavior for image files 40 | # 41 | # image files are treated as binary by default. 42 | ############################################################################### 43 | #*.jpg binary 44 | #*.png binary 45 | #*.gif binary 46 | 47 | ############################################################################### 48 | # diff behavior for common document formats 49 | # 50 | # Convert binary document formats to text before diffing them. This feature 51 | # is only available from the command line. Turn it on by uncommenting the 52 | # entries below. 53 | ############################################################################### 54 | #*.doc diff=astextplain 55 | #*.DOC diff=astextplain 56 | #*.docx diff=astextplain 57 | #*.DOCX diff=astextplain 58 | #*.dot diff=astextplain 59 | #*.DOT diff=astextplain 60 | #*.pdf diff=astextplain 61 | #*.PDF diff=astextplain 62 | #*.rtf diff=astextplain 63 | #*.RTF diff=astextplain 64 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.rsuser 8 | *.suo 9 | *.user 10 | *.userosscache 11 | *.sln.docstates 12 | 13 | # User-specific files (MonoDevelop/Xamarin Studio) 14 | *.userprefs 15 | 16 | # Build results 17 | [Dd]ebug/ 18 | [Dd]ebugPublic/ 19 | [Rr]elease/ 20 | [Rr]eleases/ 21 | x64/ 22 | x86/ 23 | [Aa][Rr][Mm]/ 24 | [Aa][Rr][Mm]64/ 25 | bld/ 26 | [Bb]in/ 27 | [Oo]bj/ 28 | [Ll]og/ 29 | 30 | # Visual Studio 2015/2017 cache/options directory 31 | .vs/ 32 | # Uncomment if you have tasks that create the project's static files in wwwroot 33 | #wwwroot/ 34 | 35 | # Visual Studio 2017 auto generated files 36 | Generated\ Files/ 37 | 38 | # MSTest test Results 39 | [Tt]est[Rr]esult*/ 40 | [Bb]uild[Ll]og.* 41 | 42 | # NUNIT 43 | *.VisualState.xml 44 | TestResult.xml 45 | 46 | # Build Results of an ATL Project 47 | [Dd]ebugPS/ 48 | [Rr]eleasePS/ 49 | dlldata.c 50 | 51 | # Benchmark Results 52 | BenchmarkDotNet.Artifacts/ 53 | 54 | # .NET Core 55 | project.lock.json 56 | project.fragment.lock.json 57 | artifacts/ 58 | 59 | # StyleCop 60 | StyleCopReport.xml 61 | 62 | # Files built by Visual Studio 63 | *_i.c 64 | *_p.c 65 | *_h.h 66 | *.ilk 67 | *.meta 68 | *.obj 69 | *.iobj 70 | *.pch 71 | *.pdb 72 | *.ipdb 73 | *.pgc 74 | *.pgd 75 | *.rsp 76 | *.sbr 77 | *.tlb 78 | *.tli 79 | *.tlh 80 | *.tmp 81 | *.tmp_proj 82 | *_wpftmp.csproj 83 | *.log 84 | *.vspscc 85 | *.vssscc 86 | .builds 87 | *.pidb 88 | *.svclog 89 | *.scc 90 | 91 | # Chutzpah Test files 92 | _Chutzpah* 93 | 94 | # Visual C++ cache files 95 | ipch/ 96 | *.aps 97 | *.ncb 98 | *.opendb 99 | *.opensdf 100 | *.sdf 101 | *.cachefile 102 | *.VC.db 103 | *.VC.VC.opendb 104 | 105 | # Visual Studio profiler 106 | *.psess 107 | *.vsp 108 | *.vspx 109 | *.sap 110 | 111 | # Visual Studio Trace Files 112 | *.e2e 113 | 114 | # TFS 2012 Local Workspace 115 | $tf/ 116 | 117 | # Guidance Automation Toolkit 118 | *.gpState 119 | 120 | # ReSharper is a .NET coding add-in 121 | _ReSharper*/ 122 | *.[Rr]e[Ss]harper 123 | *.DotSettings.user 124 | 125 | # JustCode is a .NET coding add-in 126 | .JustCode 127 | 128 | # TeamCity is a build add-in 129 | _TeamCity* 130 | 131 | # DotCover is a Code Coverage Tool 132 | *.dotCover 133 | 134 | # AxoCover is a Code Coverage Tool 135 | .axoCover/* 136 | !.axoCover/settings.json 137 | 138 | # Visual Studio code coverage results 139 | *.coverage 140 | *.coveragexml 141 | 142 | # NCrunch 143 | _NCrunch_* 144 | .*crunch*.local.xml 145 | nCrunchTemp_* 146 | 147 | # MightyMoose 148 | *.mm.* 149 | AutoTest.Net/ 150 | 151 | # Web workbench (sass) 152 | .sass-cache/ 153 | 154 | # Installshield output folder 155 | [Ee]xpress/ 156 | 157 | # DocProject is a documentation generator add-in 158 | DocProject/buildhelp/ 159 | DocProject/Help/*.HxT 160 | DocProject/Help/*.HxC 161 | DocProject/Help/*.hhc 162 | DocProject/Help/*.hhk 163 | DocProject/Help/*.hhp 164 | DocProject/Help/Html2 165 | DocProject/Help/html 166 | 167 | # Click-Once directory 168 | publish/ 169 | 170 | # Publish Web Output 171 | *.[Pp]ublish.xml 172 | *.azurePubxml 173 | # Note: Comment the next line if you want to checkin your web deploy settings, 174 | # but database connection strings (with potential passwords) will be unencrypted 175 | *.pubxml 176 | *.publishproj 177 | 178 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 179 | # checkin your Azure Web App publish settings, but sensitive information contained 180 | # in these scripts will be unencrypted 181 | PublishScripts/ 182 | 183 | # NuGet Packages 184 | *.nupkg 185 | # The packages folder can be ignored because of Package Restore 186 | **/[Pp]ackages/* 187 | # except build/, which is used as an MSBuild target. 188 | !**/[Pp]ackages/build/ 189 | # Uncomment if necessary however generally it will be regenerated when needed 190 | #!**/[Pp]ackages/repositories.config 191 | # NuGet v3's project.json files produces more ignorable files 192 | *.nuget.props 193 | *.nuget.targets 194 | 195 | # Microsoft Azure Build Output 196 | csx/ 197 | *.build.csdef 198 | 199 | # Microsoft Azure Emulator 200 | ecf/ 201 | rcf/ 202 | 203 | # Windows Store app package directories and files 204 | AppPackages/ 205 | BundleArtifacts/ 206 | Package.StoreAssociation.xml 207 | _pkginfo.txt 208 | *.appx 209 | 210 | # Visual Studio cache files 211 | # files ending in .cache can be ignored 212 | *.[Cc]ache 213 | # but keep track of directories ending in .cache 214 | !?*.[Cc]ache/ 215 | 216 | # Others 217 | ClientBin/ 218 | ~$* 219 | *~ 220 | *.dbmdl 221 | *.dbproj.schemaview 222 | *.jfm 223 | *.pfx 224 | *.publishsettings 225 | orleans.codegen.cs 226 | 227 | # Including strong name files can present a security risk 228 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 229 | #*.snk 230 | 231 | # Since there are multiple workflows, uncomment next line to ignore bower_components 232 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 233 | #bower_components/ 234 | 235 | # RIA/Silverlight projects 236 | Generated_Code/ 237 | 238 | # Backup & report files from converting an old project file 239 | # to a newer Visual Studio version. Backup files are not needed, 240 | # because we have git ;-) 241 | _UpgradeReport_Files/ 242 | Backup*/ 243 | UpgradeLog*.XML 244 | UpgradeLog*.htm 245 | ServiceFabricBackup/ 246 | *.rptproj.bak 247 | 248 | # SQL Server files 249 | *.mdf 250 | *.ldf 251 | *.ndf 252 | 253 | # Business Intelligence projects 254 | *.rdl.data 255 | *.bim.layout 256 | *.bim_*.settings 257 | *.rptproj.rsuser 258 | *- Backup*.rdl 259 | 260 | # Microsoft Fakes 261 | FakesAssemblies/ 262 | 263 | # GhostDoc plugin setting file 264 | *.GhostDoc.xml 265 | 266 | # Node.js Tools for Visual Studio 267 | .ntvs_analysis.dat 268 | node_modules/ 269 | 270 | # Visual Studio 6 build log 271 | *.plg 272 | 273 | # Visual Studio 6 workspace options file 274 | *.opt 275 | 276 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 277 | *.vbw 278 | 279 | # Visual Studio LightSwitch build output 280 | **/*.HTMLClient/GeneratedArtifacts 281 | **/*.DesktopClient/GeneratedArtifacts 282 | **/*.DesktopClient/ModelManifest.xml 283 | **/*.Server/GeneratedArtifacts 284 | **/*.Server/ModelManifest.xml 285 | _Pvt_Extensions 286 | 287 | # Paket dependency manager 288 | .paket/paket.exe 289 | paket-files/ 290 | 291 | # FAKE - F# Make 292 | .fake/ 293 | 294 | # JetBrains Rider 295 | .idea/ 296 | *.sln.iml 297 | 298 | # CodeRush personal settings 299 | .cr/personal 300 | 301 | # Python Tools for Visual Studio (PTVS) 302 | __pycache__/ 303 | *.pyc 304 | 305 | # Cake - Uncomment if you are using it 306 | # tools/** 307 | # !tools/packages.config 308 | 309 | # Tabs Studio 310 | *.tss 311 | 312 | # Telerik's JustMock configuration file 313 | *.jmconfig 314 | 315 | # BizTalk build output 316 | *.btp.cs 317 | *.btm.cs 318 | *.odx.cs 319 | *.xsd.cs 320 | 321 | # OpenCover UI analysis results 322 | OpenCover/ 323 | 324 | # Azure Stream Analytics local run output 325 | ASALocalRun/ 326 | 327 | # MSBuild Binary and Structured Log 328 | *.binlog 329 | 330 | # NVidia Nsight GPU debugger configuration file 331 | *.nvuser 332 | 333 | # MFractors (Xamarin productivity tool) working folder 334 | .mfractor/ 335 | 336 | # Local History for Visual Studio 337 | .localhistory/ 338 | 339 | # BeatPulse healthcheck temp database 340 | healthchecksdb -------------------------------------------------------------------------------- /ClangTest.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30611.23 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ClangTest", "ClangTest\ClangTest.vcxproj", "{2411D5F8-1842-4155-9012-5C652C6DF9AD}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | LLVM|ARM = LLVM|ARM 15 | LLVM|ARM64 = LLVM|ARM64 16 | LLVM|x64 = LLVM|x64 17 | LLVM|x86 = LLVM|x86 18 | Release|ARM = Release|ARM 19 | Release|ARM64 = Release|ARM64 20 | Release|x64 = Release|x64 21 | Release|x86 = Release|x86 22 | EndGlobalSection 23 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 24 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM.ActiveCfg = Debug|ARM 25 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM.Build.0 = Debug|ARM 26 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM.Deploy.0 = Debug|ARM 27 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM64.ActiveCfg = Debug|ARM64 28 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM64.Build.0 = Debug|ARM64 29 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|ARM64.Deploy.0 = Debug|ARM64 30 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x64.ActiveCfg = Debug|x64 31 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x64.Build.0 = Debug|x64 32 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x64.Deploy.0 = Debug|x64 33 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x86.ActiveCfg = Release|x64 34 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x86.Build.0 = Release|x64 35 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Debug|x86.Deploy.0 = Release|x64 36 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|ARM.ActiveCfg = LLVM|ARM 37 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|ARM.Build.0 = LLVM|ARM 38 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|ARM64.ActiveCfg = LLVM|ARM64 39 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|ARM64.Build.0 = LLVM|ARM64 40 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|x64.ActiveCfg = LLVM|x64 41 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|x64.Build.0 = LLVM|x64 42 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|x86.ActiveCfg = LLVM|Win32 43 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.LLVM|x86.Build.0 = LLVM|Win32 44 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM.ActiveCfg = Release|ARM 45 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM.Build.0 = Release|ARM 46 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM.Deploy.0 = Release|ARM 47 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM64.ActiveCfg = Release|ARM64 48 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM64.Build.0 = Release|ARM64 49 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|ARM64.Deploy.0 = Release|ARM64 50 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x64.ActiveCfg = Release|x64 51 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x64.Build.0 = Release|x64 52 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x64.Deploy.0 = Release|x64 53 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x86.ActiveCfg = Release|Win32 54 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x86.Build.0 = Release|Win32 55 | {2411D5F8-1842-4155-9012-5C652C6DF9AD}.Release|x86.Deploy.0 = Release|Win32 56 | EndGlobalSection 57 | GlobalSection(SolutionProperties) = preSolution 58 | HideSolutionNode = FALSE 59 | EndGlobalSection 60 | GlobalSection(ExtensibilityGlobals) = postSolution 61 | SolutionGuid = {EA3B38CB-DF08-4411-874E-5D98283EAB8F} 62 | EndGlobalSection 63 | EndGlobal 64 | -------------------------------------------------------------------------------- /ClangTest/ClangTest.inf: -------------------------------------------------------------------------------- 1 | ; 2 | ; ClangTest.inf 3 | ; 4 | 5 | [Version] 6 | Signature="$WINDOWS NT$" 7 | Class=Sample ; TODO: edit Class 8 | ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid 9 | Provider=%ManufacturerName% 10 | CatalogFile=ClangTest.cat 11 | DriverVer= ; TODO: set DriverVer in stampinf property pages 12 | PnpLockDown=1 13 | 14 | [DestinationDirs] 15 | DefaultDestDir = 12 16 | ClangTest_Device_CoInstaller_CopyFiles = 11 17 | 18 | ; ================= Class section ===================== 19 | 20 | [ClassInstall32] 21 | Addreg=SampleClassReg 22 | 23 | [SampleClassReg] 24 | HKR,,,0,%ClassName% 25 | HKR,,Icon,,-5 26 | 27 | [SourceDisksNames] 28 | 1 = %DiskName%,,,"" 29 | 30 | [SourceDisksFiles] 31 | ClangTest.sys = 1,, 32 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames 33 | 34 | ;***************************************** 35 | ; Install Section 36 | ;***************************************** 37 | 38 | [Manufacturer] 39 | %ManufacturerName%=Standard,NT$ARCH$ 40 | 41 | [Standard.NT$ARCH$] 42 | %ClangTest.DeviceDesc%=ClangTest_Device, Root\ClangTest ; TODO: edit hw-id 43 | 44 | [ClangTest_Device.NT] 45 | CopyFiles=Drivers_Dir 46 | 47 | [Drivers_Dir] 48 | ClangTest.sys 49 | 50 | ;-------------- Service installation 51 | [ClangTest_Device.NT.Services] 52 | AddService = ClangTest,%SPSVCINST_ASSOCSERVICE%, ClangTest_Service_Inst 53 | 54 | ; -------------- ClangTest driver install sections 55 | [ClangTest_Service_Inst] 56 | DisplayName = %ClangTest.SVCDESC% 57 | ServiceType = 1 ; SERVICE_KERNEL_DRIVER 58 | StartType = 3 ; SERVICE_DEMAND_START 59 | ErrorControl = 1 ; SERVICE_ERROR_NORMAL 60 | ServiceBinary = %12%\ClangTest.sys 61 | 62 | ; 63 | ;--- ClangTest_Device Coinstaller installation ------ 64 | ; 65 | 66 | [ClangTest_Device.NT.CoInstallers] 67 | AddReg=ClangTest_Device_CoInstaller_AddReg 68 | CopyFiles=ClangTest_Device_CoInstaller_CopyFiles 69 | 70 | [ClangTest_Device_CoInstaller_AddReg] 71 | HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller" 72 | 73 | [ClangTest_Device_CoInstaller_CopyFiles] 74 | WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll 75 | 76 | [ClangTest_Device.NT.Wdf] 77 | KmdfService = ClangTest, ClangTest_wdfsect 78 | [ClangTest_wdfsect] 79 | KmdfLibraryVersion = $KMDFVERSION$ 80 | 81 | [Strings] 82 | SPSVCINST_ASSOCSERVICE= 0x00000002 83 | ManufacturerName="" ;TODO: Replace with your manufacturer name 84 | ClassName="Samples" ; TODO: edit ClassName 85 | DiskName = "ClangTest Installation Disk" 86 | ClangTest.DeviceDesc = "ClangTest Device" 87 | ClangTest.SVCDESC = "ClangTest Service" 88 | -------------------------------------------------------------------------------- /ClangTest/ClangTest.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | LLVM 10 | ARM 11 | 12 | 13 | LLVM 14 | ARM64 15 | 16 | 17 | LLVM 18 | Win32 19 | 20 | 21 | LLVM 22 | x64 23 | 24 | 25 | Release 26 | Win32 27 | 28 | 29 | Debug 30 | x64 31 | 32 | 33 | Release 34 | x64 35 | 36 | 37 | Debug 38 | ARM 39 | 40 | 41 | Release 42 | ARM 43 | 44 | 45 | Debug 46 | ARM64 47 | 48 | 49 | Release 50 | ARM64 51 | 52 | 53 | 54 | {2411D5F8-1842-4155-9012-5C652C6DF9AD} 55 | {1bc93793-694f-48fe-9372-81e2b05556fd} 56 | v4.5 57 | 12.0 58 | Debug 59 | Win32 60 | ClangTest 61 | $(LatestTargetPlatformVersion) 62 | 63 | 64 | 65 | Windows10 66 | true 67 | WindowsKernelModeDriver10.0 68 | Driver 69 | KMDF 70 | Universal 71 | 72 | 73 | Windows10 74 | false 75 | WindowsKernelModeDriver10.0 76 | Driver 77 | KMDF 78 | Universal 79 | 80 | 81 | Windows10 82 | false 83 | WindowsKernelModeDriver10.0 84 | Driver 85 | KMDF 86 | Universal 87 | 88 | 89 | Windows10 90 | true 91 | WindowsKernelModeDriver10.0_LLVM 92 | Driver 93 | KMDF 94 | Universal 95 | 96 | 97 | Windows10 98 | false 99 | WindowsKernelModeDriver10.0 100 | Driver 101 | KMDF 102 | Universal 103 | 104 | 105 | Windows10 106 | false 107 | WindowsKernelModeDriver10.0_LLVM 108 | Driver 109 | KMDF 110 | Universal 111 | false 112 | 113 | 114 | Windows10 115 | true 116 | WindowsKernelModeDriver10.0 117 | Driver 118 | KMDF 119 | Universal 120 | 121 | 122 | Windows10 123 | false 124 | WindowsKernelModeDriver10.0 125 | Driver 126 | KMDF 127 | Universal 128 | 129 | 130 | Windows10 131 | false 132 | WindowsKernelModeDriver10.0 133 | Driver 134 | KMDF 135 | Universal 136 | 137 | 138 | Windows10 139 | true 140 | WindowsKernelModeDriver10.0 141 | Driver 142 | KMDF 143 | Universal 144 | 145 | 146 | Windows10 147 | false 148 | WindowsKernelModeDriver10.0 149 | Driver 150 | KMDF 151 | Universal 152 | 153 | 154 | Windows10 155 | false 156 | WindowsKernelModeDriver10.0 157 | Driver 158 | KMDF 159 | Universal 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | DbgengKernelDebugger 171 | 172 | 173 | DbgengKernelDebugger 174 | 175 | 176 | DbgengKernelDebugger 177 | 178 | 179 | DbgengKernelDebugger 180 | 181 | 182 | DbgengKernelDebugger 183 | 184 | 185 | DbgengKernelDebugger 186 | 187 | 188 | DbgengKernelDebugger 189 | 190 | 191 | DbgengKernelDebugger 192 | 193 | 194 | DbgengKernelDebugger 195 | 196 | 197 | DbgengKernelDebugger 198 | 199 | 200 | DbgengKernelDebugger 201 | 202 | 203 | DbgengKernelDebugger 204 | 205 | 206 | 207 | -mllvm -irobf-cse -mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cff %(AdditionalOptions) 208 | 209 | 210 | 211 | 212 | -mllvm -irobf-cse -mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cff 213 | 214 | 215 | 216 | false 217 | 218 | 219 | false 220 | 221 | 222 | 223 | 224 | 225 | 226 | 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | -------------------------------------------------------------------------------- /ClangTest/ClangTest.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Driver Files 24 | 25 | 26 | 27 | 28 | Resource Files 29 | 30 | 31 | 32 | 33 | Header Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /ClangTest/DriverEntry.cpp: -------------------------------------------------------------------------------- 1 | #include "DriverEntry.h" 2 | 3 | static VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject) 4 | { 5 | UNREFERENCED_PARAMETER(DriverObject); 6 | return; 7 | } 8 | EXTERN_C NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString) 9 | { 10 | UNREFERENCED_PARAMETER(pRegistryString); 11 | ULONG64 _Rax = 0; 12 | 13 | for (size_t i = 0; i < 10; i++) 14 | { 15 | DPRINT("Test\n"); 16 | 17 | } 18 | __asm 19 | { 20 | mov _Rax, rax 21 | } 22 | DPRINT("Rax = %x\n", _Rax); 23 | 24 | pDriverObj->DriverUnload = DriverUnload; 25 | 26 | return STATUS_UNSUCCESSFUL; 27 | } -------------------------------------------------------------------------------- /ClangTest/DriverEntry.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | #define DPRINT(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, format, __VA_ARGS__) 5 | 6 | 7 | -------------------------------------------------------------------------------- /WindowsKernelModeDriver10.0_LLVM/Toolset.props: -------------------------------------------------------------------------------- 1 | 12 | 13 | 14 | 15 | true 16 | 22 | Spectre 23 | $(Driver_SpectreMitigation) 24 | DbgengKernelDebugger 25 | 26 | 27 | $(MicrosoftKitRoot)\ 28 | 29 | 10.0 30 | 31 | $(MicrosoftKitRoot)windows kits\$(WDKKitVersion) 32 | 33 | $(Registry:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots@KitsRoot10) 34 | $(Registry:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Kits\Installed Roots@KitsRoot10) 35 | 36 | 37 | $(WDKContentRoot)\ 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.props 49 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v143\Toolset.props 50 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.props 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | -------------------------------------------------------------------------------- /WindowsKernelModeDriver10.0_LLVM/Toolset.targets: -------------------------------------------------------------------------------- 1 | 15 | 16 | 17 | 18 | 19 | 20 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v142\Toolset.targets 21 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\v143\Toolset.targets 22 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.targets 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | -------------------------------------------------------------------------------- /readme.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: 如何使用LLVM编译Windows驱动(混淆&Asm) 3 | date: 2020-10-14 15:10:47 4 | tags: 5 | --- 6 | ### 前言 7 | --- 8 | > 总所周知 世界上最好的IDE **Viusal studio** 所用的msvc编译器无法使用x64的内联汇编 9 | > 当然我们可以选择intel 的编译器 这里我们提供一个选择 10 | > llvm对vs兼容性没有 intel 编译器好 但是他还有个功能是intel没有的 就是混淆 11 | 12 | 13 | 14 | #### 混淆效果&内联汇编 15 | --- 16 | 混淆前代码 17 | ``` 18 | #include "DriverEntry.h" 19 | 20 | static VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject) 21 | { 22 | UNREFERENCED_PARAMETER(DriverObject); 23 | return; 24 | } 25 | EXTERN_C NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString) 26 | { 27 | UNREFERENCED_PARAMETER(pRegistryString); 28 | ULONG64 _Rax = 0; 29 | 30 | for (size_t i = 0; i < 10; i++) 31 | { 32 | DPRINT("Test\n"); 33 | 34 | } 35 | __asm 36 | { 37 | mov _Rax, rax 38 | } 39 | DPRINT("Rax = %x\n", _Rax); 40 | 41 | pDriverObj->DriverUnload = DriverUnload; 42 | 43 | return STATUS_UNSUCCESSFUL; 44 | } 45 | ``` 46 | 混淆后IDA F5 47 | ![图 1](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/4d5f75a4d5f282938b4e85fcf60921adcf86c162d960bf79ce0146c1c4f61543.png) 48 | ![图 2](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/5f1523b8f84d86ec6def2592c3f8ccff6d0112b83481f1c1f8c5891d54494642.png) 49 | 这里我们使用的是 [goron](https://github.com/amimo/goron) 50 | 51 | 52 | 53 | #### 如何实现 54 | ##### 1.下载安装官方版本LLVM 55 | > 这一步其实自己设置环境变量 56 | ``` 57 | LLVM_DIR 58 | ``` 59 | 60 | LLVM 官方下载地址:[LLVM](https://releases.llvm.org/) 61 | ##### 2.安装LLVM插件 62 | * **Vs2022** 插件下载地址: [llvm2019 for vs 2022](https://github.com/KomiMoe/llvm2019/tree/2022) 63 | * **Vs2019** 插件下载地址: [llvm2019](https://marketplace.visualstudio.com/items?itemName=MarekAniola.mangh-llvm2019) 64 | * **Vs2017** 插件下载地址: [LLVM Compiler Toolchain](https://marketplace.visualstudio.com/items?itemName=LLVMExtensions.llvm-toolchain) 65 | * **2017以下不支持** 66 | 67 | ##### 3.修改WDK配置 68 | ###### 1.打开**PlatformToolsets**目录 69 | 我的: 70 | ``` 71 | D:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Microsoft\VC\v160\Platforms\x64\PlatformToolsets 72 | ``` 73 | ###### 2.复制WindowsKernelModeDriver10.0并重命名 74 | 如下 75 | ![图 3](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/86e3eb7cac42d41325dcf6b651d7785b1b6eea9cd8eb4c3882520ebe5b9fab6c.png) 76 | ###### 3.修改WindowsKernelModeDriver10.0_LLVM中的配置 77 | * Toolset.props 78 | ``` 79 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.props 80 | 81 | ``` 82 | ![图 4](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/1a164385b82fa23a6d879b42bd9fc8774118271f6183c5a4a9a435925408f2aa.png) 83 | 84 | * Toolset.targets 85 | ``` 86 | $(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\llvm\Toolset.targets 87 | 88 | ``` 89 | 90 | ![图 5](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/6529826c42712b6eb16208f6460314175025ce217721af553656d130cab026df.png) 91 | 92 | ###### 4.配置项目 93 | * 平台工具集 选择 WindowsKernelModeDriver10.0_LLVM 94 | 95 | ![图 6](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/c310ef9a9e2b41b4ab6005ecf2478b514b28961ce7a7de8a76013d0bb3758d44.png) 96 | * 选择了我们上面修改的工具及 这里就会出现 **LLVM** 选项 我们这里只需要 **Clang-cl** 其他全选**否**(vs2017 有三个选项) 97 | ![图 7](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/fa5337795e89a9969ffd32d2487c48e1ea8fcde27b2ec188c5897db381182e96.png) 98 | * 关闭Qspectre 缓解 99 | ![图 8](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/0ab64f4e7d7fd76d5f1c623a9da1e90eab69546aa5b8995835f32eff03f6327e.png) 100 | * c/c++ 命令行 从父级或项目默认设置继承 取消勾选 101 | 102 | ###### 5. 可选 103 | * 使用带混淆的llvm 比如 [ollvm](https://github.com/heroims/obfuscator/tree/llvm-9.0) 或者 [goron](https://github.com/amimo/goron) 等其他可以在 104 | c/c++ 命令行 其他选项 添加混淆选项 以下是[goron](https://github.com/amimo/goron)的混淆选项 105 | ``` 106 | -mllvm -irobf-cse -mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cff 107 | ``` 108 | ![图 10](https://chordp.coding.net/p/hexo/d/blog/git/raw/master/d30127101441e031cec5865082467ac2291fc9ce7180f4bc27696837d1f0153c.png) 109 | ###### 6. 项目地址 110 | * 里面包括修改好的项目 以及 修改好的编译器配置 111 | [项目地址](https://github.com/Chordp/ClangTest) 112 | --------------------------------------------------------------------------------