├── README.md └── code ├── WDFStructs.h ├── kmdf_re_ida_68.py └── kmdf_re_ida_74.py /README.md: -------------------------------------------------------------------------------- 1 | # Reverse Engineering and Bug Hunting on KMDF Drivers 2 | 3 | Link to slides: https://ioactive.com/wp-content/uploads/2018/09/Reverse_Engineering_and_Bug_Hunting_On_KMDF_Drivers.pdf 4 | 5 | kmdf_re is a small idapython code that attempts to rename common structures and find usages of interesting kmdf callbacks. 6 | 7 | Presentation given at AsiaSecWest 2018 (https://www.asiasecwest.com) and 44Con 2018 (https://44con.com/) 8 | 9 | ## Author 10 | * [Enrique Nissim](https://twitter.com/kiqueNissim) -------------------------------------------------------------------------------- /code/WDFStructs.h: -------------------------------------------------------------------------------- 1 | 2 | /* 3 | In KMDF, the first parameter into the pfnWdfCallbacks is the WdfDriverGlobals object (goes in RCX), so when we say: 4 | 5 | NTSTATUS pfnWdfDriverCreate(PDRIVER_OBJECT DriverObject, PCUNICODE_STRING RegistryPath, PVOID DriverAttributes, PWDF_DRIVER_CONFIG DriverConfig, PVOID WdfDriver); 6 | 7 | WdfDriverGlobals goes in RCX 8 | DriverObject goes in RDX 9 | RegistryPath goes in R8 10 | and so on 11 | 12 | 13 | This doesn't apply to Evt*Routines like EvtIoDeviceControl. 14 | */ 15 | 16 | typedef enum _MAJOR_FUNCTIONS { 17 | DispatchCreate, 18 | DispatchCreateNamedPipe, 19 | DispatchCLose, 20 | DispatchRead, 21 | DispatchWrite, 22 | DispatchQueryInformation, 23 | DispatchSetInformation, 24 | DispatchQueryEA, 25 | DispatchSetEA, 26 | DispatchFlushBuffers, 27 | DispatchQueryVolumeInformation, 28 | DispatchSetVolumeInformation, 29 | DispatchDirectoryControl, 30 | DispatchFileSystemControl, 31 | DispatchDeviceIOControl, 32 | DispatchInternalDeviceControl, 33 | DispatchShutdown, 34 | DispatchLockControl, 35 | DispatchCleanup, 36 | DispatchCreateMailslot, 37 | DispatchQuerySecurity, 38 | DispatchSetSecurity, 39 | DispatchPower, 40 | DispatchSystemControl, 41 | DispatchDeviceChange, 42 | DispatchQueryQuota, 43 | DispatchSetQuota, 44 | DispatchPNP, 45 | } MAJOR_FUNCTIONS; 46 | 47 | typedef struct _DRIVER_OBJECT 48 | { 49 | SHORT Type; 50 | SHORT Size; 51 | PVOID DeviceObject; 52 | ULONG Flags; 53 | PVOID DriverStart; 54 | ULONG DriverSize; 55 | PVOID DriverSection; 56 | PVOID DriverExtension; 57 | UNICODE_STRING DriverName; 58 | PUNICODE_STRING HardwareDatabase; 59 | PVOID FastIoDispatch; 60 | PVOID DriverInit; 61 | PVOID DriverStartIo; 62 | PVOID DriverUnload; 63 | PVOID DispatchCreate; 64 | PVOID DispatchCreateNamedPipe; 65 | PVOID DispatchClose; 66 | PVOID DispatchRead; 67 | PVOID DispatchWrite; 68 | PVOID DispatchQueryInformation; 69 | PVOID DispatchSetInformation; 70 | PVOID DispatchQueryEA; 71 | PVOID DispatchSetEA; 72 | PVOID DispatchFlushBuffers; 73 | PVOID DispatchQueryVolumeInformation; 74 | PVOID DispatchSetVolumeInformation; 75 | PVOID DispatchDirectoryControl; 76 | PVOID DispatchFileSystemControl; 77 | PVOID DispatchDeviceIOControl; 78 | PVOID DispatchInternalDeviceControl; 79 | PVOID DispatchShutdown; 80 | PVOID DispatchLockControl; 81 | PVOID DispatchCleanup; 82 | PVOID DispatchCreateMailslot; 83 | PVOID DispatchQuerySecurity; 84 | PVOID DispatchSetSecurity; 85 | PVOID DispatchPower; 86 | PVOID DispatchSystemControl; 87 | PVOID DispatchDeviceChange; 88 | PVOID DispatchQueryQuota; 89 | PVOID DispatchSetQuota; 90 | PVOID DispatchPNP; 91 | } DRIVER_OBJECT, *PDRIVER_OBJECT; 92 | 93 | typedef struct _IO_STACK_LOCATION { 94 | UCHAR MajorFunction; 95 | UCHAR MinorFunction; 96 | UCHAR Flags; 97 | UCHAR Control; 98 | PVOID OutputBufferLength; 99 | PVOID InputBufferLength; 100 | DWORD IOControlCode; 101 | PVOID Type3InputBuffer; 102 | PVOID DeviceObject; 103 | PVOID FileObject; 104 | PVOID CompletionRoutine; 105 | PVOID Context; 106 | } IO_STACK_LOCATION, *PIO_STACK_LOCATION; 107 | 108 | typedef enum { 109 | DevicePropertyDeviceDescription = 0x0, 110 | DevicePropertyHardwareID = 0x1, 111 | DevicePropertyCompatibleIDs = 0x2, 112 | DevicePropertyBootConfiguration = 0x3, 113 | DevicePropertyBootConfigurationTranslated = 0x4, 114 | DevicePropertyClassName = 0x5, 115 | DevicePropertyClassGuid = 0x6, 116 | DevicePropertyDriverKeyName = 0x7, 117 | DevicePropertyManufacturer = 0x8, 118 | DevicePropertyFriendlyName = 0x9, 119 | DevicePropertyLocationInformation = 0xa, 120 | DevicePropertyPhysicalDeviceObjectName = 0xb, 121 | DevicePropertyBusTypeGuid = 0xc, 122 | DevicePropertyLegacyBusType = 0xd, 123 | DevicePropertyBusNumber = 0xe, 124 | DevicePropertyEnumeratorName = 0xf, 125 | DevicePropertyAddress = 0x10, 126 | DevicePropertyUINumber = 0x11, 127 | DevicePropertyInstallState = 0x12, 128 | DevicePropertyRemovalPolicy = 0x13, 129 | DevicePropertyResourceRequirements = 0x14, 130 | DevicePropertyAllocatedResources = 0x15, 131 | DevicePropertyContainerID = 0x16 132 | } DEVICE_REGISTRY_PROPERTY; 133 | 134 | typedef struct _WDF_VERSION { 135 | UINT Major; 136 | UINT Minor; 137 | UINT Build; 138 | } WDF_VERSION; 139 | 140 | typedef struct _WDF_BIND_INFO { 141 | ULONG Size; 142 | PWCHAR Component; 143 | WDF_VERSION Version; 144 | ULONG FuncCount; 145 | PVOID FuncTable; 146 | PVOID Module; // Mgmt and diagnostic use only 147 | } WDF_BIND_INFO, * PWDF_BIND_INFO; 148 | 149 | /* 150 | WdfVersionBind( 151 | __in PDRIVER_OBJECT DriverObject, 152 | __in PUNICODE_STRING RegistryPath, 153 | __inout PWDF_BIND_INFO BindInfo, 154 | __out PWDF_COMPONENT_GLOBALS* ComponentGlobals 155 | ); 156 | */ 157 | 158 | typedef struct _WDF_PNPPOWER_EVENT_CALLBACKS { 159 | ULONG Size; 160 | PVOID EvtDeviceD0Entry; 161 | PVOID EvtDeviceD0EntryPostInterruptsEnabled; 162 | PVOID EvtDeviceD0Exit; 163 | PVOID EvtDeviceD0ExitPreInterruptsDisabled; 164 | PVOID EvtDevicePrepareHardware; 165 | PVOID EvtDeviceReleaseHardware; 166 | PVOID EvtDeviceSelfManagedIoCleanup; 167 | PVOID EvtDeviceSelfManagedIoFlush; 168 | PVOID EvtDeviceSelfManagedIoInit; 169 | PVOID EvtDeviceSelfManagedIoSuspend; 170 | PVOID EvtDeviceSelfManagedIoRestart; 171 | PVOID EvtDeviceSurpriseRemoval; 172 | PVOID EvtDeviceQueryRemove; 173 | PVOID EvtDeviceQueryStop; 174 | PVOID EvtDeviceUsageNotification; 175 | PVOID EvtDeviceRelationsQuery; 176 | PVOID EvtDeviceUsageNotificationEx; 177 | } WDF_PNPPOWER_EVENT_CALLBACKS, *PWDF_PNPPOWER_EVENT_CALLBACKS; 178 | 179 | /* 180 | NTSTATUS EvtWdfDevicePrepareHardware( 181 | WDFDEVICE Device, 182 | WDFCMRESLIST ResourcesRaw, 183 | WDFCMRESLIST ResourcesTranslated 184 | ) 185 | 186 | The EvtDevicePrepareHardware callback function accesses the device's raw and translated hardware resources by using the ResourcesRaw and ResourcesTranslated handles that it receives. The callback function can call WdfCmResourceListGetCount and WdfCmResourceListGetDescriptor to traverse the resource lists. This callback function cannot modify the resource lists. 187 | 188 | For more information about resource lists and the order in which the resources appear, see raw and translated hardware resources. 189 | 190 | Typically, your driver's EvtDevicePrepareHardware callback function does the following, if necessary: 191 | 192 | - Maps physical memory addresses to virtual addresses so the driver can access memory that is assigned to the device 193 | - Determines the device's revision number 194 | - Configures USB devices 195 | - Obtains driver-defined interfaces from other drivers 196 | 197 | Optionally, EvtDevicePrepareHardware callback function might queue a work item to complete any other time-intensive configuration tasks. 198 | */ 199 | 200 | 201 | // pfnWdfDeviceInitSetPnpPowerEventCallbacks 202 | 203 | typedef struct _WDF_DRIVER_CONFIG { 204 | ULONG Size; 205 | PVOID EvtDriverDeviceAdd; 206 | PVOID EvtDriverUnload; 207 | ULONG DriverInitFlags; 208 | ULONG DriverPoolTag; 209 | } WDF_DRIVER_CONFIG, *PWDF_DRIVER_CONFIG; 210 | 211 | typedef enum _WDF_SYNCHRONIZATION_SCOPE { 212 | WdfSynchronizationScopeInvalid = 0x00, 213 | WdfSynchronizationScopeInheritFromParent = 0x1, 214 | WdfSynchronizationScopeDevice = 0x2, 215 | WdfSynchronizationScopeQueue = 0x3, 216 | WdfSynchronizationScopeNone = 0x4 217 | } WDF_SYNCHRONIZATION_SCOPE; 218 | 219 | typedef enum _WDF_EXECUTION_LEVEL { 220 | WdfExecutionLevelInvalid = 0x00, 221 | WdfExecutionLevelInheritFromParent = 0x1, 222 | WdfExecutionLevelPassive = 0x2, 223 | WdfExecutionLevelDispatch = 0x3 224 | } WDF_EXECUTION_LEVEL; 225 | 226 | typedef struct _WDF_OBJECT_CONTEXT_TYPE_INFO { 227 | ULONG Size; 228 | PCHAR ContextName; 229 | UINT ContextSize; 230 | PVOID UniqueType; 231 | PVOID EvtDriverGetUniqueContextType; 232 | } WDF_OBJECT_CONTEXT_TYPE_INFO, *PWDF_OBJECT_CONTEXT_TYPE_INFO; 233 | 234 | typedef struct _WDF_OBJECT_ATTRIBUTES { 235 | ULONG Size; 236 | PVOID EvtCleanupCallback; 237 | PVOID EvtDestroyCallback; 238 | WDF_EXECUTION_LEVEL ExecutionLevel; 239 | WDF_SYNCHRONIZATION_SCOPE SynchronizationScope; 240 | HANDLE ParentObject; 241 | UINT ContextSizeOverride; 242 | PWDF_OBJECT_CONTEXT_TYPE_INFO ContextTypeInfo; 243 | } WDF_OBJECT_ATTRIBUTES, *PWDF_OBJECT_ATTRIBUTES; 244 | 245 | 246 | 247 | /* 248 | pfnWdfObjectGetTypedContextWorker() -> receives a handle in RDX and returns a pointer into the private object context 249 | */ 250 | 251 | /* 252 | NTSTATUS WdfIoQueueCreate( 253 | _In_ WDFDEVICE Device, 254 | _In_ PWDF_IO_QUEUE_CONFIG Config, 255 | _In_opt_ PWDF_OBJECT_ATTRIBUTES QueueAttributes, 256 | _Out_opt_ WDFQUEUE *Queue 257 | ); 258 | 259 | void EvtWdfIoQueueIoDeviceControl( 260 | WDFQUEUE Queue, 261 | WDFREQUEST Request, 262 | UINT OutputBufferLength, 263 | UINT InputBufferLength, 264 | ULONG IoControlCode 265 | ) 266 | 267 | void EvtWdfIoQueueIoDeviceControl( 268 | PVOID Queue, 269 | PVOID Request, 270 | UINT OutputBufferLength, 271 | UINT InputBufferLength, 272 | ULONG IoControlCode 273 | ) 274 | 275 | 276 | void EvtWdfIoQueueIoRead( 277 | WDFQUEUE Queue, 278 | WDFREQUEST Request, 279 | size_t Length 280 | ) 281 | 282 | void EvtWdfIoQueueIoWrite( 283 | WDFQUEUE Queue, 284 | WDFREQUEST Request, 285 | size_t Length 286 | ) 287 | 288 | void EvtWdfIoQueueIoInternalDeviceControl( 289 | WDFQUEUE Queue, 290 | WDFREQUEST Request, 291 | size_t OutputBufferLength, 292 | size_t InputBufferLength, 293 | ULONG IoControlCode 294 | ) 295 | */ 296 | 297 | typedef enum _WDF_DEVICE_IO_TYPE { 298 | WdfDeviceIoUndefined = 0, 299 | WdfDeviceIoNeither = 1, 300 | WdfDeviceIoBuffered = 2, 301 | WdfDeviceIoDirect = 3, 302 | WdfDeviceIoBufferedOrDirect = 4 303 | } WDF_DEVICE_IO_TYPE, *PWDF_DEVICE_IO_TYPE; 304 | 305 | typedef enum _WDF_IO_QUEUE_DISPATCH_TYPE { 306 | WdfIoQueueDispatchInvalid = 0, 307 | WdfIoQueueDispatchSequential = 1, 308 | WdfIoQueueDispatchParallel = 2, 309 | WdfIoQueueDispatchManual = 3, 310 | WdfIoQueueDispatchMax = 4 311 | } WDF_IO_QUEUE_DISPATCH_TYPE; 312 | 313 | typedef enum _WDF_TRI_STATE { 314 | WdfFalse = FALSE, 315 | WdfTrue = TRUE, 316 | WdfUseDefault = 2 317 | } WDF_TRI_STATE, *PWDF_TRI_STATE; 318 | 319 | typedef struct _WDF_IO_QUEUE_CONFIG { 320 | ULONG Size; 321 | WDF_IO_QUEUE_DISPATCH_TYPE DispatchType; 322 | WDF_TRI_STATE PowerManaged; 323 | BOOLEAN AllowZeroLengthRequests; 324 | BOOLEAN DefaultQueue; 325 | PVOID EvtIoDefault; 326 | PVOID EvtIoRead; 327 | PVOID EvtIoWrite; 328 | PVOID EvtIoDeviceControl; 329 | PVOID EvtIoInternalDeviceControl; 330 | PVOID EvtIoStop; 331 | PVOID EvtIoResume; 332 | PVOID EvtIoCanceledOnQueue; 333 | union { 334 | struct { 335 | ULONG NumberOfPresentedRequests; 336 | } Parallel; 337 | } Settings; 338 | HANDLE Driver; 339 | } WDF_IO_QUEUE_CONFIG, *PWDF_IO_QUEUE_CONFIG; 340 | 341 | 342 | /* 343 | VOID WdfDeviceInitSetFileObjectConfig( 344 | _In_ PWDFDEVICE_INIT DeviceInit, 345 | _In_ PWDF_FILEOBJECT_CONFIG FileObjectConfig, 346 | _In_opt_ PWDF_OBJECT_ATTRIBUTES FileObjectAttributes 347 | ); 348 | */ 349 | 350 | typedef enum _WDF_FILEOBJECT_CLASS { 351 | WdfFileObjectInvalid = 0, 352 | WdfFileObjectNotRequired = 1, 353 | WdfFileObjectWdfCanUseFsContext = 2, 354 | WdfFileObjectWdfCanUseFsContext2 = 3, 355 | WdfFileObjectWdfCannotUseFsContexts = 4, 356 | WdfFileObjectCanBeOptional = 0x80000000 357 | } WDF_FILEOBJECT_CLASS, *PWDF_FILEOBJECT_CLASS; 358 | 359 | typedef struct _WDF_FILEOBJECT_CONFIG { 360 | ULONG Size; 361 | PVOID EvtDeviceFileCreate; 362 | PVOID EvtFileClose; 363 | PVOID EvtFileCleanup; 364 | WDF_TRI_STATE AutoForwardCleanupClose; 365 | WDF_FILEOBJECT_CLASS FileObjectClass; 366 | } WDF_FILEOBJECT_CONFIG, *PWDF_FILEOBJECT_CONFIG; 367 | 368 | /* 369 | NTSTATUS WdfRequestRetrieveInputBuffer( 370 | _In_ WDFREQUEST Request, 371 | _In_ size_t MinimumRequiredSize, 372 | _Out_ PVOID *Buffer, 373 | _Out_opt_ size_t *Length 374 | ); 375 | */ 376 | 377 | /* 378 | WDF Request buffers (input and output) are hold in a structure like the follows 379 | */ 380 | typedef struct _BuffRequest { 381 | PVOID InputBuffer; 382 | PVOID OutputBuffer; 383 | DWORD64 InputBuffLen; 384 | DWORD64 OutputBuffLen; 385 | } BuffRequest, *PBuffRequest; 386 | 387 | 388 | typedef enum _WDF_REQUEST_TYPE { 389 | WdfRequestTypeCreate = 0x0, 390 | WdfRequestTypeCreateNamedPipe = 0x1, 391 | WdfRequestTypeClose = 0x2, 392 | WdfRequestTypeRead = 0x3, 393 | WdfRequestTypeWrite = 0x4, 394 | WdfRequestTypeQueryInformation = 0x5, 395 | WdfRequestTypeSetInformation = 0x6, 396 | WdfRequestTypeQueryEA = 0x7, 397 | WdfRequestTypeSetEA = 0x8, 398 | WdfRequestTypeFlushBuffers = 0x9, 399 | WdfRequestTypeQueryVolumeInformation = 0xa, 400 | WdfRequestTypeSetVolumeInformation = 0xb, 401 | WdfRequestTypeDirectoryControl = 0xc, 402 | WdfRequestTypeFileSystemControl = 0xd, 403 | WdfRequestTypeDeviceControl = 0xe, 404 | WdfRequestTypeDeviceControlInternal = 0xf, 405 | WdfRequestTypeShutdown = 0x10, 406 | WdfRequestTypeLockControl = 0x11, 407 | WdfRequestTypeCleanup = 0x12, 408 | WdfRequestTypeCreateMailSlot = 0x13, 409 | WdfRequestTypeQuerySecurity = 0x14, 410 | WdfRequestTypeSetSecurity = 0x15, 411 | WdfRequestTypePower = 0x16, 412 | WdfRequestTypeSystemControl = 0x17, 413 | WdfRequestTypeDeviceChange = 0x18, 414 | WdfRequestTypeQueryQuota = 0x19, 415 | WdfRequestTypeSetQuota = 0x1A, 416 | WdfRequestTypePnp = 0x1B, 417 | WdfRequestTypeOther = 0x1C, 418 | WdfRequestTypeUsb = 0x40, 419 | WdfRequestTypeNoFormat = 0xFF, 420 | WdfRequestTypeMax = 0x100 421 | } WDF_REQUEST_TYPE; 422 | 423 | 424 | /* 425 | WDF_REQUEST_PARAMETERS requestParameters; 426 | 427 | // Get the Request parameters 428 | WDF_REQUEST_PARAMETERS_INIT(&requestParameters); 429 | WdfRequestGetParameters(Request, &requestParameters); 430 | */ 431 | 432 | typedef struct _WDF_REQUEST_PARAMETERS { 433 | USHORT Size; 434 | UCHAR MinorFunction; 435 | WDF_REQUEST_TYPE Type; 436 | union { 437 | struct { 438 | PVOID SecurityContext; 439 | ULONG Options; 440 | UINT64 FileAttributes; 441 | USHORT ShareAccess; 442 | UINT64 EaLength; 443 | } Create; 444 | struct { 445 | UINT Length; 446 | UINT64 Key; 447 | UINT64 DeviceOffset; 448 | } Read; 449 | struct { 450 | UINT Length; 451 | UINT64 Key; 452 | LONGLONG DeviceOffset; 453 | } Write; 454 | struct { 455 | UINT OutputBufferLength; 456 | UINT64 InputBufferLength; 457 | UINT64 IoControlCode; 458 | PVOID Type3InputBuffer; 459 | } DeviceIoControl; 460 | struct { 461 | PVOID Arg1; 462 | PVOID Arg2; 463 | UINT64 IoControlCode; 464 | PVOID Arg4; 465 | } Others; 466 | } Parameters; 467 | } WDF_REQUEST_PARAMETERS, *PWDF_REQUEST_PARAMETERS; 468 | 469 | 470 | 471 | /* 472 | NTSTATUS WdfDeviceAddQueryInterface( 473 | _In_ WDFDEVICE Device, 474 | _In_ PWDF_QUERY_INTERFACE_CONFIG InterfaceConfig 475 | ); 476 | */ 477 | 478 | typedef struct _INTERFACE { 479 | USHORT Size; 480 | USHORT Version; 481 | PVOID Context; 482 | PVOID InterfaceReference; 483 | PVOID InterfaceDereference; 484 | } INTERFACE, *PINTERFACE; 485 | 486 | typedef struct _WDF_QUERY_INTERFACE_CONFIG { 487 | ULONG Size; 488 | PINTERFACE Interface; 489 | PVOID GUIDInterfaceType; 490 | BOOLEAN SendQueryToParentStack; 491 | PVOID EvtDeviceProcessQueryInterfaceRequest; 492 | BOOLEAN ImportInterface; 493 | } WDF_QUERY_INTERFACE_CONFIG, *PWDF_QUERY_INTERFACE_CONFIG; 494 | 495 | 496 | 497 | 498 | typedef struct _WDF_WORKITEM_CONFIG { 499 | ULONG Size; 500 | PVOID EvtWorkItemFunc; 501 | BOOLEAN AutomaticSerialization; 502 | } WDF_WORKITEM_CONFIG, *PWDF_WORKITEM_CONFIG; 503 | 504 | /* 505 | NTSTATUS WdfWorkItemCreate( 506 | _In_ PWDF_WORKITEM_CONFIG Config, 507 | _In_ PWDF_OBJECT_ATTRIBUTES Attributes, 508 | _Out_ WDFWORKITEM *WorkItem 509 | ); 510 | 511 | */ 512 | 513 | 514 | /* 515 | IO Targets: 516 | 517 | A WDF driver can forward an I/O request or create and send a new request to another driver, called an I/O target. 518 | 519 | The framework initializes a driver's local I/O target for a device when the driver calls WdfDeviceCreate. To retrieve a handle to a device's local I/O target, the driver calls WdfDeviceGetIoTarget. 520 | 521 | NTSTATUS WdfDeviceCreate( 522 | PWDFDEVICE_INIT *DeviceInit, 523 | PWDF_OBJECT_ATTRIBUTES DeviceAttributes, 524 | WDFDEVICE *Device 525 | ); 526 | 527 | 528 | Most drivers send requests only to their local I/O target. 529 | 530 | To initialize a remote I/O target for a device, the driver must: 531 | 1) Call WdfIoTargetCreate to create an I/O target object. 532 | 2) Call WdfIoTargetOpen to open an I/O target so that the driver can send requests to it. 533 | 534 | 535 | When the driver calls WdfIoTargetOpen, it typically identifies the remote I/O target by supplying a Unicode string that represents an object name. This name can identify a device, file, or device interface. 536 | 537 | The framework sends I/O requests to the top of the driver stack that supports the object name. 538 | 539 | 540 | 541 | NTSTATUS WdfIoTargetOpen( 542 | _In_ WDFIOTARGET IoTarget, 543 | _In_ PWDF_IO_TARGET_OPEN_PARAMS OpenParams 544 | ); 545 | */ 546 | 547 | 548 | typedef enum _WDF_IO_TARGET_OPEN_TYPE { 549 | WdfIoTargetOpenUndefined = 0, 550 | WdfIoTargetOpenUseExistingDevice = 1, 551 | WdfIoTargetOpenByName = 2, 552 | WdfIoTargetOpenReopen = 3, 553 | WdfIoTargetOpenLocalTargetByFile = 4 554 | } WDF_IO_TARGET_OPEN_TYPE; 555 | 556 | typedef struct _WDF_IO_TARGET_OPEN_PARAMS { 557 | ULONG Size; 558 | WDF_IO_TARGET_OPEN_TYPE Type; 559 | PVOID EvtIoTargetQueryRemove; 560 | PVOID EvtIoTargetRemoveCanceled; 561 | PVOID EvtIoTargetRemoveComplete; 562 | PDEVICE_OBJECT TargetDeviceObject; 563 | PVOID TargetFileObject; 564 | UNICODE_STRING TargetDeviceName; 565 | DWORD DesiredAccess; 566 | ULONG ShareAccess; 567 | ULONG FileAttributes; 568 | ULONG CreateDisposition; 569 | ULONG CreateOptions; 570 | PVOID EaBuffer; 571 | ULONG EaBufferLength; 572 | PVOID AllocationSize; 573 | ULONG FileInformation; 574 | UNICODE_STRING FileName; 575 | } WDF_IO_TARGET_OPEN_PARAMS, *PWDF_IO_TARGET_OPEN_PARAMS; 576 | 577 | typedef struct _WDF_INTERRUPT_CONFIG { 578 | ULONG Size; 579 | PVOID SpinLock; 580 | WDF_TRI_STATE ShareVector; 581 | BOOLEAN FloatingSave; 582 | BOOLEAN AutomaticSerialization; 583 | PVOID EvtInterruptIsr; 584 | PVOID EvtInterruptDpc; 585 | PVOID EvtInterruptEnable; 586 | PVOID EvtInterruptDisable; 587 | PVOID EvtInterruptWorkItem; 588 | PVOID InterruptRaw; 589 | PVOID InterruptTranslated; 590 | PVOID WaitLock; 591 | BOOLEAN PassiveHandling; 592 | WDF_TRI_STATE ReportInactiveOnPowerDown; 593 | BOOLEAN CanWakeDevice; 594 | } WDF_INTERRUPT_CONFIG, *PWDF_INTERRUPT_CONFIG; 595 | 596 | /* 597 | NTSTATUS WdfInterruptCreate( 598 | _In_ WDFDEVICE Device, 599 | _In_ PWDF_INTERRUPT_CONFIG Configuration, 600 | _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes, 601 | _Out_ WDFINTERRUPT *Interrupt 602 | ); 603 | */ 604 | 605 | 606 | /* 607 | The WdfFdoInitSetDefaultChildListConfig method configures a bus driver's default child list. 608 | 609 | VOID WdfFdoInitSetDefaultChildListConfig( 610 | _Inout_ PWDFDEVICE_INIT DeviceInit, 611 | _In_ PWDF_CHILD_LIST_CONFIG Config, 612 | _In_opt_ PWDF_OBJECT_ATTRIBUTES DefaultChildListAttributes 613 | ); 614 | */ 615 | 616 | typedef struct _WDF_CHILD_LIST_CONFIG { 617 | ULONG Size; 618 | ULONG IdentificationDescriptionSize; 619 | ULONG AddressDescriptionSize; 620 | PVOID EvtChildListCreateDevice; 621 | PVOID EvtChildListScanForChildren; 622 | PVOID EvtChildListIdentificationDescriptionCopy; 623 | PVOID EvtChildListIdentificationDescriptionDuplicate; 624 | PVOID EvtChildListIdentificationDescriptionCleanup; 625 | PVOID EvtChildListIdentificationDescriptionCompare; 626 | PVOID EvtChildListAddressDescriptionCopy; 627 | PVOID EvtChildListAddressDescriptionDuplicate; 628 | PVOID EvtChildListAddressDescriptionCleanup; 629 | PVOID EvtChildListDeviceReenumerated; 630 | } WDF_CHILD_LIST_CONFIG, *PWDF_CHILD_LIST_CONFIG; 631 | 632 | 633 | typedef struct _WDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER { 634 | // 635 | // Size in bytes of the entire description, including this header. 636 | // 637 | // Same value as WDF_CHILD_LIST_CONFIG::IdentificationDescriptionSize 638 | // Used as a sanity check. 639 | // 640 | ULONG IdentificationDescriptionSize; 641 | } WDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER, 642 | *PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER; 643 | 644 | /* 645 | NTSTATUS EvtWdfChildListCreateDevice( 646 | PVOID ChildList, 647 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER IdentificationDescription, 648 | PVOID ChildInit 649 | ) 650 | 651 | NTSTATUS EvtWdfChildListIdentificationDescriptionDuplicate( 652 | PVOID ChildList, 653 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER SourceIdentificationDescription, 654 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER DestinationIdentificationDescription 655 | ) 656 | 657 | 658 | EVT_WDF_CHILD_LIST_IDENTIFICATION_DESCRIPTION_COMPARE EvtWdfChildListIdentificationDescriptionCompare; 659 | 660 | BOOLEAN EvtWdfChildListIdentificationDescriptionCompare( 661 | PVOID ChildList, 662 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER FirstIdentificationDescription, 663 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER SecondIdentificationDescription 664 | ) 665 | 666 | 667 | void EvtWdfChildListIdentificationDescriptionCleanup( 668 | WDFCHILDLIST ChildList, 669 | PWDF_CHILD_IDENTIFICATION_DESCRIPTION_HEADER IdentificationDescription 670 | ) 671 | 672 | */ 673 | 674 | 675 | /* 676 | PIRP WdfRequestWdmGetIrp( 677 | _In_ WDFREQUEST Request 678 | ); 679 | Returns the WDM IRP structure that is associated with a specified framework request object. 680 | */ 681 | 682 | 683 | // WdfDeviceInitAssignWdmIrpPreprocessCallback 684 | /* 685 | NTSTATUS WdfDeviceInitAssignWdmIrpPreprocessCallback( 686 | PVOID DeviceInit, 687 | PVOID EvtDeviceWdmIrpPreprocess, 688 | UCHAR MajorFunction, 689 | PUCHAR MinorFunctions, 690 | ULONG NumMinorFunctions 691 | ); 692 | */ 693 | 694 | 695 | // Stripped version of this structure so it fits most binaries out there 696 | typedef struct _WDFFUNCTIONS { 697 | PVOID pfnWdfChildListCreate; 698 | PVOID pfnWdfChildListGetDevice; 699 | PVOID pfnWdfChildListRetrievePdo; 700 | PVOID pfnWdfChildListRetrieveAddressDescription; 701 | PVOID pfnWdfChildListBeginScan; 702 | PVOID pfnWdfChildListEndScan; 703 | PVOID pfnWdfChildListBeginIteration; 704 | PVOID pfnWdfChildListRetrieveNextDevice; 705 | PVOID pfnWdfChildListEndIteration; 706 | PVOID pfnWdfChildListAddOrUpdateChildDescriptionAsPresent; 707 | PVOID pfnWdfChildListUpdateChildDescriptionAsMissing; 708 | PVOID pfnWdfChildListUpdateAllChildDescriptionsAsPresent; 709 | PVOID pfnWdfChildListRequestChildEject; 710 | PVOID pfnWdfCollectionCreate; 711 | PVOID pfnWdfCollectionGetCount; 712 | PVOID pfnWdfCollectionAdd; 713 | PVOID pfnWdfCollectionRemove; 714 | PVOID pfnWdfCollectionRemoveItem; 715 | PVOID pfnWdfCollectionGetItem; 716 | PVOID pfnWdfCollectionGetFirstItem; 717 | PVOID pfnWdfCollectionGetLastItem; 718 | PVOID pfnWdfCommonBufferCreate; 719 | PVOID pfnWdfCommonBufferGetAlignedVirtualAddress; 720 | PVOID pfnWdfCommonBufferGetAlignedLogicalAddress; 721 | PVOID pfnWdfCommonBufferGetLength; 722 | PVOID pfnWdfControlDeviceInitAllocate; // 0xC8 723 | PVOID pfnWdfControlDeviceInitSetShutdownNotification; 724 | PVOID pfnWdfControlFinishInitializing; 725 | PVOID pfnWdfDeviceGetDeviceState; 726 | PVOID pfnWdfDeviceSetDeviceState; 727 | PVOID pfnWdfWdmDeviceGetWdfDeviceHandle; 728 | PVOID pfnWdfDeviceWdmGetDeviceObject; 729 | PVOID pfnWdfDeviceWdmGetAttachedDevice; 730 | PVOID pfnWdfDeviceWdmGetPhysicalDevice; 731 | PVOID pfnWdfDeviceWdmDispatchPreprocessedIrp; 732 | PVOID pfnWdfDeviceAddDependentUsageDeviceObject; 733 | PVOID pfnWdfDeviceAddRemovalRelationsPhysicalDevice; 734 | PVOID pfnWdfDeviceRemoveRemovalRelationsPhysicalDevice; 735 | PVOID pfnWdfDeviceClearRemovalRelationsDevices; 736 | PVOID pfnWdfDeviceGetDriver; 737 | PVOID pfnWdfDeviceRetrieveDeviceName; 738 | PVOID pfnWdfDeviceAssignMofResourceName; 739 | PVOID pfnWdfDeviceGetIoTarget; 740 | PVOID pfnWdfDeviceGetDevicePnpState; 741 | PVOID pfnWdfDeviceGetDevicePowerState; 742 | PVOID pfnWdfDeviceGetDevicePowerPolicyState; 743 | PVOID pfnWdfDeviceAssignS0IdleSettings; 744 | PVOID pfnWdfDeviceAssignSxWakeSettings; 745 | PVOID pfnWdfDeviceOpenRegistryKey; 746 | PVOID pfnWdfDeviceSetSpecialFileSupport; 747 | PVOID pfnWdfDeviceSetCharacteristics; 748 | PVOID pfnWdfDeviceGetCharacteristics; 749 | PVOID pfnWdfDeviceGetAlignmentRequirement; 750 | PVOID pfnWdfDeviceSetAlignmentRequirement; 751 | PVOID pfnWdfDeviceInitFree; 752 | PVOID pfnWdfDeviceInitSetPnpPowerEventCallbacks; 753 | PVOID pfnWdfDeviceInitSetPowerPolicyEventCallbacks; 754 | PVOID pfnWdfDeviceInitSetPowerPolicyOwnership; 755 | PVOID pfnWdfDeviceInitRegisterPnpStateChangeCallback; 756 | PVOID pfnWdfDeviceInitRegisterPowerStateChangeCallback; 757 | PVOID pfnWdfDeviceInitRegisterPowerPolicyStateChangeCallback; 758 | PVOID pfnWdfDeviceInitSetIoType; 759 | PVOID pfnWdfDeviceInitSetExclusive; 760 | PVOID pfnWdfDeviceInitSetPowerNotPageable; 761 | PVOID pfnWdfDeviceInitSetPowerPageable; 762 | PVOID pfnWdfDeviceInitSetPowerInrush; 763 | PVOID pfnWdfDeviceInitSetDeviceType; 764 | PVOID pfnWdfDeviceInitAssignName; 765 | PVOID pfnWdfDeviceInitAssignSDDLString; //0x220 766 | PVOID pfnWdfDeviceInitSetDeviceClass; 767 | PVOID pfnWdfDeviceInitSetCharacteristics; 768 | PVOID pfnWdfDeviceInitSetFileObjectConfig; 769 | PVOID pfnWdfDeviceInitSetRequestAttributes; 770 | PVOID pfnWdfDeviceInitAssignWdmIrpPreprocessCallback; // 248h 771 | PVOID pfnWdfDeviceInitSetIoInCallerContextCallback; // 250h 772 | PVOID pfnWdfDeviceCreate; // 258h 773 | PVOID pfnWdfDeviceSetStaticStopRemove; 774 | PVOID pfnWdfDeviceCreateDeviceInterface; // 268h 775 | PVOID pfnWdfDeviceSetDeviceInterfaceState; 776 | PVOID pfnWdfDeviceRetrieveDeviceInterfaceString; 777 | PVOID pfnWdfDeviceCreateSymbolicLink; // 0x280 778 | PVOID pfnWdfDeviceQueryProperty; 779 | PVOID pfnWdfDeviceAllocAndQueryProperty; 780 | PVOID pfnWdfDeviceSetPnpCapabilities; 781 | PVOID pfnWdfDeviceSetPowerCapabilities; 782 | PVOID pfnWdfDeviceSetBusInformationForChildren; 783 | PVOID pfnWdfDeviceIndicateWakeStatus; 784 | PVOID pfnWdfDeviceSetFailed; 785 | PVOID pfnWdfDeviceStopIdleNoTrack; 786 | PVOID pfnWdfDeviceResumeIdleNoTrack; 787 | PVOID pfnWdfDeviceGetFileObject; 788 | PVOID pfnWdfDeviceEnqueueRequest; 789 | PVOID pfnWdfDeviceGetDefaultQueue; 790 | PVOID pfnWdfDeviceConfigureRequestDispatching; 791 | PVOID pfnWdfDmaEnablerCreate; 792 | PVOID pfnWdfDmaEnablerGetMaximumLength; 793 | PVOID pfnWdfDmaEnablerGetMaximumScatterGatherElements; 794 | PVOID pfnWdfDmaEnablerSetMaximumScatterGatherElements; 795 | PVOID pfnWdfDmaTransactionCreate; 796 | PVOID pfnWdfDmaTransactionInitialize; 797 | PVOID pfnWdfDmaTransactionInitializeUsingRequest; 798 | PVOID pfnWdfDmaTransactionExecute; 799 | PVOID pfnWdfDmaTransactionRelease; 800 | PVOID pfnWdfDmaTransactionDmaCompleted; 801 | PVOID pfnWdfDmaTransactionDmaCompletedWithLength; 802 | PVOID pfnWdfDmaTransactionDmaCompletedFinal; 803 | PVOID pfnWdfDmaTransactionGetBytesTransferred; 804 | PVOID pfnWdfDmaTransactionSetMaximumLength; 805 | PVOID pfnWdfDmaTransactionGetRequest; 806 | PVOID pfnWdfDmaTransactionGetCurrentDmaTransferLength; 807 | PVOID pfnWdfDmaTransactionGetDevice; 808 | PVOID pfnWdfDpcCreate; 809 | PVOID pfnWdfDpcEnqueue; 810 | PVOID pfnWdfDpcCancel; 811 | PVOID pfnWdfDpcGetParentObject; 812 | PVOID pfnWdfDpcWdmGetDpc; 813 | PVOID pfnWdfDriverCreate; 814 | PVOID pfnWdfDriverGetRegistryPath; 815 | PVOID pfnWdfDriverWdmGetDriverObject; 816 | PVOID pfnWdfDriverOpenParametersRegistryKey; 817 | PVOID pfnWdfWdmDriverGetWdfDriverHandle; 818 | PVOID pfnWdfDriverRegisterTraceInfo; 819 | PVOID pfnWdfDriverRetrieveVersionString; 820 | PVOID pfnWdfDriverIsVersionAvailable; 821 | PVOID pfnWdfFdoInitWdmGetPhysicalDevice; 822 | PVOID pfnWdfFdoInitOpenRegistryKey; 823 | PVOID pfnWdfFdoInitQueryProperty; 824 | PVOID pfnWdfFdoInitAllocAndQueryProperty; 825 | PVOID pfnWdfFdoInitSetEventCallbacks; 826 | PVOID pfnWdfFdoInitSetFilter; 827 | PVOID pfnWdfFdoInitSetDefaultChildListConfig; 828 | PVOID pfnWdfFdoQueryForInterface; 829 | PVOID pfnWdfFdoGetDefaultChildList; 830 | PVOID pfnWdfFdoAddStaticChild; 831 | PVOID pfnWdfFdoLockStaticChildListForIteration; 832 | PVOID pfnWdfFdoRetrieveNextStaticChild; 833 | PVOID pfnWdfFdoUnlockStaticChildListFromIteration; 834 | PVOID pfnWdfFileObjectGetFileName; 835 | PVOID pfnWdfFileObjectGetFlags; 836 | PVOID pfnWdfFileObjectGetDevice; 837 | PVOID pfnWdfFileObjectWdmGetFileObject; 838 | PVOID pfnWdfInterruptCreate; 839 | PVOID pfnWdfInterruptQueueDpcForIsr; 840 | PVOID pfnWdfInterruptSynchronize; 841 | PVOID pfnWdfInterruptAcquireLock; 842 | PVOID pfnWdfInterruptReleaseLock; 843 | PVOID pfnWdfInterruptEnable; 844 | PVOID pfnWdfInterruptDisable; 845 | PVOID pfnWdfInterruptWdmGetInterrupt; 846 | PVOID pfnWdfInterruptGetInfo; 847 | PVOID pfnWdfInterruptSetPolicy; 848 | PVOID pfnWdfInterruptGetDevice; 849 | PVOID pfnWdfIoQueueCreate; // 4C0h 850 | PVOID pfnWdfIoQueueGetState; 851 | PVOID pfnWdfIoQueueStart; 852 | PVOID pfnWdfIoQueueStop; 853 | PVOID pfnWdfIoQueueStopSynchronously; 854 | PVOID pfnWdfIoQueueGetDevice; 855 | PVOID pfnWdfIoQueueRetrieveNextRequest; 856 | PVOID pfnWdfIoQueueRetrieveRequestByFileObject; 857 | PVOID pfnWdfIoQueueFindRequest; 858 | PVOID pfnWdfIoQueueRetrieveFoundRequest; 859 | PVOID pfnWdfIoQueueDrainSynchronously; 860 | PVOID pfnWdfIoQueueDrain; 861 | PVOID pfnWdfIoQueuePurgeSynchronously; 862 | PVOID pfnWdfIoQueuePurge; 863 | PVOID pfnWdfIoQueueReadyNotify; 864 | PVOID pfnWdfIoTargetCreate; 865 | PVOID pfnWdfIoTargetOpen; 866 | PVOID pfnWdfIoTargetCloseForQueryRemove; 867 | PVOID pfnWdfIoTargetClose; 868 | PVOID pfnWdfIoTargetStart; 869 | PVOID pfnWdfIoTargetStop; 870 | PVOID pfnWdfIoTargetGetState; 871 | PVOID pfnWdfIoTargetGetDevice; 872 | PVOID pfnWdfIoTargetQueryTargetProperty; 873 | PVOID pfnWdfIoTargetAllocAndQueryTargetProperty; 874 | PVOID pfnWdfIoTargetQueryForInterface; 875 | PVOID pfnWdfIoTargetWdmGetTargetDeviceObject; 876 | PVOID pfnWdfIoTargetWdmGetTargetPhysicalDevice; 877 | PVOID pfnWdfIoTargetWdmGetTargetFileObject; 878 | PVOID pfnWdfIoTargetWdmGetTargetFileHandle; 879 | PVOID pfnWdfIoTargetSendReadSynchronously; 880 | PVOID pfnWdfIoTargetFormatRequestForRead; 881 | PVOID pfnWdfIoTargetSendWriteSynchronously; 882 | PVOID pfnWdfIoTargetFormatRequestForWrite; 883 | PVOID pfnWdfIoTargetSendIoctlSynchronously; 884 | PVOID pfnWdfIoTargetFormatRequestForIoctl; 885 | PVOID pfnWdfIoTargetSendInternalIoctlSynchronously; 886 | PVOID pfnWdfIoTargetFormatRequestForInternalIoctl; 887 | PVOID pfnWdfIoTargetSendInternalIoctlOthersSynchronously; 888 | PVOID pfnWdfIoTargetFormatRequestForInternalIoctlOthers; 889 | PVOID pfnWdfMemoryCreate; 890 | PVOID pfnWdfMemoryCreatePreallocated; 891 | PVOID pfnWdfMemoryGetBuffer; 892 | PVOID pfnWdfMemoryAssignBuffer; 893 | PVOID pfnWdfMemoryCopyToBuffer; 894 | PVOID pfnWdfMemoryCopyFromBuffer; 895 | PVOID pfnWdfLookasideListCreate; 896 | PVOID pfnWdfMemoryCreateFromLookaside; 897 | PVOID pfnWdfDeviceMiniportCreate; 898 | PVOID pfnWdfDriverMiniportUnload; 899 | PVOID pfnWdfObjectGetTypedContextWorker; 900 | PVOID pfnWdfObjectAllocateContext; 901 | PVOID pfnWdfObjectContextGetObject; 902 | PVOID pfnWdfObjectReferenceActual; 903 | PVOID pfnWdfObjectDereferenceActual; 904 | PVOID pfnWdfObjectCreate; 905 | PVOID pfnWdfObjectDelete; 906 | PVOID pfnWdfObjectQuery; 907 | PVOID pfnWdfPdoInitAllocate; 908 | PVOID pfnWdfPdoInitSetEventCallbacks; 909 | PVOID pfnWdfPdoInitAssignDeviceID; 910 | PVOID pfnWdfPdoInitAssignInstanceID; 911 | PVOID pfnWdfPdoInitAddHardwareID; 912 | PVOID pfnWdfPdoInitAddCompatibleID; 913 | PVOID pfnWdfPdoInitAddDeviceText; 914 | PVOID pfnWdfPdoInitSetDefaultLocale; 915 | PVOID pfnWdfPdoInitAssignRawDevice; 916 | PVOID pfnWdfPdoMarkMissing; 917 | PVOID pfnWdfPdoRequestEject; 918 | PVOID pfnWdfPdoGetParent; 919 | PVOID pfnWdfPdoRetrieveIdentificationDescription; 920 | PVOID pfnWdfPdoRetrieveAddressDescription; 921 | PVOID pfnWdfPdoUpdateAddressDescription; 922 | PVOID pfnWdfPdoAddEjectionRelationsPhysicalDevice; 923 | PVOID pfnWdfPdoRemoveEjectionRelationsPhysicalDevice; 924 | PVOID pfnWdfPdoClearEjectionRelationsDevices; 925 | PVOID pfnWdfDeviceAddQueryInterface; 926 | PVOID pfnWdfRegistryOpenKey; 927 | PVOID pfnWdfRegistryCreateKey; 928 | PVOID pfnWdfRegistryClose; 929 | PVOID pfnWdfRegistryWdmGetHandle; 930 | PVOID pfnWdfRegistryRemoveKey; 931 | PVOID pfnWdfRegistryRemoveValue; 932 | PVOID pfnWdfRegistryQueryValue; 933 | PVOID pfnWdfRegistryQueryMemory; 934 | PVOID pfnWdfRegistryQueryMultiString; 935 | PVOID pfnWdfRegistryQueryUnicodeString; 936 | PVOID pfnWdfRegistryQueryString; 937 | PVOID pfnWdfRegistryQueryULong; 938 | PVOID pfnWdfRegistryAssignValue; 939 | PVOID pfnWdfRegistryAssignMemory; 940 | PVOID pfnWdfRegistryAssignMultiString; 941 | PVOID pfnWdfRegistryAssignUnicodeString; 942 | PVOID pfnWdfRegistryAssignString; 943 | PVOID pfnWdfRegistryAssignULong; 944 | PVOID pfnWdfRequestCreate; 945 | PVOID pfnWdfRequestCreateFromIrp; 946 | PVOID pfnWdfRequestReuse; 947 | PVOID pfnWdfRequestChangeTarget; 948 | PVOID pfnWdfRequestFormatRequestUsingCurrentType; 949 | PVOID pfnWdfRequestWdmFormatUsingStackLocation; 950 | PVOID pfnWdfRequestSend; 951 | PVOID pfnWdfRequestGetStatus; 952 | PVOID pfnWdfRequestMarkCancelable; 953 | PVOID pfnWdfRequestUnmarkCancelable; 954 | PVOID pfnWdfRequestIsCanceled; 955 | PVOID pfnWdfRequestCancelSentRequest; 956 | PVOID pfnWdfRequestIsFrom32BitProcess; 957 | PVOID pfnWdfRequestSetCompletionRoutine; 958 | PVOID pfnWdfRequestGetCompletionParams; 959 | PVOID pfnWdfRequestAllocateTimer; 960 | PVOID pfnWdfRequestComplete; 961 | PVOID pfnWdfRequestCompleteWithPriorityBoost; 962 | PVOID pfnWdfRequestCompleteWithInformation; 963 | PVOID pfnWdfRequestGetParameters; 964 | PVOID pfnWdfRequestRetrieveInputMemory; 965 | PVOID pfnWdfRequestRetrieveOutputMemory; 966 | PVOID pfnWdfRequestRetrieveInputBuffer; 967 | PVOID pfnWdfRequestRetrieveOutputBuffer; 968 | PVOID pfnWdfRequestRetrieveInputWdmMdl; 969 | PVOID pfnWdfRequestRetrieveOutputWdmMdl; 970 | PVOID pfnWdfRequestRetrieveUnsafeUserInputBuffer; 971 | PVOID pfnWdfRequestRetrieveUnsafeUserOutputBuffer; 972 | PVOID pfnWdfRequestSetInformation; 973 | PVOID pfnWdfRequestGetInformation; 974 | PVOID pfnWdfRequestGetFileObject; 975 | PVOID pfnWdfRequestProbeAndLockUserBufferForRead; 976 | PVOID pfnWdfRequestProbeAndLockUserBufferForWrite; 977 | PVOID pfnWdfRequestGetRequestorMode; 978 | PVOID pfnWdfRequestForwardToIoQueue; 979 | PVOID pfnWdfRequestGetIoQueue; 980 | PVOID pfnWdfRequestRequeue; 981 | PVOID pfnWdfRequestStopAcknowledge; 982 | PVOID pfnWdfRequestWdmGetIrp; 983 | PVOID pfnWdfIoResourceRequirementsListSetSlotNumber; 984 | PVOID pfnWdfIoResourceRequirementsListSetInterfaceType; 985 | PVOID pfnWdfIoResourceRequirementsListAppendIoResList; 986 | PVOID pfnWdfIoResourceRequirementsListInsertIoResList; 987 | PVOID pfnWdfIoResourceRequirementsListGetCount; 988 | PVOID pfnWdfIoResourceRequirementsListGetIoResList; 989 | PVOID pfnWdfIoResourceRequirementsListRemove; 990 | PVOID pfnWdfIoResourceRequirementsListRemoveByIoResList; 991 | PVOID pfnWdfIoResourceListCreate; 992 | PVOID pfnWdfIoResourceListAppendDescriptor; 993 | PVOID pfnWdfIoResourceListInsertDescriptor; 994 | PVOID pfnWdfIoResourceListUpdateDescriptor; 995 | PVOID pfnWdfIoResourceListGetCount; 996 | PVOID pfnWdfIoResourceListGetDescriptor; 997 | PVOID pfnWdfIoResourceListRemove; 998 | PVOID pfnWdfIoResourceListRemoveByDescriptor; 999 | PVOID pfnWdfCmResourceListAppendDescriptor; 1000 | PVOID pfnWdfCmResourceListInsertDescriptor; 1001 | PVOID pfnWdfCmResourceListGetCount; 1002 | PVOID pfnWdfCmResourceListGetDescriptor; 1003 | PVOID pfnWdfCmResourceListRemove; 1004 | PVOID pfnWdfCmResourceListRemoveByDescriptor; 1005 | PVOID pfnWdfStringCreate; 1006 | PVOID pfnWdfStringGetUnicodeString; 1007 | PVOID pfnWdfObjectAcquireLock; 1008 | PVOID pfnWdfObjectReleaseLock; 1009 | PVOID pfnWdfWaitLockCreate; 1010 | PVOID pfnWdfWaitLockAcquire; 1011 | PVOID pfnWdfWaitLockRelease; 1012 | PVOID pfnWdfSpinLockCreate; 1013 | PVOID pfnWdfSpinLockAcquire; 1014 | PVOID pfnWdfSpinLockRelease; 1015 | PVOID pfnWdfTimerCreate; 1016 | PVOID pfnWdfTimerStart; 1017 | PVOID pfnWdfTimerStop; 1018 | PVOID pfnWdfTimerGetParentObject; 1019 | PVOID pfnWdfUsbTargetDeviceCreate; 1020 | PVOID pfnWdfUsbTargetDeviceRetrieveInformation; 1021 | PVOID pfnWdfUsbTargetDeviceGetDeviceDescriptor; 1022 | PVOID pfnWdfUsbTargetDeviceRetrieveConfigDescriptor; 1023 | PVOID pfnWdfUsbTargetDeviceQueryString; 1024 | PVOID pfnWdfUsbTargetDeviceAllocAndQueryString; 1025 | PVOID pfnWdfUsbTargetDeviceFormatRequestForString; 1026 | PVOID pfnWdfUsbTargetDeviceGetNumInterfaces; 1027 | PVOID pfnWdfUsbTargetDeviceSelectConfig; 1028 | PVOID pfnWdfUsbTargetDeviceWdmGetConfigurationHandle; 1029 | PVOID pfnWdfUsbTargetDeviceRetrieveCurrentFrameNumber; 1030 | PVOID pfnWdfUsbTargetDeviceSendControlTransferSynchronously; 1031 | PVOID pfnWdfUsbTargetDeviceFormatRequestForControlTransfer; 1032 | PVOID pfnWdfUsbTargetDeviceIsConnectedSynchronous; 1033 | PVOID pfnWdfUsbTargetDeviceResetPortSynchronously; 1034 | PVOID pfnWdfUsbTargetDeviceCyclePortSynchronously; 1035 | PVOID pfnWdfUsbTargetDeviceFormatRequestForCyclePort; 1036 | PVOID pfnWdfUsbTargetDeviceSendUrbSynchronously; 1037 | PVOID pfnWdfUsbTargetDeviceFormatRequestForUrb; 1038 | PVOID pfnWdfUsbTargetPipeGetInformation; 1039 | PVOID pfnWdfUsbTargetPipeIsInEndpoint; 1040 | PVOID pfnWdfUsbTargetPipeIsOutEndpoint; 1041 | PVOID pfnWdfUsbTargetPipeGetType; 1042 | PVOID pfnWdfUsbTargetPipeSetNoMaximumPacketSizeCheck; 1043 | PVOID pfnWdfUsbTargetPipeWriteSynchronously; 1044 | PVOID pfnWdfUsbTargetPipeFormatRequestForWrite; 1045 | PVOID pfnWdfUsbTargetPipeReadSynchronously; 1046 | PVOID pfnWdfUsbTargetPipeFormatRequestForRead; 1047 | PVOID pfnWdfUsbTargetPipeConfigContinuousReader; 1048 | PVOID pfnWdfUsbTargetPipeAbortSynchronously; 1049 | PVOID pfnWdfUsbTargetPipeFormatRequestForAbort; 1050 | PVOID pfnWdfUsbTargetPipeResetSynchronously; 1051 | PVOID pfnWdfUsbTargetPipeFormatRequestForReset; 1052 | PVOID pfnWdfUsbTargetPipeSendUrbSynchronously; 1053 | PVOID pfnWdfUsbTargetPipeFormatRequestForUrb; 1054 | PVOID pfnWdfUsbInterfaceGetInterfaceNumber; 1055 | PVOID pfnWdfUsbInterfaceGetNumEndpoints; 1056 | PVOID pfnWdfUsbInterfaceGetDescriptor; 1057 | PVOID pfnWdfUsbInterfaceSelectSetting; 1058 | PVOID pfnWdfUsbInterfaceGetEndpointInformation; 1059 | PVOID pfnWdfUsbTargetDeviceGetInterface; 1060 | PVOID pfnWdfUsbInterfaceGetConfiguredSettingIndex; 1061 | PVOID pfnWdfUsbInterfaceGetNumConfiguredPipes; 1062 | PVOID pfnWdfUsbInterfaceGetConfiguredPipe; 1063 | PVOID pfnWdfUsbTargetPipeWdmGetPipeHandle; 1064 | PVOID pfnWdfVerifierDbgBreakPoint; 1065 | PVOID pfnWdfVerifierKeBugCheck; 1066 | PVOID pfnWdfWmiProviderCreate; 1067 | PVOID pfnWdfWmiProviderGetDevice; 1068 | PVOID pfnWdfWmiProviderIsEnabled; 1069 | PVOID pfnWdfWmiProviderGetTracingHandle; 1070 | } WDFFUNCTIONS, *PWDFFUNCTIONS; 1071 | 1072 | 1073 | #define FILE_DEVICE_8042_PORT 0x00000027 1074 | #define FILE_DEVICE_ACPI 0x00000032 1075 | #define FILE_DEVICE_BATTERY 0x00000029 1076 | #define FILE_DEVICE_BEEP 0x00000001 1077 | #define FILE_DEVICE_BUS_EXTENDER 0x0000002a 1078 | #define FILE_DEVICE_CD_ROM 0x00000002 1079 | #define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003 1080 | #define FILE_DEVICE_CHANGER 0x00000030 1081 | #define FILE_DEVICE_CONTROLLER 0x00000004 1082 | #define FILE_DEVICE_DATALINK 0x00000005 1083 | #define FILE_DEVICE_DFS 0x00000006 1084 | #define FILE_DEVICE_DFS_FILE_SYSTEM 0x00000035 1085 | #define FILE_DEVICE_DFS_VOLUME 0x00000036 1086 | #define FILE_DEVICE_DISK 0x00000007 1087 | #define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008 1088 | #define FILE_DEVICE_DVD 0x00000033 1089 | #define FILE_DEVICE_FILE_SYSTEM 0x00000009 1090 | #define FILE_DEVICE_FIPS 0x0000003a 1091 | #define FILE_DEVICE_FULLSCREEN_VIDEO 0x00000034 1092 | #define FILE_DEVICE_INPORT_PORT 0x0000000a 1093 | #define FILE_DEVICE_KEYBOARD 0x0000000b 1094 | #define FILE_DEVICE_KS 0x0000002f 1095 | #define FILE_DEVICE_KSEC 0x00000039 1096 | #define FILE_DEVICE_MAILSLOT 0x0000000c 1097 | #define FILE_DEVICE_MASS_STORAGE 0x0000002d 1098 | #define FILE_DEVICE_MIDI_IN 0x0000000d 1099 | #define FILE_DEVICE_MIDI_OUT 0x0000000e 1100 | #define FILE_DEVICE_MODEM 0x0000002b 1101 | #define FILE_DEVICE_MOUSE 0x0000000f 1102 | #define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010 1103 | #define FILE_DEVICE_NAMED_PIPE 0x00000011 1104 | #define FILE_DEVICE_NETWORK 0x00000012 1105 | #define FILE_DEVICE_NETWORK_BROWSER 0x00000013 1106 | #define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014 1107 | #define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028 1108 | #define FILE_DEVICE_NULL 0x00000015 1109 | #define FILE_DEVICE_PARALLEL_PORT 0x00000016 1110 | #define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017 1111 | #define FILE_DEVICE_PRINTER 0x00000018 1112 | #define FILE_DEVICE_SCANNER 0x00000019 1113 | #define FILE_DEVICE_SCREEN 0x0000001c 1114 | #define FILE_DEVICE_SERENUM 0x00000037 1115 | #define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a 1116 | #define FILE_DEVICE_SERIAL_PORT 0x0000001b 1117 | #define FILE_DEVICE_SMARTCARD 0x00000031 1118 | #define FILE_DEVICE_SMB 0x0000002e 1119 | #define FILE_DEVICE_SOUND 0x0000001d 1120 | #define FILE_DEVICE_STREAMS 0x0000001e 1121 | #define FILE_DEVICE_TAPE 0x0000001f 1122 | #define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020 1123 | #define FILE_DEVICE_TERMSRV 0x00000038 1124 | #define FILE_DEVICE_TRANSPORT 0x00000021 1125 | #define FILE_DEVICE_UNKNOWN 0x00000022 1126 | #define FILE_DEVICE_VDM 0x0000002c 1127 | #define FILE_DEVICE_VIDEO 0x00000023 1128 | #define FILE_DEVICE_VIRTUAL_DISK 0x00000024 1129 | #define FILE_DEVICE_WAVE_IN 0x00000025 1130 | #define FILE_DEVICE_WAVE_OUT 0x00000026 -------------------------------------------------------------------------------- /code/kmdf_re_ida_68.py: -------------------------------------------------------------------------------- 1 | #https://zairon.wordpress.com/2008/02/15/idc-script-and-stack-frame-variables-length/ 2 | 3 | import idautils 4 | import idaapi 5 | import idc 6 | import struct 7 | 8 | g_vars = {} # Global variables 9 | g_functions_stack = set() # Keep track of function addresses whose stack members were erased 10 | 11 | OFFSET_WdfControlDeviceInitAllocate = 0xC8 12 | OFFSET_WdfDeviceInitSetIoIncallerContextCallback = 0x250 13 | OFFSET_WdfDeviceCreateDeviceInterface = 0x268 14 | OFFSET_WdfDeviceCreateSymbolicLink = 0x280 15 | OFFSET_WdfDriverCreate = 0x3a0 16 | OFFSET_WdfIoQueueCreate = 0x4c0 17 | OFFSET_WdfRequestRetrieveInputMemory = 0x858 18 | OFFSET_WdfRequestRetrieveOutputMemory = 0x860 19 | OFFSET_WdfRequestRetrieveInputBuffer = 0x868 20 | OFFSET_WdfRequestRetrieveOutputBuffer = 0x870 21 | OFFSET_WdfRequestRetrieveInputWdmMdl = 0x878 22 | OFFSET_WdfRequestRetrieveOutputWdmMdl = 0x880 23 | OFFSET_WdfRequestRetrieveUnsafeUserInputBuffer = 0x888 24 | OFFSET_WdfRequestRetrieveUnsafeUserOutputBuffer = 0x890 25 | 26 | 27 | def print_guid(guid): 28 | data = "GUID(" 29 | part1 = struct.unpack("