{"id":30,"date":"2006-09-11T10:31:04","date_gmt":"2006-09-11T10:31:04","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2006\/09\/11\/getting-started\/"},"modified":"2026-07-24T17:23:17","modified_gmt":"2026-07-24T17:23:17","slug":"getting-started","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2006\/09\/11\/getting-started\/","title":{"rendered":"Getting Started…"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Let’s just stop the idle talk and get our hands dirty. Answering some requests, in this post I will take the steps to develop a minimum driver. At the end of this post, we will have a module that will be installed and loaded into the kernel without any functional purpose. I am not gonna talk yet about process context, Devices, Symbolic Links, IOCTL, IRP, DPC, ISR, FGTS, IR, or even about IPTU. I’ll talk a little about everything over time. Today we’ll just build from scratch an empty module that could eventually serve as a starting point for future experiments.<\/p>\n

To compile a driver for Windows, we need minimally the Windows Device Driver Kit (DDK).\u00a0The DDK can be obtained from the Microsoft website<\/a>.\u00a0There are some alternatives to get the DDK, but the most economical of them is to opt \u00a0for downloading the ISO file.\u00a0When this post was created, the version available on the site was the “Windows Server 2003 SP1 DDK” with 230 MB.<\/p>\n

I do not think it’s necessary to provide each detail about the DDK installation, something like “Take the mouse to the button which the text on it written NEXT and press the left mouse button”. <\/em>The default options are more than sufficient for our experiments.\u00a0If you don’t have much on disk space, change the options of “Build Environments”<\/em> to be installed only Windows 2000 environments, as it appears below.\u00a0This will make the necessary space drop from 628 MB to 246 MB.\u00a0If you still have trouble installing the DDK, you might consider professional help<\/a>.<\/p>\n

\"\"<\/div>\n

After installing the DDK, we have everything we need to create drivers.\u00a0Obviously, there are many other tools that make our work more comfortable, but in this post we will stay on bread and water.<\/p>\n

For our test, create a folder where we put the driver source (e.g. C:\\Projects\\Useless).\u00a0Inside this folder, create a text file named “Useless.c”<\/em> and use your text editor from the bottom of your heart to enter the source below.\u00a0Not worth using “Microsoft Word”<\/em>, but if you thought it, use the “Notepad”<\/em> and seek for professional help<\/a>.<\/p>\n

\n
#include<\/span> <\/pre>\n
 <\/pre>\n
VOID OnDriverUnload(IN PDRIVER_OBJECT   pDriverObject);<\/pre>\n
 <\/pre>\n
\/****<\/span><\/pre>\n
***     DriverEntry <\/span><\/pre>\n
**<\/span><\/pre>\n
**      That's the entry point of our driver, everything starts here,<\/span><\/pre>\n
**      and later it'll get confused and confused...<\/span><\/pre>\n
*\/<\/span><\/pre>\n
 <\/pre>\n
NTSTATUS DriverEntry(IN PDRIVER_OBJECT  pDriverObject,<\/pre>\n
                     IN PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    \/\/-f--> If there is a debugger attached to the system,<\/span><\/pre>\n
    \/\/      we could see the message below.<\/span><\/pre>\n
    DbgPrint(\"Wow, it's really working!\\n\"<\/span>);<\/pre>\n
 <\/pre>\n
    \/\/-f--> Here we inform the system that our driver can be<\/span><\/pre>\n
    \/\/      unloaded dynamically and the callback routine that<\/span><\/pre>\n
    \/\/      will handle the completion of all is the OnDriverUnload.<\/span><\/pre>\n
    pDriverObject->DriverUnload = OnDriverUnload;<\/pre>\n
 <\/pre>\n
    \/\/-f--> Phew! We were able to get here, that deserves<\/span><\/pre>\n
    \/\/      a success return code to the system.<\/span><\/pre>\n
    return<\/span> STATUS_SUCCESS;<\/pre>\n
}<\/pre>\n
 <\/pre>\n
 <\/pre>\n
\/****<\/span><\/pre>\n
***     OnDriverUnload<\/span><\/pre>\n
**<\/span><\/pre>\n
**      Callback routine that deals with the necessary<\/span><\/pre>\n
**      terminations to get this driver unloaded.<\/span><\/pre>\n
*\/<\/span><\/pre>\n
 <\/pre>\n
VOID OnDriverUnload(IN PDRIVER_OBJECT   pDriverObject)<\/pre>\n
{<\/pre>\n
    \/\/-f--> If there is a debugger attached to the system,<\/span><\/pre>\n
    \/\/      we could see the message below.<\/span><\/pre>\n
    DbgPrint(\"But now? I did nothing so far...\\n\"<\/span>);<\/pre>\n
}<\/pre>\n<\/div>\n
After doing “Copy”<\/em> and “Paste”<\/em> from the source above, we can notice some points.\u00a0In this example, remember saving your source file with extension “.c”<\/em>; otherwise, we will have some problems in exporting our entry point.\u00a0In a few posts, I intend to demonstrate how to have “.cpp”<\/em> files\u00a0and how to use object-orientation in building drivers.\u00a0Another important point to be noted is that the use of \u00a0DriverUnload callback\u00a0function is optional.\u00a0If you don’t wanna provide a callback function for the driver unload notification, just don’t do this assignment.\u00a0However, in these circumstances the driver will not be able to be unloaded.\u00a0You need this assignment even for an empty function, so that its driver is able to get turned off.\u00a0Let’s talk about this in more details later (see details in the DDK).<\/p>\n
It is still necessary to create files that define the project.\u00a0In the same directory as the source, create a file named “makefile”<\/em> and copy the text below to it.\u00a0This file simply implements the real “Makefile”<\/em> that is used to build various DDK\u00a0components.<\/p>\n
\n
!INCLUDE $(NTMAKEENV)\\makefile.def<\/pre>\n<\/div>\n
The makefile\u00a0should never be edited.\u00a0All settings what type of driver will be compiled on, which sources will make up the driver, which libraries will be used and many other settings are specified in the file named “SOURCES” that must exist in the same directory. Its content is the one that appears below.\u00a0In conjunction with the “makefile.def”<\/em> from DDK, these files create a series of macros that greatly facilitate the project file creation as a Visual Studio\u00a0“.vcproj”<\/em>.\u00a0Posts about how to use Visual Studio 2005 to compile drivers are also on my list of tasks.<\/p>\n
\n
TARGETNAME=Useless<\/pre>\n
TARGETPATH=obj<\/pre>\n
TARGETTYPE=DRIVER<\/pre>\n
 <\/pre>\n
SOURCES=Useless.c<\/pre>\n<\/div>\n
There are too many details to be discussed on a file “SOURCES” <\/em>for now, let’s just limit it to know that your final binary name is defined by “TARGETNAME” variable, and the list of source code that makes up your driver should be set in “SOURCES” variables separated by space. (For more details, see it in DDK).<\/p>\n
At last, after having the files created, let’s compile them.\u00a0For this, we must set some environment variables to define where the libraries, headers and binaries are that will compile your sources.\u00a0Installing DDK provides a shortcut on your Start Menu<\/em> that points to the file “setenv.bat”<\/em>.\u00a0This shortcut opens a console window and sets up the environment to compile the driver.\u00a0You find the shortcut in “Build Environments”<\/em> that was installed in your Start Menu<\/em>.\u00a0Should there be a “Checked”<\/em> and a\u00a0“Free”<\/em> version of this shortcut.\u00a0Whereas the “Checked”<\/em> version sets up the environment to generate drivers with debug information,\u00a0“Free”<\/em> version sets up the environment for their final version, which is equivalent to “Release”<\/em>. Selecting the “Checked Build”<\/em> from “Windows 2000” <\/em>menu, we\u00a0will have a Command Prompt window with the title as shown below. Follow the same image steps below to get the same results.<\/p>\n
\"\"<\/div>\n
Launching the command “build”<\/em>, we should have the following results:<\/p>\n
\"\"<\/div>\n
All done now, we just need a victim, or rather, a volunteer.\u00a0It could be your cousin’s computer, a younger brother’s, an intern’s, or just anyone’s that is not bigger than you or also a person’s who can not make you lose your job.\u00a0Try not to use your own machine, we may need it later. Usually I use virtual machines; they are perfect victims.\u00a0Next, we will install our driver by the simplest way I know. We will edit some entries at the registry and restart the system.\u00a0There are some APIs and tools that register the driver and put it to work right away without restarting the system, but remember, we are just on bread and water.<\/p>\n
Firstly we copy the “Useless.sys”<\/em> file that was generated in subfolder “objchk_w2k_x86\\i386”<\/em> of\u00a0our project to the folder “\\Windows\\System32\\drivers”<\/em>.\u00a0Then, using the registry editor, you need to create the\u00a0“Useless”<\/em> key inside the\u00a0“Services”<\/em> key of the system and put the values as shown in the figure below.<\/p>\n
\"\"<\/div>\n
These lines are the minimum for a driver in the registry.\u00a0The “Type” <\/em>value\u00a0specifies a Kernel driver, the “Start” <\/em>value indicates that it will be started manually and finally the “ErrorControl” <\/em>value <\/em>tells the system how it should behave if this driver fails in its load time (details, details and\u00a0details…).<\/p>\n
At this point, we have to restart the system, so that the system becomes aware of this new module.\u00a0Our driver won’t start automatically.\u00a0Once the system has restarted, go to the Console Prompt and start the driver with the command “net start Useless”<\/em>. Isn’t it impressive as anything happened?\u00a0This means that the driver is doing exactly what it has been intended to do, “Nothing”<\/em>. You can stop the driver using the “net stop Useless” <\/em>command. If we had the debugger attached to the system, we’d have the following outputs.<\/p>\n
\"\"<\/div>\n
For those who have never created a driver before and cannot see the output in WinDbg, it becomes very frustrating, because nothing happened to prove that our driver was really loaded and running in Kernel.\u00a0To give a little more action to this monotony, modify the DriverEntry()<\/em> function as shown below.\u00a0Recompile the driver, replace it at the directory “\\Windows\\System32\\drivers”<\/em> and finally reboot the machine.<\/p>\n
\n
NTSTATUS DriverEntry(IN PDRIVER_OBJECT  pDriverObject,<\/pre>\n
                     IN PUNICODE_STRING pusRegistryPath)<\/pre>\n
{<\/pre>\n
    \/\/-f--> Say hello to the BSOD and get used to it...<\/span><\/pre>\n
    *(PVOID*)0x00000000 = 0;<\/pre>\n
 <\/pre>\n
    \/\/-f--> We wont survive to see this.<\/span><\/pre>\n
    return<\/span> STATUS_SUCCESS;<\/pre>\n
}<\/pre>\n<\/div>\n
In this case, when the driver starts, it will try to write at zero address; an exception is thrown here and we will have our first Blue Screen of Death (BSOD).\u00a0Have fun!<\/p>\n
I’ll try to interim posts for beginners with more advanced ones in order to try to attract the attention of both groups.\u00a0In this post we have nothing very useful, but we already have the basis for people who have never had contact with this type of development before, so they can do their first step.\u00a0Every citizen has the right to create a Blue Screen.\u00a0\ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"
Let’s just stop the idle talk and get our hands dirty. Answering some requests, in this post I will take the steps to develop a minimum driver. At the end of this post, we will have a module that will be installed and loaded into the kernel without any functional purpose. I am not gonna […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-30","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/30","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/comments?post=30"}],"version-history":[{"count":1,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/30\/revisions"}],"predecessor-version":[{"id":31,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/posts\/30\/revisions\/31"}],"wp:attachment":[{"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/media?parent=30"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/categories?post=30"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/driverentry.com.br\/en\/wp-json\/wp\/v2\/tags?post=30"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}