Driver Basics

WDM vs WDF driver models, DriverEntry, device objects, IRP dispatch tables, IOCTL communication, and detecting malicious driver loading

WDM vs WDF

Rootkits and security drivers nearly always use WDM, because WDF abstractions hide the IRP details needed to intercept OS behavior. This chapter focuses on WDM since it is what you will encounter in both offensive driver code and most EDR kernel components.

DriverEntry — The Driver's Main()

DriverEntry is called by the I/O manager immediately after the driver is mapped into the kernel. It must: create a device object so applications can open a handle to the driver, set up a symbolic link so user mode can find the device, and populate the DriverObject->MajorFunction dispatch table with function pointers for each IRP type it handles.

// Minimal WDM driver skeleton
#include <ntddk.h>

#define DEVICE_NAME  L"\Device\MyDriver"
#define SYMLINK_NAME L"\DosDevices\MyDriver"

VOID DriverUnload(PDRIVER_OBJECT DriverObject) {
    UNICODE_STRING symLink = RTL_CONSTANT_STRING(SYMLINK_NAME);
    IoDeleteSymbolicLink(&symLink);
    IoDeleteDevice(DriverObject->DeviceObject);
}

NTSTATUS DispatchCreateClose(PDEVICE_OBJECT DevObj, PIRP Irp) {
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject,
                      PUNICODE_STRING RegistryPath) {
    NTSTATUS status;
    UNICODE_STRING devName  = RTL_CONSTANT_STRING(DEVICE_NAME);
    UNICODE_STRING symLink  = RTL_CONSTANT_STRING(SYMLINK_NAME);
    PDEVICE_OBJECT devObj;

    // 1. Create device object (kernel-visible)
    status = IoCreateDevice(DriverObject, 0, &devName,
                            FILE_DEVICE_UNKNOWN,
                            FILE_DEVICE_SECURE_OPEN,
                            FALSE, &devObj);
    if (!NT_SUCCESS(status)) return status;

    // 2. Create symbolic link (user-mode visible: \\.\MyDriver)
    status = IoCreateSymbolicLink(&symLink, &devName);
    if (!NT_SUCCESS(status)) {
        IoDeleteDevice(devObj);
        return status;
    }

    // 3. Populate dispatch table
    DriverObject->DriverUnload                         = DriverUnload;
    DriverObject->MajorFunction[IRP_MJ_CREATE]         = DispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_CLOSE]          = DispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;

    // 4. Use buffered I/O (copies data through system buffer)
    devObj->Flags |= DO_BUFFERED_IO;
    devObj->Flags &= ~DO_DEVICE_INITIALIZING;

    return STATUS_SUCCESS;
}

IRP Dispatch Table

The MajorFunction array has 28 slots. Each slot is an IRP major function code. The key major codes:

IOCTL Interface — User-Mode to Kernel Channel

DeviceIoControl from user mode generates an IRP_MJ_DEVICE_CONTROL IRP. The IOCTL code is a 32-bit value encoding the operation, device type, access requirements, and transfer method. The driver's DispatchIoctl function receives the IRP and dispatches on the code:

// IOCTL code encoding
// CTL_CODE(DeviceType, Function, Method, Access)
#define IOCTL_READ_PHYSMEM   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, \
                                       METHOD_BUFFERED, FILE_READ_DATA)
#define IOCTL_WRITE_PHYSMEM  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, \
                                       METHOD_BUFFERED, FILE_WRITE_DATA)
#define IOCTL_MAP_KERNEL_MEM CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, \
                                       METHOD_OUT_DIRECT, FILE_ANY_ACCESS)

NTSTATUS DispatchIoctl(PDEVICE_OBJECT DevObj, PIRP Irp) {
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG code   = stack->Parameters.DeviceIoControl.IoControlCode;
    ULONG inLen  = stack->Parameters.DeviceIoControl.InputBufferLength;
    ULONG outLen = stack->Parameters.DeviceIoControl.OutputBufferLength;
    PVOID buf    = Irp->AssociatedIrp.SystemBuffer; // METHOD_BUFFERED

    NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;

    switch (code) {
    case IOCTL_READ_PHYSMEM:
        status = HandleReadPhysMem(buf, inLen, outLen,
                    &Irp->IoStatus.Information);
        break;
    case IOCTL_WRITE_PHYSMEM:
        status = HandleWritePhysMem(buf, inLen);
        break;
    default:
        break;
    }

    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

Driver Loading Mechanics

Driver Loading Path:

User Mode (admin required):
  CreateService(SC_MANAGER, ..., SERVICE_KERNEL_DRIVER)
  StartService() → calls SCM

  Service Control Manager (services.exe):
    Reads HKLM\SYSTEM\CurrentControlSet\Services\[name]
      ImagePath: path to .sys file
      Type: 0x1 = SERVICE_KERNEL_DRIVER
      Start: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled

  I/O Manager (ntoskrnl):
    NtLoadDriver() syscall
    Maps .sys PE into kernel virtual address space (SEC_IMAGE)
    Applies kernel ASLR (KASLR)
    Relocates based on kernel image base
    Calls DriverEntry()

  Windows Driver Signing enforcement:
    On x64: all drivers must have valid WHQL or Authenticode signature
    Test signing mode: bcdedit /set testsigning on (only if SecureBoot disabled)
    HVCI: additionally requires signature from verified CA chain

Alternative loading (malicious):
  NtLoadDriver() directly (no SCM)
  Exploiting kernel from user mode to map arbitrary code
  Using BYOVD to achieve ring-0 primitives without loading new driver

The registry path for a driver's configuration is:

HKLM\SYSTEM\CurrentControlSet\Services\[DriverName]
  ImagePath    = \??\C:\path\to\driver.sys
  Type         = 1       ; SERVICE_KERNEL_DRIVER
  Start        = 3       ; SERVICE_DEMAND_START (manual)
  ErrorControl = 1       ; SERVICE_ERROR_NORMAL
  ObjectName   = LocalSystem
  DisplayName  = Driver Display Name

Detection Signals

Event Log Signals

Python: Detect Unsigned or Anomalous Drivers

import subprocess, json, re

def list_loaded_drivers():
    """Use sc query type= driver or wmic path Win32_SystemDriver"""
    result = subprocess.run(
        ['powershell', '-Command',
         'Get-WmiObject Win32_SystemDriver | Select-Object Name,PathName,State,Started | ConvertTo-Json'],
        capture_output=True, text=True
    )
    return json.loads(result.stdout)

def check_driver_signature(path):
    result = subprocess.run(
        ['powershell', '-Command',
         f'Get-AuthenticodeSignature "{path}" | Select-Object Status,SignerCertificate | ConvertTo-Json'],
        capture_output=True, text=True
    )
    try:
        sig = json.loads(result.stdout)
        return sig.get('Status'), sig.get('SignerCertificate')
    except:
        return 'Unknown', None

def audit_drivers():
    drivers = list_loaded_drivers()
    if not isinstance(drivers, list):
        drivers = [drivers]

    for drv in drivers:
        path = drv.get('PathName', '')
        if not path:
            continue

        status, cert = check_driver_signature(path)

        anomalies = []
        if status != 'Valid':
            anomalies.append(f'sig={status}')
        if path and not path.lower().startswith(r'\systemroot') \
                and not path.lower().startswith(r'c:\windows'):
            anomalies.append('non-system-path')

        if anomalies:
            print(f"[!] {drv['Name']:30s} {path}")
            print(f"    anomalies: {', '.join(anomalies)}")

audit_drivers()

Q & A