Click here to Skip to main content

Submit your article

Kernel

kernel

Great Reads

Reboot or Not to Reboot?

by Maxim Kartavenkov

This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.

The Kernel-Bridge Framework

by Alexander Eremeev

The Windows kernel-hacking library and development framework written on C++17

Comparison of User Mode and Kernel Mode Applications for Modifying HTTP Traffic

by Apriorit Inc, gamapat

Take a look at how to intercept HTTP traffic in order to inject custom code into Windows HTML markup

The OX Boot Loader

by Roger Doss

The OX kernel features its own custom boot loader designed to boot a 32 bit protected mode kernel.

Latest Articles

Reboot or Not to Reboot?

by Maxim Kartavenkov

This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.

Storage Device Restriction Using a Minifilter Driver Approach

by Rahul Dev Tripathi

The fully working sample code explains everything necessary to create a Minifilter driver to block devices connected through an interface.

Porting a Large Project from Windows to Linux

by Greg Utas

Analogous functions, subtle differences, multiple compilers...

How to Debug the Linux Kernel with QEMU and Libvirt

by Apriorit Inc, Sergii Kusii

And its modules during runtime

All Articles

Kernel

Reboot or Not to Reboot?

13 Oct 2023 by Maxim Kartavenkov

This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.

The Kernel-Bridge Framework

1 Nov 2018 by Alexander Eremeev

The Windows kernel-hacking library and development framework written on C++17

Comparison of User Mode and Kernel Mode Applications for Modifying HTTP Traffic

7 Nov 2018 by Apriorit Inc, gamapat

Take a look at how to intercept HTTP traffic in order to inject custom code into Windows HTML markup

The OX Boot Loader

5 Sep 2013 by Roger Doss

The OX kernel features its own custom boot loader designed to boot a 32 bit protected mode kernel.

Struct problem in C code

30 Jan 2019 by CPallini

It should be typedef struct _OBJECT_DIRECTORY_ENTRY { struct _OBJECT_DIRECTORY_ENTRY* ChainLink; } OBJECT_DIRECTORY_ENTRY;

Pre boot authentication

18 Nov 2015 by Dave Kreskowiak

This little project is nowhere near as easy as you think it is.First, you're going to be limited to ASM code. You're not going to have ANY libraries at all, so you have to write everything from scratch, including any encryption algorithms and key storage and management. If you think you need...

Kernel Modules using autoconf

17 Dec 2015 by Tim ONeil

Using the autoconf tool chain to add modules to the Linux kernel

Whats the best practices for mastering in reading source java and c++?

2 Mar 2016 by CPallini

If you inntend to master C++ and Java then don't read Linux kernel sources. You know, Linux kernel is written using just bare C (as far as I know, even the standard C library is not allowed in kernel code). Moreover the Linux kernel code has to be very efficient, not elegant. Finally you have to...

Whats the best practices for mastering in reading source java and c++?

2 Mar 2016 by Richard MacCutchan

This is not something you can learn from a book, you learn it by doing. If you do not have enough experience in either C++ or Java, then you just need to study more tutorials and samples that Google will find for you.

how to make bootable image after compiling source code

15 Apr 2013 by Matthew Faithfull

The HelenOS documentation should explain how to do this. If you want another example which has entirely Windows hosted development and a includes an OS Bootloader for x86 based machines then I would take a look at the SanOS[^] project which is a fantastic small OS example.

Whats the best practices for mastering in reading source java and c++?

2 Mar 2016 by Patrice T

C/C++ source code are notoriously difficult to understand for non specialist.Only experience and practice can help you to understand some C code such as Linux kernel where every trick is used to gain speed.I suggest not reading Linux source code as there is little chances that you can reuse...

How to initialize global struct in C

26 Jan 2019 by OriginalGriff

now org is (incomplete type is not allowed) C - just like C++ - is case sensitive, so original is not the same as Original. Try: struct Orginal { PDRIVER_OBJECT driver_object; // NULL PDRIVER_UNLOAD unload; // NULL PDRIVER_DISPATCH major_functions[IRP_MJ_MAXIMUM_FUNCTION + 1]; //{ NULL };...

How to make matrix multiplication by parts in C++

16 Aug 2020 by User 11060979

Preface Of course in c++ there are much more elegant solutions possible. This in case you implement a class Matrix (and Vector). But that was not your question. Implementation trial according to your question Here an implementation completely...

IOCTL block or allow process creation

10 May 2022 by Randor

Hello, You could block the process creation by setting the CreationStatus member in the PS_CREATE_NOTIFY_INFO structure[^] to access denied in your callback. I want to tell you that everything you are describing goes against Best Practices[^]....

Why All code that runs in kernel mode shares a single virtual address space

8 Dec 2012 by CPallini

Because Windows kernel (like, for instance, Linux one) is monolithic. There are alternatives, however, like Minix (see Microkernel at Wikipedia[^], "Does Windows have a Microkernel or Monolithic kernel?"[^]).The latter page gives you also a reason: performance.

DecodePointer could not be located in kernel32.dll Windows 2000 Server

29 Jan 2013 by Vyacheslav Voronenko

DecodePointer is a function which comes with Windows XP SP2 and is not supported on Windows 2000 Have you compiled software which is not suited for Windows 2000?http://msdn.microsoft.com/en-us/library/bb432242%28VS.85%29.aspx[^]

Custom Windows Logon

27 Oct 2013 by Dave Kreskowiak

The time that you want this app to run is referred to as a Windows Service application. The problem is what you describe cannot be done in a Windows Service app.On Windows Vista and above, you would be writing a custom Credential Provider.You're going to have a REALLY hard time with...

application control (how implement)

21 Nov 2013 by Richard MacCutchan

Look at some of these links[^]. There are many ways of restricting your systems by the security policies in Windows.

Is kernel a process?

29 Jan 2015 by CPallini

What about looking up the Kernel Wikipedia page[^] ?

How to clear file content without closing its handle in kernel mode

28 Feb 2016 by Richard MacCutchan

You can use the FILE_OVERWRITE option on your call to ZwCreateFile routine (Windows Drivers)[^].

KmTest: Kernel-mode C++ Unit Testing Framework in BDD-style

18 Jan 2017 by Sergey Podobry

How-to guide about using KmTest for writing kernel-mode unit tests

BITMAPINFOHEADER : fill data using copymemory

22 Aug 2017 by Jochen Arndt

You are copying to bimPtr (allocated memory) but print out bim.biSize (bim is allocated but never changed). Instead of trying to convert VBA code that calls an API function to copy memory (which calls the standard C library function memcpy in the background), you should understand what the code...

Using beaglebone black as a keyboard device.

1 Oct 2018 by Member 14002991

I don't know if you still need this, but I found the solution to your problem. I'm just starting a project where I need to do the same. The BBB sets up the USB clients in /opt/scripts/boot/am335x_evm.sh And it seems that after this, you can no longer disable the UDC in order to install your...

How to initialize global struct in C

26 Jan 2019 by Rick York

Your attempt had a seperate instruction so it was not the right syntax for initialization. Try this :struct orginal org = { NULL, NULL, NULL, NULL, false, 0 };

Having another problem with C foreach loop

27 Jan 2019 by CPallini

It depends on very nature of the HashBuckets variable. What is it, exactly? You didn't provide any insight about. I suggest you to NOT obfuscate C code behind macros. Wtite clean C code instead of trying to mimic the C++ counterpart.

How to Debug the Linux Kernel with QEMU and Libvirt

1 Mar 2019 by Apriorit Inc, Sergii Kusii

And its modules during runtime

Sending a struct with mapviewoffile and reading an unkown value (shared memory)

10 Mar 2019 by Rick York

If you never close those handles you will eventually run out of them. I made a little class that does the mapping and then unmaps and closes the handle on destruction so it is automatic. I recommend you do the same. You can use RPM as the constructor. To help synchronize things, I would add...

Shared memory execute so fast ?

17 Mar 2019 by Rick York

What you are doing wrong is hoping that two processes in different execution rings can coordinate themselves by pure luck. As I have written to you before, you need to use a signalling mechanism. This can be a simple counter that the processes watch for a change or it could be an event (or...

How can two virtual memory pointing to same physical memory in linux

29 Oct 2019 by Richard MacCutchan

You should ask the person who wrote those statements. We have no idea what the context of those claims may be.

How to hide/lock folders in C++?

19 Jan 2012 by Otto Lehmann

Hello everyone!I want to develop a software which blocks an accessing specific folders/files.And I also want the app to hide folders as long.And it is welcome if the app works on vista/seven.If you have any source code or have implemented such project, then please help me.Looking...

tdi network driver how control single process network upload，download?

10 Mar 2012 by C++Kernel

Hello, I want to know the TDI driver, how to control the network of a single process to upload and download, I never developed overdrive, I always think that driver development is useless, I do not want to lose this salary, I hope you help me,If you know the the TDI traffic monitoring open...

Dereferncing pointer to incomplete type error while using iw_struct

10 Apr 2012 by Someonebored

Hi, I'm writing a linux kernel module and I'm trying to use the get_wireless_stats function , but it keeps printing an error saying :"dereferencing pointer to incomplete type"here's how I used it, can anyone tell me what's going on?struct net_device *dev;struct iw_statistics...

Dereferncing pointer to incomplete type error while using iw_struct

10 Apr 2012 by Someonebored

Incompete type is a type that is declared but not defined (in case of struct types). the problem here was that wireless_handlers is declared in net_device.h but not defined,it's defined in net/iw_handler.h. All I had to do was include it and the error disappeared!

Is there a Kernel Module that mimics the utility 'ifconfig' ?

12 Apr 2012 by Someonebored

Hi, well the question pretty much explains its self, I'm looking for a kernel module that can print out important statistics about all the interfaces on my local machine.thanks,

how write a similar SoftICE kernel debuger

29 Apr 2012 by C++Kernel

hello,everyone...

DebugView Not Working

25 May 2012 by aboutjayesh

hi,While i use DbgPrint in kernel driver program DebugView does not print or log nothing...plz help me to solve this..thank u...

How to provide Driver and user interaction?

27 May 2012 by lilyNaz

Hello,I have written a driver and I need my driver to call a function in a user mode program(which can be done using DEVICEIOCONTROL), then my driver have to wait for the user program to respond. I need a sample code which does so.Thanks

How to provide Driver and user interaction?

27 May 2012 by User 59241

You should perhaps read the series of which this article is part:Driver Development Part 2: Introduction to Implementing IOCTLs[^]

Software Like Debug View to capture kernel

29 May 2012 by aboutjayesh

Hi,Can you Suggest a software like Debug View to capture kernel messages using DbgPrint()....Thank you

Read from kernl using char buffer in console

12 Jun 2012 by aboutjayesh

hi,i use RtlCopyMemory( userBuffer, Devicebuffer, Length);to set the user buffer from kernel and use the buffer char inBuffer[100];in console to retrieve that content.While the length of data from the kernel greater than the size 100,then the system hang up.Plz help me to find the...

Read from kernl using char buffer in console

12 Jun 2012 by OriginalGriff

Do you see the "Length" parameter on the RtlCopyMemory function?Either:1) Set that to the length of inBuffer (i.e. 100 in your example)or2) Allocate inBuffer that number of characters.

can't open device file after called?

2 Jul 2012 by mot sach

After i create device file by calling device_create:device_create(test_class, parent, devt, test_dev, "%s", "test") i can list test file device when using ls command# ls -l /dev/testbut when i using command:# cat /dev/testi get an error:couldn't found '/dev/test' or...

DebugView Not Working

11 Jul 2012 by dvsha

Open DebugView Editor, goto "Capture" tab and enable "Capture Kernel" and "Enable Verbose Kernel Output". Then you will be able to see kernel level output.---Dhirendra

How to notify an event from kernel to user space?

10 Aug 2012 by mot sach

I'm writing driver for dip switch, i want to notify an event to user space when dip switch is toggled. but i don't know how to notify an event from kernel to user space and handle this event in user application.Please suggest for me. Thanks so much!

How to differentiate between android application based on permissions

24 Aug 2012 by Tarun Batra

I want to detect which application is using the microphone.Suppose two applications have access to the microphone. For an application to use the microphone, it should have android.permission.RECORD_AUDIO.With the lsof command, we can detect the microphone is being used, but not the...

Is there any provision in android to know which user application is using which system service

24 Aug 2012 by Tarun Batra

Is there any provision in android or ndk by to know which user application is using which system service? OR another way by using pid:-Suppose i have an application which uses microphone, microphone is opened by the system service (named media serv).I can manage to get the pid of above...

Porting RTX-Kernel projects to Eclipse IDE and compile it using GCC compiler

31 Oct 2012 by Member 8738746

We have a project in KEIL IDE for LPC2148 which has RTX kernel programs along with other programs in it, which was compiled by ARM CC.Now we need to change the IDE from KEIL(ARM CC) to Eclipse(GCC). When we tried to compile it in Eclipse GCC Compiler, it is showing errors in RTX_Config.c and...

How to log keyboard inputs in Keyboard Input Filter Driver (kbfiltr)

11 Nov 2012 by muneeb131

I am trying to store all the keyboard inputs being monitored using the kbfiltr driver (given in the Windows Driver Kit). At present, I can only create a text file using the ZwCreateFile routine, inside the DriverEntry routine; but I cannot write any information to file inside the...

How to log keyboard inputs in Keyboard Input Filter Driver (kbfiltr)

23 Nov 2012 by Dharmateja Challa

I did it differently, but you can give it a try,KbFilter_IsrHook( PDEVICE_OBJECT DeviceObject, PKEYBOARD_INPUT_DATA CurrentInput, POUTPUT_PACKET CurrentOutput, UCHAR StatusByte, PUCHAR DataByte, ...

Why All code that runs in kernel mode shares a single virtual address space

8 Dec 2012 by AminMhmdi

Based on MSDN article All code that runs in kernel mode shares a single virtual address space. This means that a kernel-mode driver is not isolated from other drivers and the operating system itself. If a kernel-mode driver accidentally writes to the wrong virtual address, data that belongs to...

How to verify signatures of a PE in my driver?

1 Jan 2013 by parths

Hi, Wintrust.h and wincrypt.h use type definitions and / or macros which are defined in or indirectly from windows.hThis means that windows.h must be included before the wincrypt and wintrust headers.It seems (from the error listing you posted above) like you include hierarchy does...

DecodePointer could not be located in kernel32.dll Windows 2000 Server

29 Jan 2013 by gssajith87

My Application is compiled in VS2010 [c++]. Starting the application in Windows2000 Server Sp4 throws error popup saying - "Decodepointer could not be located in kernel32.dll". Google did not help. Have any one seen such problem before. All suggestions are welcome and...

DecodePointer could not be located in kernel32.dll Windows 2000 Server

29 Jan 2013 by H.Brydon

If you are building an app that needs to run on a down-rev version of windows (or an old version of Internet Explorer) you need to pay attention to the settings of _WIN32_WINNT and _WIN32_IE. These specify to the compiler what minimum OS and IE will be supported on target systems.Here is...

About the network driver interfacing with the linux kernel

19 Mar 2013 by Robert Clove

Hello All,I want to know(study) about the network driver interfacing with the linux kernel.For this i would like to use my own system driver as an case study.Can you please tell me the good references from where i can study the above concept.I will be very thank full to you .

About the network driver interfacing with the linux kernel

19 Mar 2013 by Richard MacCutchan

There are lots of sites dedicated to Linux development, which you can find via Google.

Windows Filtering Platform

3 Apr 2013 by jan.mach71

I'm developing network sniffer, bacically to to monitor complete network traffic - no blocking, no modification, interested in data volume, failing connections. I have it on TDI level now. For Windows 8 I need WFP. I've spent couple of days on several WFP examples. Instead of answers I'm having...

How to write into a proc file through another proc file?

10 May 2013 by BaldevS

Hello to ALL,I am writing a proc file through which i want to write something into another proc file.Is it possible to do this. If yes, then how and if no then why.NOTE : Both the proc files having read and write(read and write methods) permissions.Thanks in Advance

hook page-fault in x64

14 May 2013 by Member 8119034

hi, i want to know if is possible hook KiPageFault from IDT like other interrupts?only this interrupt give me problems and i don't understand why.I also tried with this:NewHandler:jmp OrigHandler(this routine does nothing and doesn't work too...)Thanks

KdPrintEx in 'Debugger Immediate Window' into VS 2012 is not printing any msg.

14 Jun 2013 by Amit KD

Hello,I'm debugging KmdfSmall driver installed on target VM by using VS2012 which is on Host.But, 'Debugger Immediate Window' in VS 2012 on host not printing any msg. Here I'm using KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "\n KmdfSmallEvtDeviceAdd has been called\n")) as it is...

What settings does Visual Studio 2012 require to print the Kernel debug messages?

15 Jun 2013 by Amit KD

Hey Solved! changed the value of Component Filter Mask on target machine where driver has been installed to debug.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter. Under this key, created a value with the name "IHVDRIVER" and Set the value of this...

DMA_BIT_MASK Operation in Kernel

3 Jul 2013 by OriginalGriff

Google is your friend: Be nice and visit him often. He can answer questions a lot more quickly than posting them here...A very quick search using just DMA_BIT_MASK as the search term gave 23,000 hits: Google DMA_BIT_MASK[^]The top hit took me to Linux Crsoss reference,...

Accessing Device files in Linux kernel.

12 Jul 2013 by Ivan Ivanov 83

Hi All :)I'm well aware that accessing normal files in kernel space is a bad idea, but is it that bad idea to access a device file associated with some device driver?I have to communicate with a device driver through another kernel module (which could well be a user space module but I'm...

Need brief information about Kernel and it's Types and Benefits.

14 Jul 2013 by Balaji N BI

need brief Information about the kernelhello sir I am Balaji.N from india. i am Bachelor of computer science and engineering graduates. my passion is to become a developer in field. I am more interested in Operating system my lifetime ambition is to create my own Operating system. I could...

Need brief information about Kernel and it's Types and Benefits.

15 Jul 2013 by Richard MacCutchan

You are a Bachelor of Computer Science & Engineering, you want to build your own OS, and yet you do not know what a kernel[^] is. Are you sure that's the subject you graduated in? I suggest you take your diploma throw it in the trash, and start doing some proper study of this subject:...

boot updated kernel image on beagleboard

18 Jul 2013 by ayush Joshi

i had installed a kernel on Beagle-board to update image of kernel on to it.i have used commandsudo apt-get install linux-image-3.2.0.49-omapit installed the kernel on Beagle-board it also generate initrd image for this version but it didn't generate a uImage and zImage. actually i want to...

Test signing my own driver with a custom certificate

18 Sep 2013 by Savail

Hey all,So I have created my first driver .sys file and I wanted to check if it works well. I'm getting message that "this driver has been blocked from loading" when I try to use StartService Windows API in order to run the driver. I'm using windows 8 64 bit and I've found out that my driver...

ptrace(PTRACE_ATTACH, ...) failing with error code one while attaching a thread from another thread

19 Sep 2013 by iDebD

I want to trace a specific thread from another thread.(Both are created from same parent)1) Is it possible?I wrote following code here; But from "thread_func_tracer" I got error no : 1, that is insufficient permission; i.e ptrace(PTRACE_ATTACH...) is failing with error code 1.Can any...

Multichannel I/O supporting for WDK MSVAD samples

10 Oct 2013 by SYAMKUMAR S

What are the steps to change the WDK MSVAD samples to get multichannel capture/render support?

Process and memory model in Unix

17 Oct 2013 by Super Flanker

Hi,I have studied a few books about operating system internals but have not found any clear explanation about a few things that have been on my mind for a while. I have a few questions and I would really appreciate it if someone could provide me with plain and comprehensive...

Process and memory model in Unix

17 Oct 2013 by Richard MacCutchan

You should get hold of a book on OS internals for the answers to these questions. Some of these[^] will probably help.

Which driver framework is suitable for making a Virtual Audio Device Driver (UMDF or KMDF)?

11 Nov 2013 by SYAMKUMAR S

Hi,Which driver framework is suitable for making a Virtual Audio Device Driver (fake audio device driver)? UMDF or KMDF? Is it possible to make a virtual audio device driver from a Component Object Model (COM) dll architecture (eg:-ASIO4ALL.dll driver is a user mode device driver)and the...

How does a kernel module gets attached to a running kernel?

13 Feb 2014 by Vinay Kumar Tiwary

Hello everyone,I am a learing device drivers. So far I've executed small modules. I was wondering how linux allows insertion of a module even while its running? I did a search for it but not satisfied or may be could not understand. All I got is linux daemon executes modprobe add new module....

File System Notification Kit (FSNK) Introduction

9 Jul 2014 by SoftPerfect Research

Introduction in the File System Notification Kit (FSNK) product for monitoring file system activity in real-time.

product-showcase

Virtual Volume Software Development Kit (VV SDK) Online User Guide

9 Jul 2014 by SoftPerfect Research

Virtual Volume Software Development Kit (VV SDK) is a developer’s toolkit for creating virtual disks.

product-showcase

ASM tuts for 16 bit systems

26 Aug 2014 by Curtdawg99

Hello, I have wanted to do this project for a while and that is to make a boot able kernel from ground up and i mean from literally nothing. I was thinking that maybe 16 bit x86 real mode assembly language would be a good choice for this. This would be for educational purposes and it...

System Restore like Devlelopment

12 Dec 2014 by Member 11304907

I have to develop a kernel level driver that makes user changes (new files, new software installations, etc.) store at a cache (or specified location in the disk). Upon restart of the machine, all changes to be discarded and original system to be loaded. This is similar to softwares like Deep...

System Restore like Devlelopment

12 Dec 2014 by Mehdi Gholam

Try using a virtual machine for this, you can save a copy of the "original state" of your VM and reuse that.Some VM managers allow for online snapshots (1 or more) and restores.

Why does DeviceIoControl with FSCTL_ENUM_USN_DATA return 0 for several values?

4 Jan 2015 by Mandelnuss

I am trying to enumerate the NTFS USN change log. Calling DeviceIoControl with the control code FSCTL_ENUM_USN_DATA returns zero for Reason, SecurityId, SourceInfo and TimeStamp for all 428k records.Why? How do I get the full record?

Is kernel a process?

29 Jan 2015 by venkat28vk

Hi,Is kernel a process, because i have read in many forums that it is a program that manages IO operations, and also few people are saying that kernel is a process.Kindly do share your feedback..

Building a driver via winddk

30 Mar 2015 by kommuric

Best thing is to sign the drivers with test signature, at least. Please see the following link for documentation.https://msdn.microsoft.com/en-us/library/windows/hardware/ff553480(v=vs.85).aspx[^]Alternatively, on Windows 7, while booting, press F8. It should show options to enabled...

how to create a log file for fsfilter driver which will record the debug messages without using DbgView

29 Apr 2015 by Member 11535226

how to create a log file for fsfilter driver which will record the debug messages without using DbgView

How can I get Thread Id from its handle in NtCreateThreadEx(&ThreadHandle,...)?

18 Jul 2015 by hassan_sayfi69

HiHow can I get Thread Id from its handle in NtCreateThread(&ThreadHandle) system call or NtCreateThreadEx(&ThreadHandle, ...)?I try to load thread's information by calling NtQueryInformationThread but this system call fails with ambiguous error code. Now I need a solution to get an ID of...

Intel(R) System Studio Developer Story : With Intel ® JTAG debugger and MinnowBoard MAX, how to debug exception errors in the Android-Linux-Kernel.

1 Sep 2015 by Android on Intel

In this article, we can see how to debug and check the exception error in Android Linux Kernel in Intel ® Architecture-based system with Intel ® JTAG Debugger which is a part of tool Intel System Studio ® Ultimate Edition

How do I start Gnome Weston/Wayland when the system boot up ?

10 Dec 2015 by rafidkarim

hi,I just installed a wayland and gnome in Debian 8 system, and I can access trough the desktop environment using gnome-session --session=gnome-waylandI want when I start the Debian it would directly go trough the Gnome automatically. Like the command run automatically.

How to clear file content without closing its handle in kernel mode

28 Feb 2016 by Wshwilfried

Hello, I have a file that I use to save data when the system is running and I wish to save data to it but before saving, I want to erase its old content so at the end I can only have the latest content in the file. For some reason I would like to achieve that without close the file handle.I...

Problem while opening a shared file.

4 Apr 2016 by Wshwilfried

Hello, Sorry for the basic question. I need to create a file for write access in kernel mode and and allow other thread to read it, this can happen simultaneously. so This what I do when creating the file. status =...

Problem while opening a shared file.

4 Apr 2016 by bling

It looks like you are mixing access flags with other types of flags. Also, you omit FILE_SHARE_WRITE in the second ZwCreateFile.Try this:ntstatus =...

Runung Linux Kernel 2.6.x on Ubuntu

10 Apr 2016 by Albert Holguin

In order for you to test against a specific kernel version, you need to have that kernel version installed and running. You can do this within a virtual machine. Here are a few options from Ubuntu.[^]

NDIS 5.1 to NDIS 6.x or WLF

2 Jan 2017 by ysrikanth_mca

Hi,we have used a open source NDIS IM filter driver( ipfw+dummynet) which is working fine in windows 7 but but not loading in Windows 10 Desktop.Ipfw web site : http://info.iet.unipi.it/~luigi/dummynet/Source Code : https://github.com/luigirizzo/dummynetLooks like NDIS 5.1 code...

For GETTING porthandle

7 May 2017 by Jochen Arndt

Quote: to know all of the listening ports If you don't know the ports you can't use a function that queries information for a specific port number defined by a handle. Even if you would have a handle calling that undocumented function would give you no useful information because no information...

Enumerating process id in kernel mode with EPROCESS structure

1 Aug 2017 by MinYoung Lee

I want to enumerate all of the process id running on my system by using EPROCESS structure but the problem here is, I do not know how to access to the UniqueProcessId field in EPROCESS structure. Now, I've got the pointer to EPROCESS structure by this function PEPROCESS Process;...

Enumerating process id in kernel mode with EPROCESS structure

1 Aug 2017 by Jochen Arndt

How is PEPROCESS defined? If you have the full structure just access the member: PVOID UniqueProcessId = Process->UniqueProcessId; If you know the offset and the type, cast Process to a byte or char pointer, add the offset, cast the result as pointer to the field type, and get the value:...

C++ function for "kernel memory check" before accessing

4 Aug 2017 by Randor

Hi, Your question is unclear. You need to specify who allocated the buffer... usermode or kernelmode? Also you need to clarify which ring is reading the buffer... usermode or kernelmode. I think you may be looking for the MmIsAddressValid function[^]. If the buffer you are passing to...

BITMAPINFOHEADER : fill data using copymemory

19 Sep 2017 by Member 13373000

I am using a COM Interface where I am receiving byte data representing a DIP (Device Independent Bitmap). I want take this byte[] and copy its data into a BITMAPINFOHEADER variable. I have a long piece of code and this is only part of it, however it is written in VBA and it works: Private...

Using beaglebone black as a keyboard device.

28 Sep 2017 by Ivan Ivanov 83

Hi All I'm currently working on a touchscreen keyboard project where the BBB displays images on a screen, receives the touch events form the touch panel and has to send them to the main PC as key events. So the BBB has to present it self as a HID (keyboard) device to the PC. What I have to do...

Is there any way for ioctl() in linux to specify submission queue ID for a nvme IO request

21 Dec 2017 by Member 13589269

I am working on a testing tool for nvme-cli(written in c and can run on linux). For SSD validation purpose, we are actually looking for sending I/O commands to a particular Submission queue(IO Queue pair). We needed this because we wanted threading, but for threading to happen we need to send...

How to access to data if BIO has been cloned ?

4 Jan 2018 by Ruslan R. Laishev

Hello ! I writting the Linux Device Driver is supposed to work on top of existen device drivers, so I try to use bi_end_io() complition I/O routine to access a data buffers has been read from disk device, see piece of code follows: static void dua_bio_end_io ( struct bio * iob ) {...

How to access to data if BIO has been cloned ?

4 Jan 2018 by Ruslan R. Laishev

static void __iob_enc_dec ( struct bio * iob, sector_t lbn ) { struct bio_vec *bvl; sector_t nlbn; int i; $TRACE("Start %scrypting ...", bio_data_dir(iob) == WRITE ? "En" : "De"); #if 0 { for (i = 0, bvl = iob->bi_io_vec; i bi_vcnt; i++, bvl++) { $SHOW_PTR(bvl->bv_page);...

Enumerating kernel mode drivers

17 Apr 2018 by Kyudos

Can someone point me at the APIs I'd have to use to list the loaded Kernel mode drivers (*.sys files)? The way that Process Explorer does for the System process. What I have tried: Googling without success. I found this Windows kernel | Microsoft Docs[^] but there are thousand of functions...

How to programmatically code sign a file when cross signing is required

6 Sep 2018 by KarstenK

It is not clear where you stuck, but I found some good looking example code for SignerSignEx which also demonstrates the workflow. Maybe you should start with that code, for proofing your data. PS: We are using some command line tool for signing.