Click here to Skip to main content
15,892,927 members
Everything / Kernel

Kernel

kernel

Great Reads

by Maxim Kartavenkov
This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.
by Alexander Eremeev
The Windows kernel-hacking library and development framework written on C++17
by Apriorit Inc, gamapat
Take a look at how to intercept HTTP traffic in order to inject custom code into Windows HTML markup
by Roger Doss
The OX kernel features its own custom boot loader designed to boot a 32 bit protected mode kernel.

Latest Articles

by Maxim Kartavenkov
This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.
by Rahul Dev Tripathi
The fully working sample code explains everything necessary to create a Minifilter driver to block devices connected through an interface.
by Greg Utas
Analogous functions, subtle differences, multiple compilers...
by Apriorit Inc, Sergii Kusii
And its modules during runtime

All Articles

Sort by Updated

Kernel 

13 Oct 2023 by Maxim Kartavenkov
This is a guide on how to configure your application, service or driver to handle appearing the new devices or device removal avoiding reboot request.
8 Sep 2023 by Moharram
I have a signal processing algorithm that uses FFT... The algorithm is implemented in a module or the same class and has the ability to be parallelized so that up to n Instances can be made from it and run in parallel... So far, the...
24 Jun 2023 by Littery
I'm running Ubuntu 22.04.2 LTS and have dual boot windows 11. I'm trying to hide grub menu while booting and automatically boot ubuntu as I have seen that can be done with changing GRUB_TIMEOUT to 0 in /etc/default/grub and run sudo update-grub...
12 Mar 2023 by Ṉobody
I am creating a kernel mode driver that monitors process creation and sends information about it to the C# application. The information that should be passed is ProcessID and ProcessPath. At this point, the driver only sends ProcessID to the C#...
29 Nov 2022 by seham moawed
__device__ void levenshteinDistance(char *str,int strStart,int strLength,char *patternRemoved,int patternRemovedStart,int patternRemovedLength,int *dXIndividual,int *dXFinal) { int indexA = blockIdx.x * blockDim.x + threadIdx.x; int...
8 Nov 2022 by Member 14769677
I am writing a kernel, the base is working fine, but when i went to add I/O ports, with this header: #ifndef __PORT_H #define __PORT_H class Port { protected: //protected: Port(uint16_t _portNum); ~Port(); uint16_t portNum; }; ...
8 Nov 2022 by Rick York
I got this code to compile with just a few tweaks. I used Visual Studio 2022. Here are the modules : #pragma once #define PORT_H class Port { protected: Port( uint16_t portNum ); ~Port(); uint16_t m_PortNum; }; class Port8Bit :...
8 Nov 2022 by k5054
Quote: I am using gcc as a compiler I hope that means you're using g++, and not gcc. You've not shown your main() class, but the given code compiles cleanly to a .o file g++ -Wall -Wextra -c -o port.o port.cpp so the problem must be when...
19 Sep 2022 by Member 15635207
Hello Folks, It is possible to hook 32 and 64 bit Windows API's from kernel mode? Any references will be helpful. If there any such kernel drivers , commercial or non-commercial, please do share - viks What I have tried: Tried google, and...
19 Sep 2022 by Dave Kreskowiak
It sounds like what you're looking for is "Detours"[^]
11 Sep 2022 by Rahul Dev Tripathi
The fully working sample code explains everything necessary to create a Minifilter driver to block devices connected through an interface.
19 Jul 2022 by Dale Seeley
Hello: I am trying to set up an event to notify my user mode application from my mini filter driver whenever a callback is used. Currently I have successfully set up a shared event that both can connect to like so: VB.NET ...
7 Jul 2022 by Greg Utas
Analogous functions, subtle differences, multiple compilers...
30 May 2022 by Dale Seeley
I have a driver written in pure C and a application in .NET framework which is capable of sending and receiving IOCTL commands. Currently the driver is able to send Process Creation, Image Load Notify and Thread Notify callbacks to the .NET...
10 May 2022 by Randor
Hello, You could block the process creation by setting the CreationStatus member in the PS_CREATE_NOTIFY_INFO structure[^] to access denied in your callback. I want to tell you that everything you are describing goes against Best Practices[^]....
11 Oct 2021 by alsecc
Hi, I'm developing a kernel driver for Windows and recently MS deprecated the procedure to sign drivers, see...
27 May 2021 by MrProgrammer12
Hello, for my project i need to know how to read files from an iso optical disk image. i already browsed the web but there are not many sources available. ive read the folowing articles: ISO 9660 - OSDev Wiki[^]...
27 May 2021 by Richard MacCutchan
There is not space or time here to answer such a question. You need to get hold of the technical specification for ISO files and study it in details. Wikipedia has many references, see ISO 9660 - Wikipedia[^].
27 May 2021 by OriginalGriff
The easier way is to mount the ISO files as a virtual disk and read it as a normal volumen from there: How to mount an ISO image in Windows 10 - eMexo Technologies[^] You can run powershell from the system function: c++ - How to call a...
27 May 2021 by MrProgrammer12
hey im not realy sure how to make a linux distro but on linux kernel source tree in github is some documentation for developers. maybe there is specified how to start devving :) may the source be with you GitHub - torvalds/linux: Linux kernel...
24 Nov 2020 by Cabronista
Hello everybody, I would like to program a driver that creates a fbdev device but internally use the drm driver (something like a fbdev to drm bridge). The target is to use mplayer -vo fbdev, but present custom fbdev that use the drm functions,...
16 Aug 2020 by User 11060979
Preface Of course in c++ there are much more elegant solutions possible. This in case you implement a class Matrix (and Vector). But that was not your question. Implementation trial according to your question Here an implementation completely...
16 Aug 2020 by Member 14915155
I need help, i can't imagine a C++ code for this. I have to resolve the matrix mult. A*B=C and A is a 256x128 elements and B is a 128x256 elements, so C is a 256x256 elements. But to solve this i need to create "sections" of A and B matrix (for...
15 Aug 2020 by Richard MacCutchan
You can create matrix objects on memory just by using 2 dimensional arrays. So for your example you would code: #define A_ROWS 256 #define A_COLS 128 #define B_ROWS A_COLS #define B_COLS A_ROWS int A[A_ROWS][A_COLS]; int...
30 Oct 2019 by Stefan_Lang
Richard is totally right. We can't know what these statements mean without context. However, I would offer some input. I may be totally wrong, but if I am, take that as an indication that you are not providing sufficient information to answer these questions: 1. Since you're specifically...
30 Oct 2019 by Alireza Sadeghpour
i was reading a page that told: "My microbenchmark begins by allocating one memory page, then creates two virtual address aliases pointing to it" First Question. i want to know how can i create two virtual address that pointing to same memory page in linux with c? again on that page he told...
29 Oct 2019 by Richard MacCutchan
You should ask the person who wrote those statements. We have no idea what the context of those claims may be.
21 Mar 2019 by Member 14130865
void sendrequests() { auto Readstring = (char*)MapViewOfFile(hMapFileW, FILE_MAP_WRITE, 0, 0, 4096); RtlCopyMemory(Readstring, "Read", 4); printf("message has been sent to kernel [Read]! \n"); UnmapViewOfFile(Readstring) } ; so basically if i do something like this it works fine but if i...
17 Mar 2019 by Member 14130865
kernel mode : VOID DriverLoop() { while (TRUE) { //DbgPrintEx(0, 0, "First loop is running \n"); ReadSharedMemory(); if (!(PCHAR)SharedSection == NULL && strcmp((PCHAR)SharedSection, "Read") == 0) { DbgPrintEx(0, 0, "Read looping \n"); ...
17 Mar 2019 by Rick York
What you are doing wrong is hoping that two processes in different execution rings can coordinate themselves by pure luck. As I have written to you before, you need to use a signalling mechanism. This can be a simple counter that the processes watch for a change or it could be an event (or...
10 Mar 2019 by Member 14177389
what i am doing in my user mode app : typedef struct KM_READ_REQUEST { ULONG ProcessId; UINT_PTR Address; UINT_PTR Size; void* Output; } KM_READ_REQUEST, *PKM_READ_REQUEST; template type RPM(UINT_PTR ReadAddress) { if (hDriver == INVALID_HANDLE_VALUE) { return...
10 Mar 2019 by Rick York
If you never close those handles you will eventually run out of them. I made a little class that does the mapping and then unmaps and closes the handle on destruction so it is automatic. I recommend you do the same. You can use RPM as the constructor. To help synchronize things, I would add...
10 Mar 2019 by Richard MacCutchan
Are you the same person as Member 14130865 - Professional Profile[^], who posted a very similar question? If so please delete your duplicate account and use the original one.
8 Mar 2019 by Member 14130865
hMapFile = OpenFileMappingA(FILE_MAP_WRITE, FALSE, "Global\\SharedMemoryTest"); if (!hMapFile || hMapFile == INVALID_HANDLE_VALUE) { printf("OpenFileMappingA(write) fail! Error: %u\n", GetLastError()); return 0; } pBuf = (char*)MapViewOfFile(hMapFile, FILE_MAP_WRITE, 0, 0, 4096); if...
7 Mar 2019 by Member 14130865
so straight to the point i have created a kernel driver that maps shared section to user mode. my problem is am trying to read/write memory with the driver but i have 0 experience with ReadFile , WriteFile . i have a handle that was created with CreateFileA. now i my old project driver i used...
7 Mar 2019 by KarstenK
The question is a bit unclear. Should work with memcpy to copy data. Be clear about whom the memory belongs and that the access rights are respected. It is best, when user and kernel use OWN memory and are copying the bytes into their spaces. Else you may get strange and undebuggable errors. ...
1 Mar 2019 by Apriorit Inc, Sergii Kusii
26 Feb 2019 by OriginalGriff
Nope. "Educational" or not, you have no idea what you are doing, and that means you are potentially doing something malicious, or that could become malicious if you aren't very careful. And since you have no idea what you are doing, you won't be careful enough. We do not condone, support, or...
30 Jan 2019 by Member 14130865
typedef struct _OBJECT_DIRECTORY_ENTRY { _OBJECT_DIRECTORY_ENTRY* ChainLink; } OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY; this is the c++ struct its working fine in c++ btw am going with kernel here.and am trying to make this struct works with my C kernel driver struct its the same but i...
30 Jan 2019 by CPallini
It should be typedef struct _OBJECT_DIRECTORY_ENTRY { struct _OBJECT_DIRECTORY_ENTRY* ChainLink; } OBJECT_DIRECTORY_ENTRY;
27 Jan 2019 by Member 14130865
for (auto entry : directory_object->HashBuckets) { if (entry == NULL) continue; if (success == true) break; i tried a lot of foreach loops non of them has worked. am re - writing my kernel driver from c++ to C What I have tried: #define for_each_item(item, list) \ for(T * item...
27 Jan 2019 by CPallini
It depends on very nature of the HashBuckets variable. What is it, exactly? You didn't provide any insight about. I suggest you to NOT obfuscate C code behind macros. Wtite clean C code instead of trying to mimic the C++ counterpart.
27 Jan 2019 by steveb
Simpler way struct Orginal org = {0};
27 Jan 2019 by Member 14130865
by the way am developing my kernel driver i know c++ but am new to C syntax thanks for helping in advance What I have tried: first i had my struct in my .c file but i want to initialize my vars in global space instead of giving my vars to local. so i have tried to do it this way in my...
26 Jan 2019 by OriginalGriff
now org is (incomplete type is not allowed) C - just like C++ - is case sensitive, so original is not the same as Original. Try: struct Orginal { PDRIVER_OBJECT driver_object; // NULL PDRIVER_UNLOAD unload; // NULL PDRIVER_DISPATCH major_functions[IRP_MJ_MAXIMUM_FUNCTION + 1]; //{ NULL };...
26 Jan 2019 by Rick York
Your attempt had a seperate instruction so it was not the right syntax for initialization. Try this :struct orginal org = { NULL, NULL, NULL, NULL, false, 0 };
22 Jan 2019 by Apriorit Inc, Sergey Stepanchuk
Learn how you can use ftrace to hook critical function calls in the Linux kernel
17 Jan 2019 by Apriorit Inc
In this article, we focus on the main ftrace pros and cons and describe some unexpected surprises we’ve faced when hooking Linux kernel functions with this utility.
9 Jan 2019 by Apriorit Inc
Two theoretical ways to protect a Linux kernel module from hooks.
5 Dec 2018 by KarstenK
You are misusing the API. Read the example code from Microsoft and the documentation. I cant find details about your struct on the fly, so search and read it carefully. My best guess is that Address is the pointer to the data (your string) and Value is some type information and the Output is...
5 Dec 2018 by Member 14078997
I have been attempting to write strings in Kernel Memory for some time now. I have been able to read strings, however I have no luck with writing them. I can write regular things such as a DWORD. I keep getting stuck on casting a string to a UINT_PTR. Any help is appreciated and here is my code...
5 Dec 2018 by Dave Kreskowiak
CAST a string? You can't. To be a valid pointer that would be one nasty looking string. You have to PARSE the string into a value. But then, one has to wonder why you're passing handle values around in/to/from the kernel as strings instead of the actual values.
7 Nov 2018 by Apriorit Inc, gamapat
Take a look at how to intercept HTTP traffic in order to inject custom code into Windows HTML markup
1 Nov 2018 by Alexander Eremeev
The Windows kernel-hacking library and development framework written on C++17
1 Oct 2018 by Member 14002991
I don't know if you still need this, but I found the solution to your problem. I'm just starting a project where I need to do the same. The BBB sets up the USB clients in /opt/scripts/boot/am335x_evm.sh And it seems that after this, you can no longer disable the UDC in order to install your...
24 Sep 2018 by Member 13980942
so my driver can read integers, DWORD64 etc but now i want to read strings i tried a lot of things and am sure this one should work but for some reason it displays some random chars this is how am reading from kernel PCHAR ReadMem_String(MEMDATA *data) { NTSTATUS ntStatus; PEPROCESS...
23 Sep 2018 by «_Superman_»
Could be a string format issue between UNICODE and ANSI. Try using wchar_t instead of char and std::wstring instead of std::string.
23 Sep 2018 by Richard MacCutchan
if (MmIsAddressValid((void*)(*data).address)) Same problem as yesterday. Do not dereference the data variable in this way.
23 Sep 2018 by Richard MacCutchan
This line does not look correct: RtlCopyMemory(&readBuff, (const void*)(*data).address, sizeof(readBuff)); The variable data is defined as a pointer to a MEMDATA structure, so the dereference operator should not be necessary here. Try it as: RtlCopyMemory(&readBuff, (const...
23 Sep 2018 by Member 13980942
so i cant read an integer from my usermode idk why i will share the code cuz i found it and its public hope that someone could help me with this :D in kernel space typedef struct { DWORD64 proccessId; DWORD64 address; DWORD64 Read; } MEMDATA; UINT64 ReadMem(MEMDATA *data) { NTSTATUS...
12 Sep 2018 by Member 13980942
so the problem is as the title says how could i use shmem instead of IoCreateDevice / IoCreateDriver done shmem before and i googled and i did not find anything useful they are all complicated and i cant understand them so if anyone could explain me how to use it to communicate with my...
6 Sep 2018 by Michael Haephrati
I came across the need to use SignerSignEx2() during to the process of submitting Kernel drivers for Microsoft’s approval. SignerSignEx2()[^] is used to programmatically sign these drivers. Microsoft requires the use of an EV (Extended Validation) Code Signing Certificate[^] for Kernel Drivers...
6 Sep 2018 by KarstenK
It is not clear where you stuck, but I found some good looking example code for SignerSignEx which also demonstrates the workflow. Maybe you should start with that code, for proofing your data. PS: We are using some command line tool for signing.
17 Apr 2018 by Kyudos
Can someone point me at the APIs I'd have to use to list the loaded Kernel mode drivers (*.sys files)? The way that Process Explorer does for the System process. What I have tried: Googling without success. I found this Windows kernel | Microsoft Docs[^] but there are thousand of functions...
13 Jan 2018 by Pritam Zope
In this article we will create a simple kernel such as printing HelloWorld first and then writing functions for printing numbers, Keyboard I/O, Box Drawing GUI, and Tic-Tac-Toe game in kernel in C
4 Jan 2018 by Ruslan R. Laishev
static void __iob_enc_dec ( struct bio * iob, sector_t lbn ) { struct bio_vec *bvl; sector_t nlbn; int i; $TRACE("Start %scrypting ...", bio_data_dir(iob) == WRITE ? "En" : "De"); #if 0 { for (i = 0, bvl = iob->bi_io_vec; i bi_vcnt; i++, bvl++) { $SHOW_PTR(bvl->bv_page);...
4 Jan 2018 by Ruslan R. Laishev
Hello ! I writting the Linux Device Driver is supposed to work on top of existen device drivers, so I try to use bi_end_io() complition I/O routine to access a data buffers has been read from disk device, see piece of code follows: static void dua_bio_end_io ( struct bio * iob ) {...
21 Dec 2017 by Member 13589269
I am working on a testing tool for nvme-cli(written in c and can run on linux). For SSD validation purpose, we are actually looking for sending I/O commands to a particular Submission queue(IO Queue pair). We needed this because we wanted threading, but for threading to happen we need to send...
28 Sep 2017 by Ivan Ivanov 83
Hi All I'm currently working on a touchscreen keyboard project where the BBB displays images on a screen, receives the touch events form the touch panel and has to send them to the main PC as key events. So the BBB has to present it self as a HID (keyboard) device to the PC. What I have to do...
28 Sep 2017 by Jochen Arndt
I have not done such so far. So this might not help. As far as I understand, /sys/class/udc/ is created / filled by the preceding script commands (does not exist before or is empty). So I would wait some time (sleep) before accessing that directory (not busy anymore). You can also do the last...
19 Sep 2017 by Member 13373000
I am using a COM Interface where I am receiving byte data representing a DIP (Device Independent Bitmap). I want take this byte[] and copy its data into a BITMAPINFOHEADER variable. I have a long piece of code and this is only part of it, however it is written in VBA and it works: Private...
22 Aug 2017 by Jochen Arndt
You are copying to bimPtr (allocated memory) but print out bim.biSize (bim is allocated but never changed). Instead of trying to convert VBA code that calls an API function to copy memory (which calls the standard C library function memcpy in the background), you should understand what the code...
4 Aug 2017 by Randor
Hi, Your question is unclear. You need to specify who allocated the buffer... usermode or kernelmode? Also you need to clarify which ring is reading the buffer... usermode or kernelmode. I think you may be looking for the MmIsAddressValid function[^]. If the buffer you are passing to...
4 Aug 2017 by MinYoung Lee
I am developing a simple device driver for study. With a lot of testing, I am creating so many errors which finally leads my computer to blue screen. I am sure that the reason for this is memory crash. So now I want to check if my code can access to Kernel memory before going further. My...
1 Aug 2017 by Jochen Arndt
How is PEPROCESS defined? If you have the full structure just access the member: PVOID UniqueProcessId = Process->UniqueProcessId; If you know the offset and the type, cast Process to a byte or char pointer, add the offset, cast the result as pointer to the field type, and get the value:...
1 Aug 2017 by MinYoung Lee
I want to enumerate all of the process id running on my system by using EPROCESS structure but the problem here is, I do not know how to access to the UniqueProcessId field in EPROCESS structure. Now, I've got the pointer to EPROCESS structure by this function PEPROCESS Process;...
7 May 2017 by MinYoung Lee
I want to use NtQueryInformationPort function below in DriverEntry function to know all of the listening ports number. However, I don't know how to get PortHandle which is the first parameter in NtQueryInformationPort. Is there someway to get PortHandle? /*++ Copyright (c) Microsoft...
7 May 2017 by Jochen Arndt
Quote: to know all of the listening ports If you don't know the ports you can't use a function that queries information for a specific port number defined by a handle. Even if you would have a handle calling that undocumented function would give you no useful information because no information...
18 Jan 2017 by Sergey Podobry
How-to guide about using KmTest for writing kernel-mode unit tests
2 Jan 2017 by ysrikanth_mca
Hi,we have used a open source NDIS IM filter driver( ipfw+dummynet) which is working fine in windows 7 but but not loading in Windows 10 Desktop.Ipfw web site : http://info.iet.unipi.it/~luigi/dummynet/Source Code : https://github.com/luigirizzo/dummynetLooks like NDIS 5.1 code...
15 Jul 2016 by User 6976447
In this research paper, Multidirectional Scratch Detection and Restoration in Digitized Old Images | SpringerLink[^]in the Section 4.1(Preprocessing), an equation of a Bandpass filter is...
10 Apr 2016 by columbos14927
Hello,I have a PC with Ubuntu 14.04.I'm writing some device drivers for Linux Kernel 2.6.x, i would like to test the modules using the insmod and rmmod utilities on my PC.Is there some way to do it although the runing kernel on my PC is not 2.6.x?Thanks.
10 Apr 2016 by Albert Holguin
In order for you to test against a specific kernel version, you need to have that kernel version installed and running. You can do this within a virtual machine. Here are a few options from Ubuntu.[^]
4 Apr 2016 by Wshwilfried
Hello, Sorry for the basic question. I need to create a file for write access in kernel mode and and allow other thread to read it, this can happen simultaneously. so This what I do when creating the file. status =...
4 Apr 2016 by bling
It looks like you are mixing access flags with other types of flags. Also, you omit FILE_SHARE_WRITE in the second ZwCreateFile.Try this:ntstatus =...
2 Mar 2016 by Patrice T
C/C++ source code are notoriously difficult to understand for non specialist.Only experience and practice can help you to understand some C code such as Linux kernel where every trick is used to gain speed.I suggest not reading Linux source code as there is little chances that you can reuse...
2 Mar 2016 by stackprogramer
hi, my friend ,i am familiar 3 or 4 year with java and c++.now i want to start reading source famous project ,i start to read kernel linuxbut it is very maddening,it is so difficult.my question for i can be able reading source c++ or java popular project after 1 years.whats best work can...
2 Mar 2016 by CPallini
If you inntend to master C++ and Java then don't read Linux kernel sources. You know, Linux kernel is written using just bare C (as far as I know, even the standard C library is not allowed in kernel code). Moreover the Linux kernel code has to be very efficient, not elegant. Finally you have to...
2 Mar 2016 by Richard MacCutchan
This is not something you can learn from a book, you learn it by doing. If you do not have enough experience in either C++ or Java, then you just need to study more tutorials and samples that Google will find for you.
28 Feb 2016 by Wshwilfried
Hello, I have a file that I use to save data when the system is running and I wish to save data to it but before saving, I want to erase its old content so at the end I can only have the latest content in the file. For some reason I would like to achieve that without close the file handle.I...
28 Feb 2016 by Richard MacCutchan
You can use the FILE_OVERWRITE option on your call to ZwCreateFile routine (Windows Drivers)[^].
24 Dec 2015 by Dave Kreskowiak
OK, so when do you start writing it? If you came here looking for someone to just hand over completed code to you you've come to the wrong site.
21 Dec 2015 by rafidkarim
hi,I am trying to developing my own linux distribution. I want the system base on Debian, and some people suggested me to use LFS, and i don't know what LFS exactly is that an independence Linux distro? I want to make a custom Linux, and when my own Linux distro will finish, how could I make...
17 Dec 2015 by Tim ONeil
Using the autoconf tool chain to add modules to the Linux kernel
10 Dec 2015 by rafidkarim
hi,I just installed a wayland and gnome in Debian 8 system, and I can access trough the desktop environment using gnome-session --session=gnome-waylandI want when I start the Debian it would directly go trough the Gnome automatically. Like the command run automatically.
18 Nov 2015 by Dave Kreskowiak
This little project is nowhere near as easy as you think it is.First, you're going to be limited to ASM code. You're not going to have ANY libraries at all, so you have to write everything from scratch, including any encryption algorithms and key storage and management. If you think you need...
18 Nov 2015 by Member 12147362
i found this: Bios Interrupt Service Routine (ISR). any of you guys know something about it and if it might work this way?
17 Nov 2015 by Member 12147362
Hy guysI have a little project i need help with. i want to add an authentication to my pc that will run before the boot options and before i can choose to enter bios(authentication means either password or certain key presses). now i have done some research and someone recomended me to study...
17 Nov 2015 by Sergey Alexandrovich Kryukov
You could start here: http://x86asm.net/articles/uefi-programming-first-steps[^], but I have no idea why would you ever need it — please see my comment to the question. —SA
16 Sep 2015 by Ed Nutting
In this article I discuss the innovative approach, taken by FlingOS, to teaching OS and low-level development to high-level developers using C#.