Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

›
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Bcrypt in the kernel

Don_Burn_1Don_Burn_1 Member Posts: 4,311
in NTDEV
Microsoft states that there CNG package works in the kernel
http://msdn.microsoft.com/en-us/library/bb204775(VS.85).aspx and they
have definitions in bcrypt.h that are for kernel mode functions. What
is missing is the documentation that is claimed to be there for things
like IRQL the functions can be called at or anything else related to
using it in the kernel.

So my question is can the Bcrypt api's be used in the kernel? Does
Microsoft really support them (I normally take the approach if it is not
in the WDK documentation it is in the grey area of support)? And can
anyone point me to some documentation / examples of how to use them in
the kernel.


Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Share on Facebook

Comments

  • Martin_GhazaryanMartin_Ghazaryan Member Posts: 25
    You may want to get CNG SDK with samples, containing kernel mode usage examples along with other stuff:

    http://www.microsoft.com/downloads/details.aspx?familyid=1ef399e9-b018-49db-a98b-0ced7cb8ff6f&displaylang=en

    Briefly, CNG is officially supported started from Vista (in both, user and kernel mode). In kernel mode it's implemented as an export driver (ksecdd.sys, with ksecdd.lib import library). IRQL and other info can be found in documentation for each function separately:

    http://msdn.microsoft.com/en-us/library/aa833130(VS.85).aspx
    Share on Facebook
  • Don_Burn_1Don_Burn_1 Member Posts: 4,311
    Yes I've had that for days. The one kernel sample is pretty poor and
    nowhere does it document what IRQL's you can call functions at, even
    though if you search enough on microsoft.com it implies some functions
    can be called at DISPATCH_LEVEL just not which functions they are.


    Don Burn (MVP, Windows DKD)
    Windows Filesystem and Driver Consulting
    Website: http://www.windrvr.com
    Blog: http://msmvps.com/blogs/WinDrvr




    > -----Original Message-----
    > From: xxxxx@yandex.ru [mailto:xxxxx@yandex.ru]
    > Posted At: Wednesday, June 02, 2010 1:42 PM
    > Posted To: ntdev
    > Conversation: Bcrypt in the kernel
    > Subject: RE: Bcrypt in the kernel
    >
    > You may want to get CNG SDK with samples, containing kernel mode usage
    > examples along with other stuff:
    >
    >
    http://www.microsoft.com/downloads/details.aspx?familyid=1ef399e9-b018-4
    9db-
    > a98b-0ced7cb8ff6f&displaylang=en
    >
    > Briefly, CNG is officially supported started from Vista (in both, user
    and
    > kernel mode). In kernel mode it's implemented as an export driver
    (ksecdd.sys,
    > with ksecdd.lib import library). IRQL and other info can be found in
    > documentation for each function separately:
    >
    > http://msdn.microsoft.com/en-us/library/aa833130(VS.85).aspx
    >
    >
    >
    >
    > __________ Information from ESET Smart Security, version of virus
    signature
    > database 5167 (20100602) __________
    >
    > The message was checked by ESET Smart Security.
    >
    > http://www.eset.com
    >
    Share on Facebook
  • Martin_GhazaryanMartin_Ghazaryan Member Posts: 25
    Well, the rule is pretty much generic I think -- if you pass stuff in nonpaged memory, you can call it at DISPATCH_LEVEL, otherwise -- PASSIVE_LEVEL. Here's a snip from description of BCryptEncrypt:

    "Depending on what processor modes a provider supports, BCryptEncrypt can be called either from user mode or kernel mode. Kernel mode callers can execute either at PASSIVE_LEVEL IRQL or DISPATCH_LEVEL IRQL. If the current IRQL level is DISPATCH_LEVEL, the handle provided in the hKey parameter must be derived from an algorithm handle returned by a provider that was opened with the BCRYPT_PROV_DISPATCH flag, and any pointers passed to the BCryptEncrypt function must refer to nonpaged (or locked) memory."
    Share on Facebook
  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,376
    Not to be an annoying douche-bag, but I *do* see IRQL-related comments in the docs... at least for BCryptEncrypt:

    http://msdn.microsoft.com/en-us/library/aa375421(VS.85).aspx

    ..........
    Depending on what processor modes a provider supports, BCryptEncrypt can be called either from user mode or kernel mode. Kernel mode callers can execute either at PASSIVE_LEVEL IRQL or DISPATCH_LEVEL IRQL. If the current IRQL level is DISPATCH_LEVEL, the handle provided in the hKey parameter must be derived from an algorithm handle returned by a provider that was opened with the BCRYPT_PROV_DISPATCH flag, and any pointers passed to the BCryptEncrypt function must refer to nonpaged (or locked) memory.

    To call this function in kernel mode, use Ksecdd.lib, which is part of the Driver Development Kit (DDK).
    ..........

    Peter Viscarola
    OSR
    @OSRDrivers

    Share on Facebook
  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,376
    Ah, sorry... I see Mr. Ghazaryan has already pointed to this same passage.

    I'll go back to sleep now,

    Peter
    OSR

    Peter Viscarola
    OSR
    @OSRDrivers

    Share on Facebook
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA

Categories