Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 16-20 October 2023 | Live, Online |
Developing Minifilters | 13-17 November 2023 | Live, Online |
Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
Maybe this will help: https://www.cybereason.com/blog/code-integrity-in-the-kernel-a-look-into-cidll
You could cheat and look up your device stack to see what is on top of you. But that is all wrong and you shouldn't do that.
This is not a production driver, so verifiable non-production ideas are ok.
I'd have to go look, but I think it wraps the driver? Any way, in either direction you can take a look, although, perversely, verifier might complain.
MmIsDriverVerifyingByAddress Could work
Bent from my phone.
________________________________
From: Mark_Roddy
Sent: Friday, June 16, 2023 1:54:48 PM
To: Doron_Holan
Subject: Re: [NTDEV] Api to tell if a driver is verified?
OSR https://na01.safelinks.protection.outlook.com/?url=https://community.osr.com/&data=05|01||0f2e14298f1a417c5c9808db6eabed16|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638225456928923464|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|3000|||&sdata=ZyKuNNAzSLyUXwzGWCEDEf2Cx6Z214wVJSkOpi/fMa4=&reserved=0
Mark_Roddy commented on Api to tell if a driver is verified?
> Wouldn't verifier be below and not above the driver?
I'd have to go look, but I think it wraps the driver? Any way, in either direction you can take a look, although, perversely, verifier might complain.
Many thanks!
________________________________
From: Dejan_Maksimovic
Sent: Saturday, June 17, 2023 2:34:17 AM
To: Doron_Holan
Subject: Re: [NTDEV] Api to tell if a driver is verified?
OSR https://na01.safelinks.protection.outlook.com/?url=https://community.osr.com/&data=05|01||5b03484e5eb547ce074a08db6f160674|84df9e7fe9f640afb435aaaaaaaaaaaa|1|0|638225912608260718|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|3000|||&sdata=VHWTB00IfprZS9UC2wToC1Zd4D+rncaUYfK5Ra1ULo0=&reserved=0
Dejan_Maksimovic commented on Api to tell if a driver is verified?
I knewI saw some API, but didn't remember Mm was the prefix!
Many thanks!