struct to lpDrvObject->DriverStart_

NTDEV
1

Hello all, Im noob in kernel mode programming , so I would like to know what is the structure pointed by the DriverStart field of DRIVER_OBJECT struct

typedef struct _DRIVER_OBJECT
{
SHORT Type;
SHORT Size;
PDEVICE_OBJECT DeviceObject;
ULONG Flags;
PVOID DriverStart; <<<<<<<<<<<<<<<<<
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
UNICODE_STRING DriverName;
PUNICODE_STRING HardwareDatabase;
PFAST_IO_DISPATCH FastIoDispatch;
LONG * DriverInit;
PVOID DriverStartIo;
PVOID DriverUnload;
LONG * MajorFunction[28];
} DRIVER_OBJECT, *PDRIVER_OBJECT;

I understand its a pointer to a struct but whats the structure…
thanks in advance

2

Why?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, September 06, 2012 12:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] struct to lpDrvObject->DriverStart_

Hello all, Im noob in kernel mode programming , so I would like to know what is the structure pointed by the DriverStart field of DRIVER_OBJECT struct

typedef struct _DRIVER_OBJECT
{
SHORT Type;
SHORT Size;
PDEVICE_OBJECT DeviceObject;
ULONG Flags;
PVOID DriverStart; <<<<<<<<<<<<<<<<<
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
UNICODE_STRING DriverName;
PUNICODE_STRING HardwareDatabase;
PFAST_IO_DISPATCH FastIoDispatch;
LONG * DriverInit;
PVOID DriverStartIo;
PVOID DriverUnload;
LONG * MajorFunction[28];
} DRIVER_OBJECT, *PDRIVER_OBJECT;

I understand its a pointer to a struct but whats the structure…
thanks in advance

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

how?.. I do not understand… but as I said, Im noob and I was reading about DriverEntry:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544113(v=vs.85).aspx

then DRIVER_OBJECT:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174(v=vs.85).aspx

and then looked all fields in DRIVER_OBJECT struct and find information about them…

4

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 9/6/2012 12:39 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] struct to lpDrvObject->DriverStart_

how?.. I do not understand… but as I said, Im noob and I was reading about DriverEntry:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544113(v=vs.85).aspx

then DRIVER_OBJECT:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174(v=vs.85).aspx

and then looked all fields in DRIVER_OBJECT struct and find information about them…

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

As the doc says,

Undocumented members within a driver object should be considered inaccessible. Drivers with dependencies on object member locations or on access to undocumented members might not remain portable and interoperable with other drivers over time.

This field is not documented. As a noob, I would think you would want to first learn the documented stuff, not undocumented things that have no relevance to writing a driver

d

debt from my phone

From: xxxxx@hotmail.com
Sent: 9/6/2012 12:39 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] struct to lpDrvObject->DriverStart_

how?.. I do not understand… but as I said, Im noob and I was reading about DriverEntry:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544113(v=vs.85).aspx

then DRIVER_OBJECT:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174(v=vs.85).aspx

and then looked all fields in DRIVER_OBJECT struct and find information about them…

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

well, I found the answer to my question, and I write the reply for newbies like me.
DriverStart = imageBase
it was too much to ask? thanks anyway

7

Due to a long and ignoble history, many kernel structures are referred to
as “partially opaque”, that is, there are fields you are allowed to use,
and fields which only the I/O system is allowed to use. In C++, these
would have been public and protected/private, but in C, the way this is
done is by not documenting the fields you are not supposed to use. So if
you search for “DriverStart” in the docs and don’t find it, then it
doesn’t matter to you in the slightest what its purpose is. If it is
documented, the docs will tell you.

It’s a crappy way to have public/protected, even in C, but think of it as
a structure that had things thrown at it over its history, without any
thought as to what should really be documented and what is properly
hidden. The scary thing is when you find a union, and some of the
components of the union are user-visible, and some, which overlay those
components, are not.
joe

Hello all, Im noob in kernel mode programming , so I would like to know
what is the structure pointed by the DriverStart field of DRIVER_OBJECT
struct

typedef struct _DRIVER_OBJECT
{
SHORT Type;
SHORT Size;
PDEVICE_OBJECT DeviceObject;
ULONG Flags;
PVOID DriverStart; <<<<<<<<<<<<<<<<<
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
UNICODE_STRING DriverName;
PUNICODE_STRING HardwareDatabase;
PFAST_IO_DISPATCH FastIoDispatch;
LONG * DriverInit;
PVOID DriverStartIo;
PVOID DriverUnload;
LONG * MajorFunction[28];
} DRIVER_OBJECT, *PDRIVER_OBJECT;

I understand its a pointer to a struct but whats the structure…
thanks in advance

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

You are not meant to understand this.

(That is a famous comment from the context-swap code in the Unix kernel)

Yes, it was too much to ask. If it isn’t documented, it’s none of your
business what it is, who sets it, and who uses it. It is owned by the
kernel I/O system, and depending on it in any way is usually a recipe for
total disaster.

Imagine a C++ user demanding that the implementor of an class document all
the protected fields, which are inaccessible to the client of the class.

A huge number of the kernel structures have this property, so if you can’t
find an official Microsoft document telling you that you can use it, you
can’t use it. That means you cannot read it and use it to make decisions,
you certainly cannot write it without potentially experiencing the wrath
of the BSOD god, and You Are Not Meant To Understand This Field.

joe

well, I found the answer to my question, and I write the reply for newbies
like me.
DriverStart = imageBase
it was too much to ask? thanks anyway

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Joseph M. Newcomer wrote:

Due to a long and ignoble history, many kernel structures are
referred to as “partially opaque”, that is, there are fields you
are allowed to use, and fields which only the I/O system is
allowed to use. In C++, these would have been public and
protected/private, but in C, the way this is done is by not
documenting the fields you are not supposed to use.

In C++ I think one would truly hide these fields using the pImpl idiom.

Say that struct were marked as such:

private:
PVOID DriverStart;

I think Gilbert would still be asking what the field was.