Windows Internals & Software Drivers Training

Size: px

Start display at page:

Download "Windows Internals & Software Drivers Training"

Jonah Lawson
5 years ago
Views:

Overview Windws Internals & Sftware Drivers Training This training is designed fr sftware engineers and architects wh need t understand the details f the majr Windws architectural cmpnents, as well

The training includes a review f basic Windws architecture, and cvers the basics f building and debugging kernel-mde drivers fr Windws.

Other extensin mechanisms, such as Object Manager, Prcess Manager, and Registry callbacks are discussed.

1 Overview Windws Internals & Sftware Drivers Training This training is designed fr sftware engineers and architects wh need t understand the details f the majr Windws architectural cmpnents, as well as hw t create sftware nly kernel-mde drivers that serve as extensins t the Windws perating system. The training includes a review f basic Windws architecture, and cvers the basics f building and debugging kernel-mde drivers fr Windws. It then discusses the details f driver structure, including the I/O and PnP subsystems, device discvery, enumeratin, and interrupt prcessing. Other extensin mechanisms, such as Object Manager, Prcess Manager, and Registry callbacks are discussed. The training als includes in-depth discussins f the Windws Kernel, prcess and thread instantiatin, and the Memry Manager. During lab sessins, participants create and mdify sftware-nly drivers t perfrm varius kernel-mde tasks. Nte that this training fcuses n the develpment f drivers that service as Windws perating system extensins but d nt service any hardware. Thus, while the basic cncepts f drivers fr devices are discussed, the lab sessins fcus strictly n the develpment f sftware (i.e. pseud) drivers which typically use legacy r NT V4 style interfaces (as ppsed t PnP). Details Length: 5 days Delivery: Lecture and Lab Target Audience Security researchers, engineers invlved in security and threat analysis/ mdeling, wh need a slid understanding f key Windws internals and data structures, and the ptins available t mnitr and extend the actins f the Windws perating system. This training is als apprpriate fr engineers actively invlved in the areas f intelligence and infrmatin and driver testing fr clients. ask@eact-tech.cm embeddedact.cm

2 Prerequisites This is nt a training fr beginners withut knwledge r experience in either perating systems r firmware. Rather, it is an intense, practical, architectural study f specific parts f the Windws O/S, interspersed with practical exercises. Students attending this training will need a gd understanding f general O/S cncepts and will be well served by starting with at least a basic Windws O/S architectural. Because it is a hands-n training, students need a wrking knwledge f the C prgramming language, as well as the basic ability t use a Windws system. Develpers wh want t develp file systems r file system filter drivers will als need the infrmatin presented in this training, as it is an abslute prerequisite t understanding thse tpics. Curse Outline Windws Operating System Architecture Overview A brief review f the general architecture f the Windws perating system. Kernel Mde and Key Structures In this mdule, we discuss fundamentals f Kernel Mde in Windws, including cverage f key bject types (Dispatcher, Cntrl, Executive) and data structures (KPCR, KTHREAD, EPROCESS) that Windws uses. Device Stacks The Windws I/O Subsystem A discussin f hw the PnP Manager wrks with drivers t build stacks f devices thrugh the enumeratin prcess. The rle f Functin Drivers, Bus Drivers, and Filter Drivers is discussed. PDOs, FDOs, and Filter Device Objects are defined. The relatinship f the PnP prcess t the prcess f lading legacy style drivers is discussed. Installing Legacy Drivers n Windws In this sectin, we discuss hw t create installatin cntrl files fr legacy style, sftware-nly drivers. Als included is a brief discussin f PnP (WDM) driver installatin using INF files. Building and Debugging This sectin describes hw WDM drivers are built using the WDK build envirnment as well as the basics f hw t setup and use the Windws kernel mde debugger, WinDbg. Interrupt Request Levels and DPCs Windws synchrnizes kernel mde activity by using a set f Interrupt Request Levels (IRQLs). This sectin cvers hw IRQLs are used t achieve synchrnizatin within the OS. Als the prcessing that ccurs at these IRQLs including Deferred Prcedure Calls (DPCs) and dispatching are discussed. Passing Requests t Other Drivers IRPs, I/O Stack Lcatins, and hw requests are sent frm driver t driver using ICallDriver are all discussed. Synchrnus and asynchrnus IRP cmpletin. A brief discussin f cmpletin rutines is als included. I/O Functin Cdes and Buffer Methds A specific discussin f I/O functin cdes (majr and minr), as well as defining custm Device Cntrl requests (IOCTLs). A detailed discussin f the way that Windws passes buffers frm usermde applicatins t kernel-mde, including the security implicatins f each methd. DriverEntry PnP vs. Legacy This sectin describes hw sftware nly drivers are initialized, and includes a walk-thrugh and discussin f the actins taken in a typical DriverEntry functin. The discussin is runded-ut with a descriptin f the initializatin functins used by PnP drivers (Add Device and Start Device). ask@eact-tech.cm embeddedact.cm

3 Dispatching and Cmpleting Requests This mdule describes Dispatch Rutines including I/O request validatin, as well as the basics f request queuing and cmpletin. Serializatin: Wait Lcks and Spin Lcks A discussin f the varius mechanisms used in Windws kernel-mde prgramming t perfrm synchrnizatin and serializatin. The different types f spin lcks, mutexes, and ther lcks are discussed, alng with guidelines fr when each might be apprpriate fr use. Tls fr Driver Quality In this sectin, we discuss tls that are available in the Windws Driver Kit t test and validate drivers. Windws Driver Verifier, OACR/PREfast, and Static Driver Verifier are all discussed, alng with the strengths and weaknesses f each tl and recmmendatins fr the best use f each. Bt, Crash, and Hibernatin Prcesses A discussin f hw Windws starts, including transitins frm 16-bit mde. Als, a discussin f the crash dump and hibernatin prcesses (which are remarkably similar n Windws). Versin-specific differences are als discussed. Windws System Services Hw system service calls are implemented in Windws, bth in new versins f the OS and histrically. A descriptin f a selectin f NtXxxx and ZwXxx functins, and hw their use in usermde and kernel mde differs. Prcess and Thread Creatin In this sectin, we discuss the rle f the Prcess Manager, including hw prcesses and threads are instantiated. The majr data structures (ETHREAD, EPROCESS) are described. The native system services fr creating prcesses and threads are als briefly discussed. Hw dispatching (scheduling) is perfrmed in Windws. Other Kernel Extensins An extended discussin f methds, ther than thse in the I/O dmain, f extending the Windws perating system using sftware nly drivers. This includes a discussin f Object Manager, Prcess Manager, and Registry callbacks, including the significant differences in the availability f these methds amng varius Windws versins. Cleanup, Clse, and Cancel Cleanup, clse and request cancellatin are cmpared and cntrasted. When ne might need t implement supprt fr each in a typical WDM driver is discussed. Guidelines fr supprting request cancellatin, including Cancel Safe Queues and in-prgress request handling are presented. Windws Virtual Memry A discussin f Windws virtual memry subsystem, including prtins f the Memry Manager and Cache Manager. Page tables. Paging and page fault handling. The Details f I/O Cmpletin In this sectin, we describe the details f hw Windws cmpletes I/O requests, as well as the crrect handling f different types f I/O cmpletin requirements within drivers. This includes a discussin f hw the I/O Manager manages maintains synchrnus request handling when requested by an applicatin, even when a driver perfrms asynchrnus I/O prcessing. Guidelines fr prper driver implementatin are develped and discussed. * * * * * * * * ask@eact-tech.cm embeddedact.cm

4 Writing WDF Drivers Training The Windws Driver Fundatin (WDF) is the mdern standard fr creating Windws drivers, and is the preferred way t implement mst new drivers fr Windws. WDF enables develpers t write drivers that execute in either kernel-mde using the Kernel Mde Driver Framewrk (KMDF) r user-mde using the User Mde Driver Framewrk V2 (UMDF V2). The gal f this seminar is t help engineers learn bth the fundamental and practical details f KMDF and UMDF V2. This includes bth basic architectural infrmatin abut Windws and the Windws I/O Subsystem as it relates t WDF, plus the specific details f hw t write, test, diagnse, and supprt drivers using KMDF and UMDF V2. The seminar fcuses specifically n KMDF and UMDF V2 sftware drivers, filter drivers, drivers fr USB devices, as well as drivers fr prgrammed I/O type devices (interfaced via either PCI-family r mtherbard-based buses). The basics f writing KMDF client drivers fr SC/IT-type envirnments and lw-pwer devices such as that cnnect via GPIO, I2C, and SPI are als discussed (thugh this tpic is nt cvered in detail). The seminar takes a unique apprach t the tpics presented: Key architectural details are described first, and then thse details are made cncrete and accessible via presentatin f task-based practical implementatin steps. Finally, larger grups f architectural and implementatin cncepts are cllected and made directly useful thugh the review and discussin f several carefully chsen case studies. Target Audience This seminar is designed fr engineers wh need t understand hw t design, develp, and test Windws drivers using the WDF Kernel Mde Driver Framewrk (KMDF) r the WDF User Mde Driver Framewrk V2 (UMDF V2). Prerequisites Students attending this seminar will be assumed t have a gd wrking knwledge f general O/S cncepts (user mde versus kernel mde, virtual memry cncepts, and cncurrency issues) and device cncepts (such as buses, interrupts, and registers). Previus experience develping device drivers (n any perating system) will definitely be an advantage, but is nt required. Due t the hands-n rientatin f this seminar, attendees will be assumed t be able t use Windws at a user level, including hw t use Micrsft s Visual Studi. Wrking knwledge f the C prgramming language, and hw t read and write t a file using Win32 APIs (CreateFile, ReadFile, WriteFile) are als assumed. ask@eact-tech.cm embeddedact.cm

5 Details Length: 5 days Delivery: Lecture and Lab Seminar Outline Intrductin Welcme remarks, seminar gals and bjectives. Intrductin t WDF, as well as KMDF and UMDF V1 and UMDF V2 and when each mdel is the mst apprpriate. Windws OS Architecture fr Driver Writers A review f cre Windws architecture cncepts f specific imprtance t driver develpers. Tpics include: General rganizatin f NTOS: Executive, Kernel, and HAL. Prcesses and threads. Memry management. Intrductin t key I/O Manager bjects (File Object, Device Object, Driver Object). Overview f PnP prcess. Pwer Management. Executive Services. Object Manager Hw an bject name (such as a file specificatin) is prcessed. Hw File Objects are created and the prcess-specific handle table. Windws Kernel intrductin. Windws HAL intrductin. The Windws Device Tree This mdule cmprises a detailed view f hw the Windws PnP subsystem discvers and enumerates devices and lads their assciated drivers. Details fr devices n dynamically enumerable buses (such as PCIe, USB, r Bluetth) and nn-dynamically enumerable buses (such as SPI, I2C, r GPIO) are described. All abut Physical Device Objects (PDOs), Functin Device Objects (FDOs), and filter Device Objects. Hw filter drivers wrk their magic. Hw requests are prcessed, and passed frm driver t driver within the Windws I/O Subsystem. I/O request cmpletin handling. Further discussin and descriptin (expanding n infrmatin frm the previus mdule) f hw system requests in general and I/O request in particular are passed frm user-mde t kernel-mde, initially in the cntext f the requesting thread. ask@eact-tech.cm embeddedact.cm

6 Driver Installatin Hw t create installatin cntrl files fr KMDF drivers. The Ten Mst Frequently Used INF File sectins are discussed. The KMDF C-Installer, and hw t specify it in an INF file, is described. The WDF Object Mdel WDF bject characteristics and taxnmy. Hw bjects are instantiated and used in KMDF and UMDF V2. An verview f the mst cmmn WDF bjects. Driver Initializatin Hw a WDF driver and its assciated device are initialized. Als, handling typical PnP and pwer management events such as device discvery (EvtDriverDeviceAdd), pwer-up (EvtDeviceD0Entry), and pwer-dwn (EvtDeviceD0Exit). Hw WDF drivers are ntified f and claim their hardware resurces, including registers, prts, cnnectins, and interrupts. Building and Debugging Students are assumed t already be familiar with the basics f hw t use Visual Studi. We ll review the details, as well as discuss hw t setup and use WinDbg, the Windws kernel debugger. We ll als discuss specific issues abut building and debugging drivers fr Windws using the WDK and Visual Studi, as well as tls such as Cde Analysis and Static Driver Verifier. We als discuss the WDF Kernel Debugger Extensins (WDFKD), including retrieving the WDF Lg frm the in flight recrder. LAB: Building and Debugging, Driver Initializatin (DriverEntry, EvtDeviceD0Entry, etc.). Interrupt Request Levels & Deferred Prcedure Calls In this mdule, we discuss the all-imprtant cncept f Interrupt Request Levels (IRQLs), and the specific uses that Windws makes f varius IRQLs. We als discuss Deferred Prcedure Calls (DPCs) and hw they re used in Windws fr Interrupt Service Rutine cmpletin (DPCfrISR). We als discuss passive-level interrupts and its assciated Wrk Item fr ISR. Queues and Requests Hw a WDF driver gets I/O requests, and hw thse requests are prcessed. Tpics include: hw WDF Queues are instantiated, Queue dispatch types, and hw Queues can be used t srt Requests; Framewrk Requests and hw Requests are prcessed and cmpleted; hw the user data buffer assciated with a Request is accessed and in what cntext this access is allwed; hw Requests are cmpleted with data, status, and infrmatin returned. Buffer Methds and Device Cntrls The different ways that requestr data buffers can be described are discussed. Direct I/O, Buffered I/O, and Neither I/O are described, cmpared, and cntrasted. Als discussed is hw t define custm Device IO Cntrl Cdes (IOCTLs), and hw the previusly described buffering methds apply t IOCTLs. LAB: Request Prcessing and Cmpletin, Filtering Case Study 1: Prgrammed I/O Device This case study reviews and demnstrates all the tpics discussed in the ask@eact-tech.cm embeddedact.cm

7 seminar t this pint. T d this, the instructr takes students n a guided walk-thrugh f the cde fr a driver fr the wrld s simplest device, reviewing and reinfrcing cncepts alng the way. All phases f driver peratin are reviewed frm device discvery, t claiming hardware resurces, prcessing pwer state changes, and prcessing and cmpleting requests bth synchrnusly and asynchrnusly. I/O Targets Hw a driver sends Requests t ther drivers in the system, and ptinally receives the results. Lcal, Remte, and Special I/O Targets. Bth synchrnusly and asynchrnusly send peratins are discussed. Cmpletin rutines are als cvered. Case Study 2: USB Part 1: USB Cncepts The basics f USB are discussed including device, cnfiguratin, and interface descriptrs. Endpints and pipes are described. Part 2: Implementing WDF USB Drivers In this sectin, we describe hw USB drivers are implemented in KMDF. This includes hw a cnfiguratin and interface is chsen, and hw endpints are retrieved. Hw t send vendr cmmands t a device via Endpint. Using Bulk and Interrupt endpints. The WDF Cntinuus Reader is briefly discussed, as is supprting Selective Suspend (USB device pwer management). LAB: USB using the OSR USB-FX2 device (dem by trainer -understanding) Case Study 3: SPB/GPIO Device Hw Simple Peripheral Bus clients and GPIO-cnnected devices (such as senrs n SPI, I2C, and GPIO buses) are supprted in Windws. SPBs and the RESOURCE_HUB. Cntrller drivers and Client drives. Walk-thrugh f the initializatin and I/O prcessing a Client driver that receives interrupts via a GPIO line and cllects data frm an I2C r SPI bus. And intrductin t the Pwer Management Framewrk (PFx), including review f example cnfiguratins and callbacks fr single-cmpnent devices. Serializatin In this mdule, we discuss issues relating t synchrnizing access t shared data within a driver. The much misunderstd tpic f WDF Synchrnizatin Scpe is fully described, as is extending sync scpe t ther callback rutines via the Autmatic Serializatin parameter. WDFSPINLOCKs and WDFWAITLOCKs are discussed, alng with the underlying implementatins f each and hw they re used and the implicatins f using each f these serializatin mechanisms frm user-mde drivers. Cleanup, Clse, and Cancel Strategies fr handling queued and in-prgress requests are discussed, as what prcessing typically takes place as part f cleanup and clse prcessing. Helpful Classes A brief descriptin f a few Framewrk classes such as WDFCOLLECTION, ask@eact-tech.cm embeddedact.cm

8 WDFWORKITEM, and WDFTIMER that might be useful fr driver develpers t knw. LAB: USB cntinued, Open/Clse prcessing. * * * * * * * * Duratin: 3-4Days Windws 10 IT Cre Level: Intermediate Objectives: The bjectives f the Windws 10 IT Cre prgram are as fllws: 1. T intrduce the participants t the dmain f the Internet f Things (IT). IT technlgies are set t explde in a variety f applicatins ranging frm Machine t Machine (M2M) Cmmunicatin, Cntrl and Autmatin, persnal healthcare devices, hme autmatin, supply chain management, cnsumer and electrnic entertainment devices and s frth. 2. T intrduce the participants t Micrsft s IT perating system ffering as it seeks t be a majr player in the IT space. Further Windws 10 IT cre aims t prvide seamless cnnectivity t desktp and clud cmputing envirnments. Pre-requisites: 1. Participants are expected t be familiar with micrcntrller-based embedded system hardware, firmware and peripheral prgramming in general fr cmmn peripherals such as GPIOs, I2C, SPI, USB etc. 2. Participants are als expected t be familiar with embedded cmmunicatin prtcls such as Bluetth LE, ZigBee, 6LWPAN etc. 3. Familiarity with ther embedded OSs, develpment tls and techniques in general. ask@eact-tech.cm embeddedact.cm

9 Day 1 Intrductin t Embedded Hardware and Firmware Architecture f Embedded Systems Hardware and Firmware Prgramming Techniques and Key Differences frm Desktp Systems Embedded Prcessrs, Peripherals and Prtcls General Purpse I/Os (GPIOs) I2C Bus SPI Bus USB Embedded OSes and RTOSes Embedded Cmmunicatin Technlgies Wired and Wireless Intrductin t Lw Pwer Wireless Technlgies Bluetth Lw Energy (LE) ZigBee 6LWPAN Requirements f Machine-t-Machine (M2M) Cmmunicatin, Cntrl and Autmatin Systems Day 2 Intrductin t IT Technlgies Cncepts and Definitins f The Internet f Things (IT) Applicatins and Requirements IT Architecture IT Enabling Technlgies Majr cmpnents f IT Hardware, sensrs, actuatrs, Systems-n-a-Chip, firmware, device drivers, applicatin sftware, cnnectivity, clud, and security Intrductin t Raspberry Pi 2 Rle f wired and wireless cmmunicatin IT Cmmunicatin and Netwrking Prtcls IT Services and Applicatins Security Clud Cmputing and the Internet f Things IT Platfrms Day 3 & 4 Case Study using Windws 10 IT Cre Prblem Statement ask@eact-tech.cm embeddedact.cm

10 Requirements and Specificatins f the IT Device Hardware Sftware Designing the Overall System Architecture Intrductin t Windws 10 IT Cre Setting up the Develpment System Implementing and Cnfiguring the Hardware Cmpnents Implementing the Sftware Cmpnents Drivers fr Sensrs and Actuatrs Applicatin Sftware Cmmunicatin Prtcl Implementatin Integratin with Clud-based Services Testing the Final Prduct ask@eact-tech.cm embeddedact.cm

Course 6368A: Programming with the Microsoft.NET Framework Using Microsoft Visual Studio 2008

Course 6368A: Programming with the Microsoft.NET Framework Using Microsoft Visual Studio 2008 Curse 6368A: Prgramming with the Micrsft.NET Framewrk Using Micrsft Visual Studi 2008 5 Days Abut this Curse This five-day, instructr-led curse prvides an intrductin t develping n-tier applicatins fr the