KOSR 22 차세미나. KOSR 연역및소개 t h K o r e a O p e r a t i n g S y s t e m S e m e n a r

Transcription

1 KOSR 22 차세미나 KOSR 연역및소개 1

2 KOSR 연혁과이념 KOSR 연혁 (2001 ~ ) : WSP(Windows System Programmer) 커뮤니티 Open : KSP(Korea System Programmer) 로독립 : KOSR (Korea Operating System Research) 커뮤니티이름변경 - 회원수 : 7800명 ( 일기준 ) - 세미나 : 총 21회개최 - 현 SCA(Software Community Association : Member KOSR 의이념 : 실무개발자들이모여서만든비영리커뮤니티 - Open Source Project 지향 * Korea OS(Open Source Operating System) Research - OS System Programming 에대한기술문서화및 OPEN 2

3 세미나 ( 02 年 ~ 06 年 ) KOSR 은 5 년동안 21 회세미나개최 - 한국주요 7 개대학교및 Syskon conference 2 times ( 03 年, 04 年 ) 21 HONGIK UNIVERSITY 3

4 WDM Begginer 안철수연구소 Application Unit 신경준 4

5 목차 -WDM Basic Information -Demo and Debugging (use WinDbg) 5

6 Windows Architecture 6

7 7

8 8

9 Kernel The lowest layer of NTOSKRNL governs how OS uses the processor/s. It provides for: Thread scheduling and context switching Interrupt handling and exception dispatching Multiprocessor synchronization CPU Architecture functions: GDT and LDT manipulation on x86, CPU Cache Support Generic Wait Operations Provides foundation synchronization primitives for use by the Executive Kernel Code Mostly Resident (non pageable) Interruptible but sometimes non preemptible Search for functions beginning with Ke, Ki 9

10 System Process Represents the kernel (in a way) Hosts kernel threads Always run in kernel mode Number of threads is not constant (drivers are free to add their own threads under this process) Process ID is constant 2 (NT 4), 8 (2000), 4 (XP) 10

11 The Kernel API Implementation Most of the Kernel code is in NtOsKrnl.Exe (single CPU) or NtKrnlMp.Exe (Multi CPU) Always called NtOsKrnl.Exe on the local hard disk (in the System32 directory) Some implementation is in Hal.Dll The DDK documents about 1/3 of the exported functions Most functions have a prefix suggesting origin 11

12 Kernel API Prefixes Ex Ex - General General executive executive routines routines Exp Exp - Executive Executive private private (not (not exported) exported) Cc Cc - Cache Cache Manager Manager (Controller) (Controller) Mm Mm - Memeory MemeoryManager Manager Rtl Rtl- General General runtime runtime library library FsRtl FsRtl - file file system system runtime runtime library library Ob Ob - object object management management Io Io - I/O I/O subsystem subsystem Se Se - Security Security Ps Ps - Process Process structure structure Po Po - Power Power management management Wmi Wmi - Windows Windows Management Management Instrumentation Instrumentation Zw Zw - File File and and registry registry access access Ke Ke - General General Kernel Kernel Ki Ki - Kernel Kernel internal internal (not (not available available outside outside of of kernel) kernel) Hal- Hal-hardware abstraction abstraction layer layer READ_xxx, READ_xxx, WRITE_xxx WRITE_xxx- I/O I/O port port and and register register access access (HAL) (HAL) 12

13 HAL Hardware Abstraction Layer Purpose Isolates Kernel and Executive from hardware specifics Presents uniform model to ease device driver development and porting HAL provides low level interface to I/O System Specifics (buses, DMA, ports and registers) Interrupt controllers and system timers MP Communication Hardware interrupt priorities Importance somewhat reduced in Windows 2000/XP Bus drivers do some of these functions 13

14 Kernel Device Driver?The only one that can touch hardware, handle interrupts, etc. Has a SYS extension Its routines always run in kernel mode Also called Privileged mode Ring 0 on 80x86 Always uses the kernel mode stack Limited in size: 12KB (2000/XP), 8KB (98/ME) No documented way to enlarge it Unhandled exceptions will crash the system Producing the infamous Blue Screen of Death 14

15 Interrupt Request Level (IRQL) 15

16 16

17 IRQL Levels PASSIVE_LEVEL (0) The normal IQRL level User mode code always runs at this level APC_LEVEL (1) Used for special kernel APCs Not really interesting for driver writers DISPATCH_LEVEL or DPC_LEVEL (2) Many driver routines run at this IRQL The kernel scheduler runs at this level If the CPU runs code at this (or higher) level, no context switching will occur on that CPU until IRQL drops below this level Also no waiting on kernel objects (requires scheduler) Page fault handling also occurs at this level Code running at this or higher IRQL must always access nonpaged memory 17

18 System Memory Pools The kernel provides two general memory pools for use by the kernel itself and device drivers Non-paged pool Memory always resides in RAM (never paged out) Can be accessed at any IRQL Paged pool Memory can be swapped to disk Should be accessed at IRQL < DPC_LEVEL (2) only Pool sizes are depend on the amount of RAM and the OS type (Professional vs. Servers) Can be altered (up to some maxima) in registry HKLM\System\CurrentControlSet\Control\Session Manager\Executive Task Manager displays current sizes 18

19 19

20 20

21 DriverObject Represents the driver for the I/O system Includes dispatch routine pointers, AddDevice routine pointer, Unload routine pointer, etc. Created by the Kernel, passed to driver and filled by it I/O Manager 는서로다른 Device 에대해서서로다른 Driver Object 를이용하여, I/O 요청을처리한다. Driver Object 는여러가지 Driver 함수들로이루어져있다. I/O Manager 는 Driver 가 Load 될때 driver object 를만든다. 초기화과정중, DriverEntry 루틴은 Driver Object 안의여러다른함수포인터를 Load 한다. IRP 가특정디바이스로전달되면 I/O Manager 는 Driver Object 를이용하여올바른 Dispatch routine 을찾는다. 만약 I/O Request 가실제 device operation 이필요하다면, I/O Manager 는 Diver 의 Start I/O routine 을찾기위해서 Driver Object 를사용한다. 21

22 Layout of a Driver Object 22

23 Device object Device object (DEVICE_OBJECT) Defines a specific device (usually hardware) Associated with File objects Allows for driver-defined extensions Provides a DPC object for after Interrupt processing Created by the driver using IoCreateDevice Several may be created 운영체제에서장치마다초기화를실행한다즉, DeviceObject 를생성해주어야한다. 23

24 Device Node Represents a stack of devices PDO: Physical Device Object Created by the bus driver FiDO: Filter Device Object Optional lower/upper device objects FDO: Functional Device Object The actual WDM driver created device object FiDOs FDO FiDOs PDO 24

25 What is an IRP? The IRP structure is defined in <wdm.h> Contains all details needed to handle the request (codes, buffers, sizes, etc.) Accompanied by a set of structures of type IO_STACK_LOCATION Number of structures is the number of the devices in this DevNode Complements the data in the IRP Broadly speaking, the data needed for handling the request is split between the actual IRP object and the current I/O stack location 다른드라이버와통신하기위한구조체이다. 그리고이구조 체는 NonPagePool 에할당된다. 25

26 IRP(IO_STACK_LOCATION) 26

27 IRP Flow I/O I/O Manager Manager IRP Processing on on the the way way down down FiDO FiDO Processing on on the the way way up up Register completion routine Register completion routine FDO FiDO FiDO PDO Complete request Call completion routine Call completion routine 27

28 WDM 드라이버기본구조 DriverEntry Routine AddDevice Routine IRP Dispatch Routine DriverUnload Routine 28

29 Driver Entry & AddDevie Routine 29

30 Dispatch & Unload Routine 30

31 How to make Device Driver? 1. Get Wdk -> 2. Get WinDbg -> 3. Get Virtual Pc Setting-> 4. Set Symbol -> 5. Build Source code -> Let s Do IT 31

32 Do you Make KB Filter Driver with me? 32