mandiant / mandiant/STrace

Convert DLL Plugin Architecture To Driver Architecture

Open
#21 2 comments 1 reaction 1 assignee View on GitHub

@tarterp is already working on this.

Since Nov 15, 2023.

Dominant language
C++
Stars
379
Forks
52
PR merge metrics
No merged PRs in 30d

Description

### Converting to a Driver Plugin brings a simpler architecture:

1. Drivers are loaded and unloaded using `ZwLoadDriver` and `ZwUnloadDriver`
2. No manual mapping required which makes symbolic debugging easier
3. Still use export functions, this requires custom `GetProcAddress`
4. Simpler interfaces from kernel to plugin
5. No more programming as a user dll, but run in kernel.

### Architecture Decisions

1. Keep exports, other ideas that were investigate: Driver Callbacks, Calling Drivers
2. Minimize Plugin API functions
3. `ZwLoadDriver` and `ZwUnloadDriver` require a Registry path. Since STrace is a single plugin architecture the plugin will always be `Registry\Machine\System\CurrentControlSet\Services\StracePlugin`, with a binary path of `\\systemroot\\system32\drivers\StracePlugin.sys`. It will be the responsibility of the CLI to rename the plugin chosen as done prior and copy it to StracePlugin.sys. When debugging the symbols will remain the original binary to help distinguish. Possibly add an IOCTL that returns the plugin name.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.