Convert DLL Plugin Architecture To Driver Architecture
@tarterp is already working on this.
Since Nov 15, 2023.
- Dominant language
- C++
- Stars
- 379
- Forks
- 52
- PR merge metrics
- No merged PRs in 30d
Description
### Converting to a Driver Plugin brings a simpler architecture:
1. Drivers are loaded and unloaded using `ZwLoadDriver` and `ZwUnloadDriver`
2. No manual mapping required which makes symbolic debugging easier
3. Still use export functions, this requires custom `GetProcAddress`
4. Simpler interfaces from kernel to plugin
5. No more programming as a user dll, but run in kernel.
### Architecture Decisions
1. Keep exports, other ideas that were investigate: Driver Callbacks, Calling Drivers
2. Minimize Plugin API functions
3. `ZwLoadDriver` and `ZwUnloadDriver` require a Registry path. Since STrace is a single plugin architecture the plugin will always be `Registry\Machine\System\CurrentControlSet\Services\StracePlugin`, with a binary path of `\\systemroot\\system32\drivers\StracePlugin.sys`. It will be the responsibility of the CLI to rename the plugin chosen as done prior and copy it to StracePlugin.sys. When debugging the symbols will remain the original binary to help distinguish. Possibly add an IOCTL that returns the plugin name.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.