Skip to main content

Driver in Freebasic


Freebasic is a free, open-source Dialect of Basic. It can produce fast, small and native Executables and DLLs. With no need for explicit declaration(s) of any Win32 API Function(s) followed by full inline ASM support, it turned out to be more reliable, efficient and powerful than other Basic dialects that i had (have) seen so far. With a helpful community available voluntarily available 24x7 for your help, it was a perfect Basic Language for both beginners and experts alike. It soon proved to be more powerful than it actually seemed.
I found a Sample Kernel Mode Device Driver in the FBC\examples\windows\ddk\driver\. The Sample Device Driver was written by a Freebasic Member called VoodooAttack.

I wanted to give it a try. I started by taking a look at the Code in Freebasic Driver SampleFBC\examples\windows\ddk\driver\DRIVER.BAS. The Code is:

'' NT driver example, written by voodooattack
   
    #include once "win\ddk\winddk.bi"
   
    #undef fb_RtInit
   
    declare function DriverEntry stdcall alias "DriverEntry" (byval pDriverObject as PDRIVER_OBJECT, _
                                                      byval pRegistryPath as PUNICODE_STRING) as NTSTATUS
   
   
   
    static shared dev_name as wstring ptr = @wstr("\Device\FBExample")
    static shared dev_dos_name as wstring ptr = @wstr("\DosDevices\FBExample")
   
    declare sub fb_RtInit stdcall alias "fb_RtInit"()
   
    declare function FBDriver_UnsupportedFunction(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare function FBDriver_Create(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare function FBDriver_Close(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare function FBDriver_IoControl(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare function FBDriver_Read(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare function FBDriver_Write(byval as PDEVICE_OBJECT, byval as PIRP) as NTSTATUS
    declare sub FBDriver_Unload(byval as PDRIVER_OBJECT)
   
   
    function DriverEntry(byval pDriverObject as PDRIVER_OBJECT, _
                         byval pRegistryPath as PUNICODE_STRING) as NTSTATUS
       
        dim Status as NTSTATUS = STATUS_SUCCESS
        dim pDeviceObject as PDEVICE_OBJECT = NULL
       
        dim as UNICODE_STRING usDriverName, usDosDeviceName
        dim i as integer
       
        DbgPrint(@!"FBExample: DriverEntry Called \r\n")
       
        RtlInitUnicodeString(@usDriverName, dev_name)
        RtlInitUnicodeString(@usDosDeviceName, dev_dos_name)
   
        Status = IoCreateDevice(pDriverObject, _
                                0, _
                                @usDriverName, _
                                FILE_DEVICE_UNKNOWN, _
                                FILE_DEVICE_SECURE_OPEN, _
                                FALSE, _
                                @pDeviceObject)
       

        if (Status = STATUS_SUCCESS) then
           
            DbgPrint(@!"FBExample: Device created \r\n")
           
            for i = 0 to IRP_MJ_MAXIMUM_FUNCTION - 1
                pDriverObject->MajorFunction(i) = @FBDriver_UnsupportedFunction
            next
           
            with *pDriverObject
                .MajorFunction(IRP_MJ_CLOSE)  = @FBDriver_Close
                .MajorFunction(IRP_MJ_CREATE) = @FBDriver_Create
                .MajorFunction(IRP_MJ_DEVICE_CONTROL) = @FBDriver_IoControl
                .MajorFunction(IRP_MJ_READ) = @FBDriver_Read
                .MajorFunction(IRP_MJ_WRITE) = @FBDriver_Write
                .DriverUnload = @FBDriver_Unload
                .Flags or= DO_DIRECT_IO
                .Flags and= NOT (DO_DEVICE_INITIALIZING)
            end with
           
            IoCreateSymbolicLink(@usDosDeviceName, @usDriverName)
        else
            DbgPrint(@!"FBExample: Error creating device \r\n")
        end if
       
        return Status
       
    end function
   
    sub fb_RtInit()
        DbgPrint(@!"FBExample: fb_RtInit Called \r\n")
        return
    end sub
   
    declare function KeTickCount stdcall alias "KeTickCount" () as PLARGE_INTEGER
   
    function KeTickCount () as LARGE_INTEGER ptr
        static as LARGE_INTEGER c
        KeQueryTickCount(@c)
        return @c
    end function
   
    sub FBDriver_Unload(byval DriverObject as PDRIVER_OBJECT)
       
        dim usDosDeviceName as UNICODE_STRING
       
        DbgPrint(@!"FBExample: unloading.. \r\n")
       
        RtlInitUnicodeString(@usDosDeviceName, dev_dos_name)
       
        IoDeleteSymbolicLink(@usDosDeviceName)
        IoDeleteDevice(DriverObject->DeviceObject)
       
    end sub
   
    function FBDriver_UnsupportedFunction(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: Unsupported Function \r\n")
        return STATUS_NOT_SUPPORTED
    end function
   
    function FBDriver_Create(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: FBDriver_Create \r\n")
        return STATUS_SUCCESS
    end function

    function FBDriver_Close(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: FBDriver_Close \r\n")
        return STATUS_SUCCESS
    end function

    function FBDriver_IoControl(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: FBDriver_IoControl \r\n")
        return STATUS_SUCCESS
    end function

    function FBDriver_Read(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: FBDriver_Read \r\n")
        return STATUS_SUCCESS
    end function

    function FBDriver_Write(byval DeviceObject as PDEVICE_OBJECT, byval Irp as PIRP) as NTSTATUS
        DbgPrint(@!"FBExample: FBDriver_Write \r\n")
        return STATUS_SUCCESS
    end function

The Command in FBC\examples\windows\ddk\driver\MAKE.BAT. It has(d) the following command:

@echo off         
set drvname=driver

fbc %drvname%.bas -c

link %drvname%.o /DRIVER /align:0x80 /FULLBUILD /base:0x10000 /release /osversion:5.1 /version:5.1 /OPT:ICF /OPT:REF /SECTION:INIT,d /MERGE:_PAGE=PAGE /MERGE:.data=PAGE /MERGE:.ctors=PAGE /MERGE:_INIT=INIT /MERGE:_TEXT=.text /subsystem:native,5.01 /entry:GsDriverEntry@8 bufferoverflowk.lib ntoskrnl.lib /OUT:%drvname%.sys

Just in case you don’t know Command Prompt, @echo off prevents the Command Prompt Commands from showing up in the Console Window. Set drvname sets the Driver name as driver(filename of the Sample Driver). Fbc is the compiler executable belonging to the Freebasic Package. –c compiler switch belongs to FBC.EXE which tells the Compiler to output an Object File(.o).
%drvname%.bas = driver.bas(Filename of the Freebasic Sample Driver)

Now, lets compile, with these commands first and you may get the error:
\inc\win\ddk\winddk.bi(3399) error 4: Duplicated definition in type EXECUTION_STATE As ULONG
Error during Compilation

Now, open \inc\win\ddk\winddk.bi and goto Line 3399 and modify type EXECUTION_STATE As ULONG to ‘ type EXECUTION_STATE As ULONG. This will make the line appear as a comment to the Freebasic Compiler.  Now, try the same command fbc %drvname%.bas –c and you will get driver.o in the Source Folder.
Now, the real process starts here.

The point worth noting here is that the Author of the Sample Driver (VoodooAttack) possibly was calling link(LINK.EXE - the linker which upon passing proper commands would produce an Executable accordingly from an Object File(s)). The Sample Driver was written possibly for Freebasic v0.17b or earlier. And, there is no link.exe now. The latest Freebasic Version available for use at the time of writing this article is Freebasic V0.23 which has ld.exe(\bin\win32\ld.exe). The Other point worth noting is that the current version of ld.exe has no compiler switch (command) called /driver.
Now, how could we build a Device Driver then. I went to the Freebasic forum and started a thread with a question about the LINK.EXE.  

The New command needed to produce a Kernel Mode Device Driver is as follows:
bin\win32\ld -h DRIVER.O -o DRIVER.SYS -shared  -e DriverEntry@8 --image-base 0x1000 --subsystem native -s -l ntoskrnl -L lib\win32

The bin\win32\ld is the path to the LD.EXE File. –h is the path to the Source (Object File), -o is the path to the desired output file, -e defines the Executable’s EntryPoint, --image-base defines the base Address of the Executable –subsystem is to be passed native (Drivers have no Subsystem(s) – so pass native) –l  is the path to the Library (LIBPATH), -L is the path to the Directory holding the Library File.

Your Antivirus may complain about the Driver but, it is clean.
Avira AV falsely detects the Driver as a Rootkit


And, there you have it, a KERNEL MODE DEVICE DRIVER written entirely on Freebasic.
by
.......<<<<<deepz>>>>.....
Labels:

Comments

Post a Comment

Popular posts from this blog

உடல் எடையை குறைக்க வேண்டுமா ?

இன்றைய அவசர உலகின் மிக பெரிய பிரச்சனையாக இருப்பது உடல் எடை அதிகரிப்பது தான்.மனம் போன போக்கில் உணவு கட்டு பாடு இல்லாமல் கண்டதையும் உள்ளே தள்ளுவதும்,உக்காந்த இடத்திலேயே கணணி முன் நேரத்தை விரயமாக்குவதும் தான் இந்த பிரச்சனைக்கு மூல காரணமாகும். அது சரி இந்த பிரச்சனையை எப்படி இல்லாமல் செய்வது அல்லது உடல் எடையை எவ்வாறு குறைப்பது என்பதை பற்றி பாப்போம் , பல வருட ஆரய்சிக்குபின் மருத்துவர்கள்   உடல் எடைய குறைக்க மிகவும் சுலபமான உடற்பயிற்சியை கண்டுபிடித்துள்ளனர்.இது  100% பயனளிக்க கூடியது, எந்த இடத்திலும் எந்தநேரத்திலும் மிக சுலபமா செய்ய கூடிய உடற் பயிற்சியாகும்.இந்த உடற்பயிற்சிகள் படத்துடன் கீழே தரப்பட்டுள்ளது நீங்களும் முயற்சித்து பாருங்கள கண்டிப்பாக பலன் கிடைக்கும்... முதலில் நாற்காலியில் உட்கார்ந்து இட  பக்கம் பார்கவும் .. ..        அடுத்து  நாற்காலியில் உட்கார்ந்து வல  பக்கம் பார்கவும்  ....  நண்பர்கள் யாரவது மச்சி வாடா சின்ன பீஸ் ,இங்க பாரு சூப்பர் அய்டம்னு சொல்லி கால்ல விழுந்து கூப்பிட்டலோ மேற்கூறிய உடற் பயி...
Post a Comment
Read more

38 (new) web tools to keep you busy

For many of us, the internet represents our daily job, income resource or biggest hobby. Every day we check our emails, read our feeds, visit our websites, find and discuss new things and GOD knows what else. It requires a lot of tools to do all this stuff and sometimes, we forget to search for easier solutions losing valuable time or keeping down the production graph. It's very hard to keep track with everything that's new and popular and this is why we do monthly searches for the best web tools out there. Enjoy!  45+ Web Operating Systems "There are many more web operating systems hoping to bring all your usual desktop applications online in one place - here are more than 45 of our favorites."  15 Ways To Create Website Screenshots "15 Ways To Create Website Screenshots"  Open Source Windows "The promise of open source software is best quality, flexibility and reliability. The only way to have TRUE "Open Source Windows"is...
Post a Comment
Read more

(Loot again) Get Mi Earphones & Mi Backpack In Just Rs.1

How to Get Mi Band , Mi Earphones & Mi Backpack In Just Rs.1 1, First Of All Just  Click On Below Links 1 By 1  Click 1->  Mi City Backpack Dark Grey Minimalist sleek design  -In Just Rs.1 Click 2->  Mi Earphones Silver Dynamic bass sound  -In Just Rs.1 2. Now Open All Links 1 By 1 3. After Opening The Link Click On “ Click to Bring The Price Down ” Then Click “ I Want it too ” 4. Login into Your Mi Account ( Or Sign Up  –  New Mi Account Giving Huge Price drop Like Rs.50 Or Rs.70 Drop , So Recommend You to Make New Account ) 5. Now You will See 3 Products There In this  Mi 24 Hour Madness Sale  6. Click On “ Participate ” Now Button & Share The Link With Your Friends When Each Friend Click On Your Link , You Will See Some Price cut in Your Products… Finally After Enough Click Your Product Will be Available For Just Rs.1  7. Start Referring , Start Looting MI
Post a Comment
Read more