Press "Enter" to skip to content

x64 Inline Assembly in Windows Driver Kit

Sinaei 0

As my testing always interferes with running assembly directly in kernel-level and unfortunately Microsoft no longer supports x64 inline assembly through their compilers and as I always have struggle creating a simple inline assembly project so I decided to create a post to describe how to create a Windows Driver Kit project with Inline assembly to run kernel code directly in a kernel driver.

This terms only applies to x64 Windows Kernel Driver, you can use _asm and asm directly in your code in x86 drivers and user-mode codes, Linux also supports x64 Inline assembly in their kernel modules.

Let’s get down to business.

First of all, you should have Windows WDK support in your visual studio, just follow the steps here, then after downloading Windows Driver Kit and Windows SDK then you can create a WDK Project in your visual studio like this :

Create Project

 

So I created a project named MyDriver after that you should add some files to your project. As you might know, you should create a .asm file beside your .c (code) and .h (header) files thus I created two files named (source.cpp)

add cpp

and the other file is source.asm.

Add Assembly file

I made a simple assembly function (Masm) along with a simple driver entry function, you can add these files to your project. For example the following lines for source.asm.

There are some important notes here, 

  • Your function should ends with ret, if not it never comes back from your function and as long as you are in the kernel, every error lead to a BSOD.
  • The other important note is you are responsible for the calling convention used in your driver (for passing arguments or clearing the stack).
  • The default calling convention in Windows x64 driver is fastcall so in most situations, all the parameters placed in the registers and you are not forced to clear anything before ret.

 

The other file is driver entry (Source.cpp), you can use something like :

Please note that I defined MainAsm and MainAsm2 from the previous assembly file as function name so that I can use it directly in my DriverEntry or etc.

Make sure to change the architecture to x64.

Change arch to x64

 

That’s it, build your project and you can use tools like OSR Driver Loader from osronline.com to load your driver.

Almost in all current Windows versions (<=Window 7) you should disable Driver Signature Enforcement, a protection for Windows to prevent non-verified drivers or rootkits to go in ring 0.

Update :

If you see some errors like this in your building process,

Error

 

Then make sure to add your driver entry in properties -> Linker -> All Options -> search for the entry point.

 Add entry

That should solve the problem.

I also added the source of this project on my GitHub, take a look at :

[https://github.com/SinaKarvandi/x64-Driver-Inline-Assembly/]

 

Leave a Reply

Your email address will not be published. Required fields are marked *