|
|
1.1 root 1: This sample is composed of two parts, the Win32 portion and the
2: kernel device driver portion.
3:
4: The Win32 portion contains a file, GETHNDL.C, which attempts to
5: obtain a handle to the LDUNLD.SYS driver which is named LOADTEST. The
6: executable is built using the Windows NT SDK. First update the environment
7: and path by running <mstools>\setenv.bat. Type "NMAKE -f GETHNDL.MAK" to
8: compile the Win32 program, GETHNDL.EXE.
9:
10: The kernel driver portion contains the driver source code, LDUNLD.C
11: (which is short for LOAD/UNLOAD) and a text file which is used in
12: conjuction with your registry. The driver is built using the Windows
13: NT DDK. To build the driver type:
14:
15: build -cef
16:
17: Copy the built driver, LDUNLD.SYS to the <winnt_root>\system32\drivers
18: directory :
19:
20: copy obj\i386\ldunld.sys <winnt_root>\system32\drivers
21:
22: Now, update the registry :
23:
24: regini ldunld.ini ; add the driver to the registry
25:
26: Reboot.
27:
28: Execute GETHNDL.EXE -- should not get a handle
29: net start ldunld
30: Execute GETHNDL.EXE -- should get a handle
31: net stop ldunld -- will only work with Administrator privileges
32: Execute GETHNDL.EXE -- should not get a handle
33:
34: That's all there is to it. You can net start the driver with User
35: privileges, but you won't be able to stop it. There are also debug
36: print messages which appear in the kernel debugger, if you build a checked
37: version.
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.