Custom IRP Queue Drainer | PointerSec

Autoplay
Autocomplete

Previous Lesson Complete and Continue

Windows Legacy & PnP Driver Programming

Full Code Snippets

TutorialDriver
UpperFilterDriver
Testpnpdriver

One Note Diagrams

Legacy Drivers OneNote diagrams
PnP drivers OneNote Diagrams

Introduction

HelloWorld Driver (25:56)
Exploring DRIVER_OBJECT structure (8:24)

Creating Devices & Symbolic Links

Creating Devices and Symbolic links (14:07)

Dispatch Routines

Create & Close dispatch routines (9:05)
DEVICE_OBJECT (8:20)

IO Request Packet (IRP)

IO Request Packet IRP (9:35)
IO_STACK_LOCATION (8:22)

METHOD IO

ReadFile Buffered IO (29:06)
WriteFile Buffered IO (8:45)
DeviceIoControl and IOCTL codes Buffered IO (18:16)
ReadFile DIRECT IO (12:54)
WriteFile DIRECT IO (3:19)
DeviceControl METHOD_OUT_DIRECT (11:47)
DeviceControl METHOD_IN_DIRECT (9:15)
ReadFile METHOD_NEITHER (11:22)
WriteFile METHOD_NEITHER (3:40)
DeviceControl METHOD_NEITHER (9:25)

Filter Drivers

Creating Legacy Upper Filter Driver (20:23)
Legacy Device Stack (8:40)

IO Stack Location

Skipping Current IRP Stack Location (12:44)
Passing down IRP with IoCallDriver (10:29)
Copying Current IRP StackLocation 2 Next (8:38)
Modifying User Buffer (9:17)

Creating IRPs

Building Synchronous IRP with IoBuildSynchronousFsdRequest (18:15)
Synchronous IoBuildDeviceIoControlRequest (13:45)
Dynamic memory allocation with ExAllocatePool2 (6:12)
Completion Routines (30:41)
Creating Asynchronous IRP (36:28)
Creating Asynchronous IOCTL IRP (4:19)
Creating IRP with IoAllocateIrp DO_BUFFERED_IO (29:47)
Creating IRP with IoAllocateIrp DO_DIRECT_IO (22:34)

Interrupts

Interrupts & IRQL (8:45)
Raising IRQL with KeRaiseIrql (4:17)

Synchronization Primitives

Synchronization Primitives (5:39)
SpinLock (14:37)
Instack Queued Spinlock (7:06)
Events (14:46)
Semaphores (13:20)
Mutex (6:51)
Fast Mutex (7:00)
Timers (17:37)
Interlocked Arithmetic (6:10)

Linked Lists

Linked Lists (32:37)

StartIO & DPC

StartIO (15:10)
Scheduling DPC from StartIO (8:37)

WorkItem & IRP Draining

WorkItem (8:48)
Theory of IRP Draining (3:18)
Custom IRP Queue Drainer (18:31)

Cancel Safe Queues

Cancel Routines (12:19)
Cancel Safe Queues CSQ (36:32)
Organizing our code (8:44)
Full Code for tutorialdriver

Registry Operations

Registry Operations (42:09)

Plug n Play

AddDevice() (14:23)
Plug n Play Theory (7:25)
Handling IRP_MN_START_DEVICE (19:45)
Handling IRP_MN_STOP_DEVICE (2:32)
Handling IRP_MN_QUERY_STOP_DEVICE (4:13)
PnP Workitem (9:30)
Handling IRP_MN_REMOVE_DEVICE (7:30)
Optimizing workitem (30:03)
Installing PnP Driver (9:44)
Usermode Async IOCTL (38:27)
Handling other pnp irps (1:46)
Auto updating pnp driver (9:50)
Installing driver using pnputil (4:19)
CSQ in PnP drivers (12:58)
Remove Locks (21:04)
Enumerating raw translated resources (25:30)
Handling IRP_MN_FILTER_RESOURCE_REQUIREMENTS (19:39)
Handling IRP_MN_DEVICE_USAGE_NOTIFICATION (12:27)
DO_POWER_PAGABLE (3:45)

Teach online with

Custom IRP Queue Drainer

Lesson content locked

If you're already enrolled, you'll need to login.

Enroll in Course to Unlock