Driver Development Workflow
The first step in driver development is to get familiar with the tool chain. This section covers the Windows Driver Kit, the Debugging Tools for Windows for kernel debugging and driver quality tools like Code Analysis and Driver Verifier. Attendees will configure a Virtual Machine as a kernel debug target to test the drivers developed during the course.
Kernel Programming Basics
The kernel mode programming environment is different from application development in many respects including memory allocation, string handling, object lifetime management, linked list manipulation, compiler pragmas etc. This section covers the basics of kernel mode software development including usage of tools like kernel mode debugger, driver verifier etc. Attendees will apply the concepts learnt in this section to the rest of the topics in this course.
Synchronization
Due the reentrant nature of the kernel, proper synchronization in drivers is critical. This section talks about IRQL and its relationship to synchronization. The entire arsenal of synchronization primitives provided by the kernel consisting of events, mutexes, fast mutexes, guarded mutexes, ERSOURCEs, interlocked operations and spin locks are covered along with their respective usage scenarios.
Execution Contexts
The windows kernel provides interfaces for drivers to execute functions in different thread contexts like calling thread context, arbitrary thread context, system thread context, targeted thread context. This section discusses the differences between the various execution contexts, their use cases and then delves into the implementation details like dispatch entry points, deferred procedure calls (DPCs), timers, asynchronous procedure calls (APC), work items and system threads.
Filter Drivers
The most common method of intercepting I/O operations in the system are IRP based filter drivers which can be used to filter keyboard, mouse, disk I/O, USB devices etc. Filter driver concepts like attaching to devices, pre-filtering, post-filtering, request forwarding, I/O completion, data access, filter and control device objects are discussed.
Advanced Topics
Attendees put together the concepts covered in previous sections and apply them to implement common tasks required in kernel drivers like locking memory, mapping memory, application to driver communication, rundown protection and building custom I/O requests etc.
