A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #1554  by SecConnex
 Thu Jul 15, 2010 6:50 pm
I was wondering what would be a good idea to get started on antivirus driver development?

What routines are used in the driver?
 #1555  by a_d_13
 Thu Jul 15, 2010 7:02 pm
Specifically what kind of AV driver are you talking about here? If you're talking about a driver to do on-access scanning, then check out the "scanner" sample in the Windows Driver Development Kit for a great example.

If you're talking about self-protection, please check out the recent thread here.

If you're talking about detecting kernel-mode rootkits, then you may want to take a look at some well-known source code for stuff like:
- Hidden Process Detection
- Hidden Driver Detection

Does that answer your question?

 #1556  by SecConnex
 Thu Jul 15, 2010 7:27 pm
Thanks very much.

Another question...would those all be separate drivers?

1. On-access scanning
2. Self-protection
3. Detecting kernel-mode rootkits
 #1558  by a_d_13
 Thu Jul 15, 2010 7:45 pm
That's entirely up to the discretion of the developer. You may find it easier to make one separate driver for each function, or just have one driver for everything. From a development point of view, though, the on-access scanning component should always be in own driver, as it needs to be as fast as possible.

 #1559  by SecConnex
 Thu Jul 15, 2010 7:52 pm
Great. I will see what the developers say on my end. :) Thanks.
 #1563  by __Genius__
 Fri Jul 16, 2010 9:00 am
@ DragonMaster Jay ,
You can say thanks by using give reputation to who answered you correctly :)