[madaboo]

Hello.

I'm looking for a suggestion how can I attach to specified driver stack with my own driver (I want to make filter driver) just after it has been loaded. (I mean here that driver I want to attach to is loaded dynamically in system so I don't really know when it is loaded).
I've tried to use PsSetLoadImageNotifyRoutine callback to track this moment, but it seems that it too early - and when I'm calling IoAttachDevice() IO manager returns specified device not found (c0000034) as I understand it is because driverEntry routine has not been called yet.
Can you tell me how could I achieve this? Or maybe I'm doing something wrong.
I would like to aviod any illegal solutions.

Thank you for joining to discussion.
madaboo

[redp]

use .inf files for example
Also if your device to attach is PnP you can set your callback with IoRegisterPlugPlayNotification with EventCategoryDeviceInterfaceChange

[madaboo]

redp, Thanks for quick response!
I will check your 'inf' suggestions soon.
Driver I want to attach is no PnP so probably I won't be able to apply your second suggestion however thank you for this - I will remember it for next time ;) .

Do you think that there is no other 'callback &notify' solution that could work for this?
Maybe there is callback for driver loading notifications or something?

[redp]

Sure there are lots of less official dirty hacks to do that
You could hijaq IoCreateDevice from IAT of driver which controls device to attach
Or even just make hook on this functions (e.g. using splicing)
or some other function like IoCreateSymbolicLink
etc etc

[madaboo]

redp,

Thanks again for joining discussion.
When I was posting this quesion I was considering legal solutions only.
BTW could you give me some links on howto for splicing, hijaq from IAT - it is sounds interesting...
But my quesion about legal way of attaching to existing driver (if you have any other ideas) that is loaded dynamically is still opened.

Thank you very much.

[redp]

remembering Richard Feynman :twisted:
You could rebuild kernel from wrk and add some custom patches
Or you can patch pointer to IoCreateDevice in VfRegularThunks table and just load target driver under driver verifier
Or you could patch NtCreateFile in SDT to intercept opening of your device to attach
etc etc

[madaboo]

redp,
Thanks again for your reply.
According to my question - can you give me some links, tutorials for those 'hacking' methods?

Thanks a lot for your help!

[Brock]

What hacking methods are you in need of? Elaboration is needed otherwise you are writing in crayons