From: muriwai on
Hi,

I have MyDriver.sys that can be loaded on Server 2003 and 2008. The driver
imports a function from ksecdd.sys. The function is available on 2008 only.
How do I dynamically link to ksecdd.sys? MmGetSystemRoutineAddress doesn't
work. Can I use delayed imports in a kernel mode driver?

Thank you,

Andrew

From: Doron Holan [MSFT] on
you have to roll your own code to walk ksecdd's export table and resolve the
exports yourself in your code at runtime. fortunately there are helper
routines here in auxklib.lib. specifically

AuxKlibInitialize
AuxKlibQueryModuleInformation and ask for AUX_MODULE_BASIC_INFO
AuxKlibGetImageExportDirectory with the ImageBase value for ksecdd from the
query call

and then parse/walk the IMAGE_EXPORT_DIRECTORY yourself

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"muriwai" <muriwai(a)nospam.nospam> wrote in message
news:OxfsQ0EqIHA.3616(a)TK2MSFTNGP06.phx.gbl...
> Hi,
>
> I have MyDriver.sys that can be loaded on Server 2003 and 2008. The driver
> imports a function from ksecdd.sys. The function is available on 2008
> only. How do I dynamically link to ksecdd.sys? MmGetSystemRoutineAddress
> doesn't work. Can I use delayed imports in a kernel mode driver?
>
> Thank you,
>
> Andrew

From: muriwai on
Thanks Doron.

How do I make sure ksecdd won't be unloaded in the middle?

Thank you,

Andrew


"Doron Holan [MSFT]" <doronh(a)online.microsoft.com> wrote in message
news:uh7yfOVqIHA.4672(a)TK2MSFTNGP05.phx.gbl...
> you have to roll your own code to walk ksecdd's export table and resolve
> the exports yourself in your code at runtime. fortunately there are
> helper routines here in auxklib.lib. specifically
>
> AuxKlibInitialize
> AuxKlibQueryModuleInformation and ask for AUX_MODULE_BASIC_INFO
> AuxKlibGetImageExportDirectory with the ImageBase value for ksecdd from
> the query call
>
> and then parse/walk the IMAGE_EXPORT_DIRECTORY yourself
>
> d
>
> --
> Please do not send e-mail directly to this alias. this alias is for
> newsgroup purposes only.
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
> "muriwai" <muriwai(a)nospam.nospam> wrote in message
> news:OxfsQ0EqIHA.3616(a)TK2MSFTNGP06.phx.gbl...
>> Hi,
>>
>> I have MyDriver.sys that can be loaded on Server 2003 and 2008. The
>> driver imports a function from ksecdd.sys. The function is available on
>> 2008 only. How do I dynamically link to ksecdd.sys?
>> MmGetSystemRoutineAddress doesn't work. Can I use delayed imports in a
>> kernel mode driver?
>>
>> Thank you,
>>
>> Andrew
>

From: muriwai on
Never mind, I'll statically link to a function that present in both 2005 and
2008....

Thanks



"muriwai" <muriwai(a)nospam.nospam> wrote in message
news:uxpgmxZqIHA.4112(a)TK2MSFTNGP03.phx.gbl...
> Thanks Doron.
>
> How do I make sure ksecdd won't be unloaded in the middle?
>
> Thank you,
>
> Andrew
>
>
> "Doron Holan [MSFT]" <doronh(a)online.microsoft.com> wrote in message
> news:uh7yfOVqIHA.4672(a)TK2MSFTNGP05.phx.gbl...
>> you have to roll your own code to walk ksecdd's export table and resolve
>> the exports yourself in your code at runtime. fortunately there are
>> helper routines here in auxklib.lib. specifically
>>
>> AuxKlibInitialize
>> AuxKlibQueryModuleInformation and ask for AUX_MODULE_BASIC_INFO
>> AuxKlibGetImageExportDirectory with the ImageBase value for ksecdd from
>> the query call
>>
>> and then parse/walk the IMAGE_EXPORT_DIRECTORY yourself
>>
>> d
>>
>> --
>> Please do not send e-mail directly to this alias. this alias is for
>> newsgroup purposes only.
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>>
>> "muriwai" <muriwai(a)nospam.nospam> wrote in message
>> news:OxfsQ0EqIHA.3616(a)TK2MSFTNGP06.phx.gbl...
>>> Hi,
>>>
>>> I have MyDriver.sys that can be loaded on Server 2003 and 2008. The
>>> driver imports a function from ksecdd.sys. The function is available on
>>> 2008 only. How do I dynamically link to ksecdd.sys?
>>> MmGetSystemRoutineAddress doesn't work. Can I use delayed imports in a
>>> kernel mode driver?
>>>
>>> Thank you,
>>>
>>> Andrew
>>
>

From: Doron Holan [MSFT] on
exactly. if you staticly link against ksecdd, it will not unload as long as
our driver is loaded.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"muriwai" <muriwai(a)nospam.nospam> wrote in message
news:umWXIAeqIHA.5068(a)TK2MSFTNGP02.phx.gbl...
> Never mind, I'll statically link to a function that present in both 2005
> and 2008....
>
> Thanks
>
>
>
> "muriwai" <muriwai(a)nospam.nospam> wrote in message
> news:uxpgmxZqIHA.4112(a)TK2MSFTNGP03.phx.gbl...
>> Thanks Doron.
>>
>> How do I make sure ksecdd won't be unloaded in the middle?
>>
>> Thank you,
>>
>> Andrew
>>
>>
>> "Doron Holan [MSFT]" <doronh(a)online.microsoft.com> wrote in message
>> news:uh7yfOVqIHA.4672(a)TK2MSFTNGP05.phx.gbl...
>>> you have to roll your own code to walk ksecdd's export table and resolve
>>> the exports yourself in your code at runtime. fortunately there are
>>> helper routines here in auxklib.lib. specifically
>>>
>>> AuxKlibInitialize
>>> AuxKlibQueryModuleInformation and ask for AUX_MODULE_BASIC_INFO
>>> AuxKlibGetImageExportDirectory with the ImageBase value for ksecdd from
>>> the query call
>>>
>>> and then parse/walk the IMAGE_EXPORT_DIRECTORY yourself
>>>
>>> d
>>>
>>> --
>>> Please do not send e-mail directly to this alias. this alias is for
>>> newsgroup purposes only.
>>> This posting is provided "AS IS" with no warranties, and confers no
>>> rights.
>>>
>>>
>>> "muriwai" <muriwai(a)nospam.nospam> wrote in message
>>> news:OxfsQ0EqIHA.3616(a)TK2MSFTNGP06.phx.gbl...
>>>> Hi,
>>>>
>>>> I have MyDriver.sys that can be loaded on Server 2003 and 2008. The
>>>> driver imports a function from ksecdd.sys. The function is available on
>>>> 2008 only. How do I dynamically link to ksecdd.sys?
>>>> MmGetSystemRoutineAddress doesn't work. Can I use delayed imports in a
>>>> kernel mode driver?
>>>>
>>>> Thank you,
>>>>
>>>> Andrew
>>>
>>
>