Anyone using FPC for drivers development?
1. Remove all initialization code from the RTL, everything that might call any user mode API calls, or create your own minimal RTL, or find one.
2. Declare SysDriverObject and SysRegistryPath pointers somewhere in the interface of system.pp, we need them to save the parameters that the entrypoint was called with for later use in PASCALMAIN.
var
SysDriverObject: Pointer;
SysRegistryPath: Pointer;
3. Use entrypoint for DLL, just change its parameteres to take 2 params instead of 3. You see, drivers are basically DLLs that are loaded into the process "System".
function _FPC_DLLMainCRTStartup(DriverObject: Pointer; RegistryPath: Pointer): LongInt; stdcall; public name '_DLLMainCRTStartup';
begin
SysDriverObject := DriverObject;
SysRegistryPath := RegistryPath;
PASCALMAIN;
result := ExitCode;
end;
4. Create a file named "driver.lpr":
library driver;
function DbgPrint(aFormat: PAnsiChar): Integer; cdecl; varargs; external 'ntoskrnl.exe';
type
_DRIVER_OBJECT = packed record
// cut
end;
DRIVER_OBJECT = _DRIVER_OBJECT;
PDRIVER_OBJECT = ^_DRIVER_OBJECT;
procedure DriverUnload(DriverObject: PDRIVER_OBJECT); stdcall;
begin
end;
begin
DbgPrint(LineEnding);
DbgPrint('Hello World! Windows Kernel Mode Driver in FPC trunk' + LineEnding);
DbgPrint('Build time = ' + {$I %DATE%} + ' ' + {$I %TIME%} + LineEnding);
DbgPrint('FPC version = ' + {$I %FPCVERSION%} + LineEnding);
DbgPrint('FPC target = ' + {$I %FPCTARGET%} + LineEnding);
DbgPrint(LineEnding);
PDRIVER_OBJECT(SysDriverObject)^.DriverUnload := @DriverUnload;
ExitCode := 0; // STATUS_SUCCESS
end.
I removed _DRIVER_OBJECT struct to leave it as an excercise for you
The struct in the FPC sources is correct only for x86. Actually the whole NativeNT source is full of bugs and is not suitable for use in x64.
5. Open driver.lpr in Lazarus and compile
6. Create a service for the driver, I named mine "fpcd" and put the compiled DLL file in C:\fpcd\fpcd.sys
sc create fpcd type= kernel start= demand binPath= "C:\fpcd\fpcd.sys"
7. Start the service
In Windows 32 bit it works fine.
For Windows 64 bit either enable TestSigning, or there are few ways to bypass the signature validation. A great literature:
https://www.geoffchappell.com/notes/windows/license/customkernelsigners.htmPerhaps I will create a github repo with all the information needed? Any interest in this?
Recent
