1
votes

I am running a sample code from windows driver samples and it gives me the following error :

1>------ Rebuild All started: Project: ObCallbackTestCtrl, Configuration: Release x64 ------
2>------ Rebuild All started: Project: ObCallbackTest, Configuration: Release x64 ------
1>  Building 'ObCallbackTestCtrl' with toolset 'WindowsApplicationForDrivers10.0' and the 'Desktop' target platform.
1>  pchsrc.cpp
2>  Building 'ObCallbackTest' with toolset 'WindowsKernelModeDriver10.0' and the 'Desktop' target platform.
2>  pchsrc.c
2>  callback.c
1>  main.cpp
2>  tdriver.c
2>  util.c
2>  Generating Code...
1>  utils.cpp
1>  Generating Code...
2>  ObCallbackTest.vcxproj -> C:\Users\me\Desktop\obcallback\driver\x64\Release\ObCallbackTest.sys
1>  ObCallbackTestCtrl.vcxproj -> C:\Users\me\Desktop\obcallback\control\x64\Release\ObCallbackTestCtrl.exe
2>  Done Adding Additional Store
2>  Successfully signed: C:\Users\me\Desktop\obcallback\driver\x64\Release\ObCallbackTest.sys
2>
2>  Inf2Cat task was skipped as there were no inf files to process
2>
========== Rebuild All: 2 succeeded, 0 failed, 0 skipped ==========

I am not sure if its a warning or intended to be, but nothing happens when I run the program. I run the program with "-install" arguments and it doesn't give any error. Then no other commands have any effect. "-reject xyz" doesn't stop the execution of the xyz process, and "-name" "-deprotect" don't seem to work either. They don't work or throw any error either.

I have read the other related thread on the same issue but I don't have that update installed on my system. I am running Windows 7 and VS 2015. Would appreciate any help, thanks!

1

1 Answers

1
votes

You need to load the kernel-mode device driver which is used for the kernel-mode callback; the user-mode program is nothing but a a console program which will communicate with the kernel-mode device driver via IOCTL. The kernel-mode device driver is responsible for actually providing the functionality.

ObCallbackTest.sys was successfully built according to the log you posted, therefore go into your analysis environment, copy across ObCallbackTest.sys and ObCallbackTestCtrl.exe and then load ObCallbackTest.sys with the Service Manager (e.g. OSRLOADER will be fine for testing). After the kernel-mode device driver is active, run ObCallbackTestCtrl.exe with administrator rights and see if it then works.

Don't do it on your Host environment because BSOD crashes can cause data corruption, and that can have devastating effects on your real Host environment. Instead, use a physical machine for testing kernel-mode software, or a Virtual Machine. You also need to setup remote kernel debugging support so you can debug your kernel-mode software for investigation to ensure things are working as they should, and to help you diagnose the source of bugs in your device driver projects.