What is a Windows Kernel Driver?

winapi wdk
userbb picture userbb · May 15, 2011 · Viewed 34k times · Source

What is Windows Kernel Driver written with the WDK?

What is different from normal app or service?

Answer

Billy ONeal picture Billy ONeal · May 15, 2011

Kernel drivers are programs written against Windows NT's native API (rather than the Win32 Subsystem's API) and which execute in kernel mode on the underlying hardware. This means that a driver needs to be able to deal with switching virtual memory contexts between processes, and needs to be written to be incredibly stable -- because kernel drivers run in kernel mode, if one crashes, it brings down the entire system. Kernel drivers are unsuitable for anything but hardware devices because they require administrative access to install or start, and because they remove the security the kernel normally provides to programs that crash -- namely, that they crash themselves and not the entire system.

Long story short:

  • Drivers use the native API rather than the Win32 API
    • This means that drivers generally cannot display any UI.
  • Drivers need to manage memory and how memory is paged explicitly -- using things like paged pool and nonpaged pool.
  • Drivers need to deal with process context switching and not depend on which process happens to have the page table while they're running.
  • Drivers cannot be installed into the kernel by limited users.
  • Drivers run with privileged rights at the processor level.
  • A fault in a user-level program results in termination of that program's process. A fault in a driver brings down the system with a Blue Screen of Death.
  • Drivers need to deal with low level hardware bits like Interrupts and Interrupt Request Levels (IRQLs).

Related questions

Is it possible to "decompile" a Windows .exe? Or at least view the Assembly?

A friend of mine downloaded some malware from Facebook, and I'm curious to see what it does without infecting myself. I know that you can't really decompile an .exe, but can I at least view it in Assembly or attach …

Read More
How to provide user name and password when connecting to a network share

When connecting to a network share for which the current user (in my case, a network enabled service user) has no rights, name and password have to be provided. I know how to do this with Win32 functions (the WNet* …

Read More
What exactly are DLL files, and how do they work?

How exactly do DLL files work? There seems to be an awful lot of them, but I don't know what they are or how they work. So, what's the deal with them?

Read More