1

I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other drivers works fine. Unfortunatelly I don't have original dropper, can it be some kind of anti debugging trick? What can be reason?

4
  • for 32-bit drivers there was KmdKit tool by Four-F, have you tried it? May 3 '18 at 8:11
  • @AntonKukoba It's 64bit driver but I tried and throws same error :/
    – spimley
    May 3 '18 at 9:43
  • Are there any messages in the Windows Event log about your driver? May 3 '18 at 10:11
  • @AntonKukoba Dump: pastebin
    – spimley
    May 3 '18 at 11:07
1

This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able to start its service. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.