I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other drivers works fine. Unfortunatelly I don't have original dropper, can it be some kind of anti debugging trick? What can be reason?
4
-
for 32-bit drivers there was KmdKit tool by Four-F, have you tried it?– Anton KukobaMay 3, 2018 at 8:11
-
@AntonKukoba It's 64bit driver but I tried and throws same error :/– spimleyMay 3, 2018 at 9:43
-
Are there any messages in the Windows Event log about your driver?– Anton KukobaMay 3, 2018 at 10:11
-
@AntonKukoba Dump: pastebin– spimleyMay 3, 2018 at 11:07
Add a comment
|
1 Answer
This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able to start its service. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver
