1

I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other drivers works fine. Unfortunatelly I don't have original dropper, can it be some kind of anti debugging trick? What can be reason?

4
  • for 32-bit drivers there was KmdKit tool by Four-F, have you tried it? May 3, 2018 at 8:11
  • @AntonKukoba It's 64bit driver but I tried and throws same error :/
    – spimley
    May 3, 2018 at 9:43
  • Are there any messages in the Windows Event log about your driver? May 3, 2018 at 10:11
  • @AntonKukoba Dump: pastebin
    – spimley
    May 3, 2018 at 11:07

1 Answer 1

1

This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able to start its service. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.