I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other drivers works fine. Unfortunatelly I don't have original dropper, can it be some kind of anti debugging trick? What can be reason?

  • for 32-bit drivers there was KmdKit tool by Four-F, have you tried it? – Anton Kukoba May 3 '18 at 8:11
  • @AntonKukoba It's 64bit driver but I tried and throws same error :/ – spimley May 3 '18 at 9:43
  • Are there any messages in the Windows Event log about your driver? – Anton Kukoba May 3 '18 at 10:11
  • @AntonKukoba Dump: pastebin – spimley May 3 '18 at 11:07

This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able to start its service. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.