Windows Kernel Programming Book Review

Table of contents

  1. Introduction
  2. High Level Overview
    1. Chapter 1: Windows Internals Overview
    2. Chapter 2: Getting Started with Kernel Development
    3. Chapter 3: Kernel Programming Basics
    4. Chapter 4: Driver from Start to Finish
    5. Chapter 5: Debugging
    6. Chapter 6: Kernel Mechanisms
    7. Chapter 7: The I/O Request Packet
    8. Chapter 8: Process and Thread Notifications
    9. Chapter 9: Object and Registry Notifications
    10. Chapter 10: Introduction to File System Mini-Filters
    11. Chapter 11: Miscellaneous Topics
  3. A word on Creating Drivers of Select Exercises

  4. Exercise 1: Create a driver that monitors process creation and allows a client application to configure executable paths that should not be allowed to execute.

    1. Understanding Process Notifications
    2. Setting up Process Create Notifications
    3. User Mode Client
    4. Summary
  5. Exercise 2: Implement a driver that protects a registry key from modifications. A client can send the driver registry keys to protect or unprotect.

    1. Understanding Registry Notifications
    2. Setting Up Registry Pre-Notifications
    3. User Mode Client
    4. Summary
  6. Exercise 3: Write a file system mini-filter that captures delete operations from cmd.exe and instead of deleting them, moves the files to the recycle bin

    1. Understanding Processing I/O Operations and Pre-Operation Callbacks
    2. Implementing Overall Filter Registration
    3. Handling Pre-Operation Callbacks
    4. User Mode Client #1 – Manages Protected Executable Names
    5. User Mode Client #2 – Testing the Deletion Methods
    6. Summary
  7. Conclusion

  8. Special Thanks

  9. References


Windows Kernel Programming by Pavel Yosifovich @zodiacon is an incredible and excellent technical book. My interest in kernel programming and development was ignited by the more recent and cool projects developed by the InfoSec community. The book in my opinion easily earns 9 out of 10 stars.

I already had decent experience with user mode windows C++ development so jumping into this book was a no brainer for me. The author does a fantastic job of pacing the book and completely breaks down the explanations and code examples. Even through complex scenarios, the book excels in dissecting these concepts into step-by-step digestible pieces of information for complete beginners. The book is fairly cheap on Leanpub and the content is also worth the price. If you’re thinking of diving in you can take a look at the Book Reviews on Amazon.

High Level Overview

Chapter 1: Windows Internals Overview

This chapter provides an overview of Windows Internals concepts that will be used throughout the book. These concepts are Virtual Memory, Threads, Processes. Services, Handles, Objects, System Services and General System Architecture. For a more better and through understanding of these concepts, the author has a Windows Internals Course Series on PluralSight.

Chapter 2: Getting Started with Kernel Development

This chapter deals with the fundamentals of getting started with kernel development and setting up a driver development environment. I also wrote a minimalistic kernel driver to prove the driver development was set and ready to go for the coming sections. My development environment matched the setup described in this chapter.

Chapter 3: Kernel Programming Basics

This section digs deeper into kernel APIs, structures and definitions. Mechanisms that invoke code in a driver are also introduced. General kernel programming guidelines were also introduced and covered.

Chapter 4: Driver from Start to Finish

Using all the knowledge from the previous chapters, this chapter walks you through writing your first functional windows driver. The driver includes a complete driver and client application. This driver demonstrated the powerful capabilities of running code in kernel mode as opposed to user mode. I won’t spoil the rest.

Chapter 5: Debugging

This section introduces kernel debugging of drivers and how to debug using the WinDbg debugger. It also covers Local and Full kernel debugging and the advantages and disadvantages of both. Setting up both debugging lab instances was particularly useful and nifty especially when dealing with my own bugs down the line.

Chapter 6: Kernel Mechanisms

Various mechanisms the Windows Kernel Provides are discussed in this chapter. Some are particularly useful when writing the drivers and others when debugging. Some of these include but are not limited to Interrupt Request Level, Deferred Procedure Calls and Thread Synchronization.

Chapter 7: The I/O Request Packet

The chapter deals with how a driver handles requests. These requests are packaged as the semi-documented I/O Request Packet (IRP) structure. Dispatch Routines, Accessing User Buffers and the I/O Stack Location are also introduced and covered. Finally, a driver to consolidate more of what was learned was put together.

Chapter 8: Process and Thread Notifications

This is a sub paragraph, formatted in heading 3 style

Chapter 9: Object and Registry Notifications

In this section, intercepting some types of operations are covered. First, object notifications, where obtaining handles to some types of objects can be intercepted are explained. Second, how to intercept Registry Operations and control Registry Access are explained and covered.

Chapter 10: Introduction to File System Mini-Filters

This chapter deals with drivers that can intercept calls destined to the file system. This was the largest chapter in the book and it took some time to get through and understand most of the concepts. I’d also add this chapter needs a few re-reads to make all the concepts sink in and solidify.

Chapter 11: Miscellaneous Topics

Finally, this section contained various driver development techniques and other miscellaneous topics that didn’t fit well with the chapters so far. My favorite by far was Filter Drivers which could monitor other types of devices (not to be confused with File System Mini-Filters).

A word on Creating Drivers of Select Exercises

I did a couple of the exercises the book offered to solidify my knowledge. I also decided to document three of them to show fellow beginners in kernel development what’s possible when dedication and commitment are applied when reading this book. By far these examples are far from perfect. Some possibly contain bugs but I did my best to put most of the code in a functional and working state. The next three sections cover these exercises. The first one is below.

Exercise 1: Create a driver that monitors process creation and allows a client application to configure executable paths that should not be allowed to execute.

Kernel drivers have the ability to be notified when certain important events occur. One of these events is Process Creation. This driver’s main purpose is to prevent executables located in configured file paths from executing. The Driver will keep a list of protected paths in a simple limited array.

Understanding Process Notifications

A driver can register for Process Creation and/or Process Exit notifications. We’ll mainly be dealing with process creation. Drivers have the power to stop a process from being created, returning an error to the caller initiating the process creation. The PsSetCreateProcessNotifyRoutineEx API is used for registering for process notifications. We can see its syntax below:

 NTSTATUS PsSetCreateProcessNotifyRoutineEx(
   BOOLEAN                           Remove

The first argument is the Driver’s callback Notify Routine having the following syntax:


 void PcreateProcessNotifyRoutineEx(
   PEPROCESS Process,
   HANDLE ProcessId,

The second argument indicates whether the driver is registering or unregistering the callback. The API will be called with FALSE in its DriverEntry routine and call the same API with TRUE in its unload routine. The first argument is a pointer to an EPROCESS structure that represents the process that’s newly created or exited. The second argument is ProcessID which is the Process ID of the process. The third argument is CreateInfo which is a pointer to a PS_CREATE_NOTIFY_INFO structure that contains information about the new process. We can see how it’s defined:

 typedef struct _PS_CREATE_NOTIFY_INFO {
   SIZE_T              Size;
   union {
     ULONG Flags;
     struct {
       ULONG FileOpenNameAvailable : 1;
       ULONG IsSubsystemProcess : 1;
       ULONG Reserved : 30;
   HANDLE              ParentProcessId;
   CLIENT_ID           CreatingThreadId;
   struct _FILE_OBJECT *FileObject;
   PCUNICODE_STRING    ImageFileName;
   PCUNICODE_STRING    CommandLine;
   NTSTATUS            CreationStatus;

The important fields in the structure are:

Setting up Process Create Notifications

In the DriverEntry we register for process notifications and this routine is called OnProcessNotify and can be found on the ZeroDawn.cpp file:

 status = PsSetCreateProcessNotifyRoutineEx(OnProcessNotify, FALSE);
 if (!NT_SUCCESS(status)) {
 	KdPrint((DRIVER_PREFIX "failed to register process callback (0x%08X)\n", status));

Then we checkout the callback routine:

void OnProcessNotify(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) {

  if (CreateInfo) {
    if (CreateInfo->FileOpenNameAvailable && CreateInfo->ImageFileName)
      KdPrint(("ImageFilePath: %wZ\n", CreateInfo->ImageFileName));
      AutoLock locker(DirNamesLock);
      if (FindDirectory(CreateInfo->ImageFileName, true) >= 0) {
        KdPrint(("File not allowed to Execute: %ws\n", CreateInfo->ImageFileName->Buffer));
	CreateInfo->CreationStatus = STATUS_ACCESS_DENIED;
      else {
	KdPrint(("File Allowed to Execute: %ws\n", CreateInfo->ImageFileName->Buffer));
  // ProcessExit
  else {


The callback first checks if CreateInfo exists. It doesn’t exist for processes that are exiting. If it does exist, we then check for the ImageFileName using the FileOpenNameAvailable member. If the ImageFileName exists we can then acquire a mutex so our operations are protected. A helper function called FindDirectory is used to check if the ImageFileName is protected. If it’s part of the directory names protected, we block its creation by returning STATUS_ACCESS_DENIED via the CreationStatus. If it’s not part of the protected list, it’s allowed to execute.

User Mode Client

To configure which executable paths which are blocked or unblocked, a user mode client that communicates with the EDR driver was created. It allows you to add executable paths to a simple limited array, where these paths are kept in the kernel. For every process created, the driver gets an in-line notification. The driver examines its array and if the executable path is part of the protected list in the array it’s blocked. It’s not a perfect, feel free to use the code and improve upon it. By default, up to 4 executable paths are protected. We can install the driver and then start it:

sc create zerodawn type= kernel binPath= C:\Code\ZeroDawn.sys

sc start zerodawn


We can see a sample run of the client and the options it offers:


Initially, we can see a copied cmd.exe can execute a command from a folder C:\Temp:


And then we add C:\Temp path to prevent execution from it. When we try to execute the cmd again from this folder, we get a sweet Access is Denied:


Similarly, we can add another folder. Execution of an executable is blocked from that folder too as shown below:


A file path can be removed or we can clear all paths. Clearing all paths is demonstrated below leading to both protected folders being unprotected:



This was an awesome exercise to learn more about Process Notifications and how to save data from user mode clients using simple limited arrays. There are far more superior ways of doing this but for purposes of this proof of concept it was amazing seeing this driver in action. The driver has a flaw in that its case insenstive. A method to overcome this is described well in the book.

Exercise 2: Implement a driver that protects a registry key from modifications. A client can send the driver registry keys to protect or unprotect.

Kernel drivers have the ability to intercept certain operations. Object notifications are where obtaining handles to some types of objects can be intercepted e.g. process, thread and for Windows 10 – desktop. For Registry entries, the Configuration Manager (the part in the Executive that deals with the registry) can be used to register for notifications when registry keys are accessed.

Understanding Process Notifications

This exercise dealt with intercepting registry operations, specifically registry modifications. The API we used was CmRegisterCallbackEx and we can see it’s prototype:

 NTSTATUS CmRegisterCallbackEx(
   PCUNICODE_STRING      Altitude,
   PVOID                 Driver,
   PVOID                 Context,
   PLARGE_INTEGER        Cookie,
   PVOID                 Reserved

It’s function is to register a RegistryCallback Routine. The Result of a successful registration is passed to the Cookie parameter. We can see the syntax for the RegistryCallback Routine:


 NTSTATUS ExCallbackFunction(
   PVOID CallbackContext,
   PVOID Argument1,
   PVOID Argument2

CallbackContext is the Context argument passed to CmRegisterCallbackEx. The first argument is in fact an enumeration, REG_NOTIFY_CLASS, describing the operation for which the callback is invoked, if it’s pre or post notification. The second argument is a pointer to a structure that contains information that is specific to the type of registry operation.

To unregister a callback, CmUnRegisterCallback routine is called.

 NTSTATUS CmUnRegisterCallback(

Setting Up Registry Pre-Notifications

The notification we are specifically interested in, per the REG_NOTIFY_CLASS enumeration is the RegNtPreSetValueKey Notification. The driver has several options of handling the callbacks before they are carried out by the Configuration Manager. The option we’ll use is to handle the request, check if our key is being modified in some way and return STATUS_CALLBACK_BYPASS from the callback. Now that we know what we need to do, we can implement the Registry Pre-Notification. In the driver’s DriverEntry we’ll add the registry callback registration. The returned cookie representing the registration is stored in our Globals structure:

 status = CmRegisterCallbackEx(OnRegistryNotify, &altitude, DriverObject, nullptr, &g_Globals.RegCookie, nullptr);
 if (!NT_SUCCESS(status)) {
	KdPrint((DRIVER_PREFIX "failed to set registry callback (status=%08X)\n", status));

In the unload routine, we need to unregister the callback:

 void DriverUnload(_In_ PDRIVER_OBJECT DriverObject)
 	// unregister callbacks
	auto status = CmUnRegisterCallback(g_Globals.RegCookie);
	if (!NT_SUCCESS(status)) {
		KdPrint(("failed on CmUnRegisterCallback (0x%08X)\n", status));

 	// Snipped

Our Callback only cares about modifications done to certain registry keys. To do this, we have to make sure we switch onto the operation of interest i.e. RegNtPreSetValueKey Notification:

 NTSTATUS OnRegistryNotify(PVOID, PVOID arg1, PVOID arg2) {

	auto status = STATUS_SUCCESS;

	switch ((REG_NOTIFY_CLASS)(ULONG_PTR)arg1) {
	case RegNtPreSetValueKey: 
	return status;

Inside the case, we cast the second argument to the pre operation data and check if the operation succeeded and if it didn’t, we break:

 auto preInfo = static_cast<PREG_SET_VALUE_KEY_INFORMATION>(arg2);
 PCUNICODE_STRING keyName = nullptr;
 if (!NT_SUCCESS(CmCallbackGetKeyObjectID(&g_Globals.RegCookie, preInfo->Object, nullptr, &keyName))) {

Next, we acquire the FastMutex so that no other operations will interfere as we try to check if a registry is protected or not. The Registry Keys to protect, are received from the client and are stored in a Linked List. We enumerate over the Linked List using a for loop. We’ll extract the key name with CmCallbackGetKeyObjectIDEx. For every key name, we’ll first convert it to Unicode string and then compare it using RtlInitUnicodeString. If the compared Unicode key names are equal to each other, we block the modification and return STATUS_CALLBACK_BYPASS. For the unmatched keys, return STATUS_SUCCESS:

 for (auto i = 0; i < g_Globals.ItemCount; i++)
 	auto entry = RemoveHeadList(&g_Globals.ItemsHead);
	auto info = CONTAINING_RECORD(entry, FullItem<RegKeyProtectInfo*>, Entry);
	auto kName = (WCHAR*)&info->Data;

	RtlInitUnicodeString(&tbcName, kName);

	if (RtlCompareUnicodeString(keyName, &tbcName, TRUE) == 0)
		KdPrint(("Found a Matching Protected key. Blocking Any Modification Attempts."));
		InsertTailList(&g_Globals.ItemsHead, entry);
	InsertTailList(&g_Globals.ItemsHead, entry);

return status;

User Mode Client

To configure which registry keys which are protected or unprotected a user mode client that communicates with the driver was created like in the previous exercise. It allows you to add registry keys to a doubly-linked list. For every registry key, the driver gets an in-line notification. The driver examines this doubly linked list and if the executable registry key to be modified is part of this list, the modification is blocked. Otherwise, the other unprotected registry key operations are not interfered with. It’s also not a perfect like the previous example. By default, up to 10 registry keys are protected.

We can install and start the driver like in the previous exercise:

sc create RegistryProtector type= kernel binPath= C:\Code\RegistryProtector.sys

sc start RegistryProtector


The client called RP-Client application adds, removes or clears registry keys to protect by issuing correct DeviceIoControl calls. We can add a registry key to protect:


We try modifying the value of the registry key using regedit by adding a + to it:


We press OK and the operation is intercepted and blocked, even though in the GUI it looks like it worked:


After a refresh, we see the value of the registry key hasn’t changed one bit:


We can remove the protected registry key as shown:


We can add multiple registry keys and remove them using the clear function:



This was a really nice challenge to learn more about Registry Pre-Notifications and how to incorporate Linked Lists into my code and how they handle data and overall workflow when managing such data from user mode clients.

Exercise 3: Write a file system mini-filter that captures delete operations from cmd.exe and instead of deleting them, moves the files to the RecycleBin.

File system filtering is the mechanism by which drivers can intercept calls destined to the file system. This is useful for software such as AVs and EDRs. In this driver, I extended it a bit and decided to add options to add more than one blacklisted executable name from which to intercept delete operations from other than just cmd.exe. The executable names are stored in a simple limited array. The maximum it can hold is around 32 names.

Understanding Processing I/O Operations and Pre-Operation Callbacks

The main function of a file system mini-filter is processing I/O operations by implementing pre and/or post callbacks for the operations of interest. Pre operations allow a mini-filter to reject an operation completely. In this case Pre-Operation Callbacks are used to capture delete operations from cmd.exe and move the deleted files instead to the Recycle Bin.

All Pre-Operation callbacks have the same prototype:


 FLT_PREOP_CALLBACK_STATUS PfltPreOperationCallback(
   PVOID *CompletionContext

The first argument is Data is a pointer to the callback data (FLT_CALLBACK_DATA) structure for the I/O operation. It provides all information related to the I/O itself. The FLT_CALLBACK_DATA structure is defined as shown:

 typedef struct _FLT_CALLBACK_DATA {
   PETHREAD                    Thread;
   IO_STATUS_BLOCK             IoStatus;
   struct _FLT_TAG_DATA_BUFFER *TagData;
   union {
     struct {
       LIST_ENTRY QueueLinks;
       PVOID      QueueContext[2];
     PVOID FilterContext[4];
   KPROCESSOR_MODE             RequestorMode;

The members of note are:

 typedef struct _FLT_IO_PARAMETER_BLOCK {
   ULONG          IrpFlags;
   UCHAR          MajorFunction;
   UCHAR          MinorFunction;
   UCHAR          OperationFlags;
   UCHAR          Reserved;
   PFILE_OBJECT   TargetFileObject;
   PFLT_INSTANCE  TargetInstance;
   FLT_PARAMETERS Parameters;

The notable members are: + TargetFileObject is the file object that is the target of this I/O operation.

The second argument to the pre-callback is another structure of type FLT_RELATED_OBJECTS. It’s defined as shown:

 typedef struct _FLT_RELATED_OBJECTS {
   USHORT        Size;
   USHORT        TransactionContext;
   PFLT_FILTER   Filter;
   PFLT_VOLUME   Volume;
   PFLT_INSTANCE Instance;
   PFILE_OBJECT  FileObject;
   PKTRANSACTION Transaction;

The FileObject field is the same one accessed through the I/O parameter block’s TargetFileObject Field. The third argument to the pre-callback is a context value that can be set by the driver.

Implementing Overall Filter Registration

First, we need to register the operations callback. Our mini-filter driver must indicate which operations it’s interested in. This is done at registration time with an array of FLT_OPERATION_REGISTRATION structures. We can see the definition:

   UCHAR                            MajorFunction;
   PVOID                            Reserved1;

We are interested in certain pre operations involving delete. Here’s the initialized array of FLT_OPERATION_REGISTRATION structures will be called Callbacks:

	{ IRP_MJ_CREATE, 0, DelProtectPreCreate, nullptr },
	{ IRP_MJ_SET_INFORMATION, 0, DelProtectPreSetInformation, nullptr },

Now that we’ve setup the array, the registration for the driver is shown below without any contexts:

 CONST FLT_REGISTRATION FilterRegistration = {

	0,                       //  Flags
	nullptr,                 //  Context
	Callbacks,               //  Operation callbacks
	DelProtectUnload,                   //  MiniFilterUnload
	DelProtectInstanceSetup,            //  InstanceSetup
	DelProtectInstanceQueryTeardown,    //  InstanceQueryTeardown
	DelProtectInstanceTeardownStart,    //  InstanceTeardownStart
	DelProtectInstanceTeardownComplete, //  InstanceTeardownComplete


With all that finished, all we need to do is to start filtering in the driver’s DriverEntry. A mini-filter driver must register itself as a mini-filter with the filter manager, specifying various settings, such as what operations it wishes to intercept. Having done the necessary initializations above, we can call FltRegisterFilter to register. Here’s its:

 NTSTATUS FLTAPI FltRegisterFilter(
   PDRIVER_OBJECT         Driver,
   const FLT_REGISTRATION *Registration,
   PFLT_FILTER            *RetFilter

If successful, the driver can do further initializations as needed and finally call FltStartFiltering to actually start filtering operations. We can see the registration for our driver’s implementation:

 status = FltRegisterFilter(DriverObject, &FilterRegistration, &gFilterHandle);

 if (!NT_SUCCESS(status))

Then start filtering:

status = FltStartFiltering(gFilterHandle);

Handling Pre-Operation Callbacks

For this section, I’ll only cover handling PreSetInformation. All the callbacks have the same prototype:


First, we’ll check if the operation is originating from kernel mode, and if so, just let it continue uninterrupted:

 if (Data->RequestorMode == KernelMode)

Next, we need to check if this is a delete operation. This is done using the parameter’s union by accessing the correct structures. The FileDispositionInformation enumeration value indicates a delete operation. The FileDispositionInformationEx is similar and undocumented, but is used internally by the user mode DeleteFile function, so we check for both:

 auto& params = Data->Iopb->Parameters.SetFileInformation;

 if (params.FileInformationClass != FileDispositionInformation && params.FileInformationClass != FileDispositionInformationEx) {
	// not a delete operation

If it is a delete operation, we check the information buffer which is of type FILE_DISPOSITION_INFORMATION for delete operations and checking the Boolean stored there:

 auto info = (FILE_DISPOSITION_INFORMATION*)params.InfoBuffer;
 if (!info->DeleteFile)

Finally, we are in a delete operation. We need to figure out from which process where the delete operation originated from i.e. check if it’s from a blacklisted executable name. We do this by combining ObOpenObjectByPointer to get a handle to the process and then call ZwQueryInformationProcess to query for the process’ image file name, and see if it’s from a blacklisted executable name:

 auto process = PsGetThreadProcess(Data->Thread);

 HANDLE hProcess;
 auto status = ObOpenObjectByPointer(process, OBJ_KERNEL_HANDLE, nullptr, 0, nullptr, KernelMode, &hProcess);
 if (!NT_SUCCESS(status))


 auto size = 512;	
 auto processName = (UNICODE_STRING*)ExAllocatePool(PagedPool, size);
 if (processName) {
 	RtlZeroMemory(processName, size);	// ensure string will be NULL-terminated
	status = ZwQueryInformationProcess(hProcess, ProcessImageFileName, processName, size - sizeof(WCHAR), nullptr);

	if (NT_SUCCESS(status) && processName->Length > 0) {
		KdPrint(("Delete operation from %wZ\n"));
		auto exeName = ::wcsrchr(processName->Buffer, L'\\');

Next we call FltGetFileNameInformation API that can return the correct file name information for the file being deleted with the assistance of FltParseFileNameInformation:

status = FltGetFileNameInformation(Data, FLT_FILE_NAME_QUERY_DEFAULT | FLT_FILE_NAME_NORMALIZED, &nameInfo);
if (!NT_SUCCESS(status)) 

status = FltParseFileNameInformation(nameInfo);
if (!NT_SUCCESS(status))

Next, we’ll need to get the DOS file name. First, we get the target file’s dos name. We’ll be using the IoQueryFileDosDeviceName which retrieves the MS-DOS device name. This device name is filled in on successful return from the IoQueryFileDosDeviceName call in the newly allocated OBJECT_NAME_INFORMATION structure pointed to by ObjectNameInformation:

POBJECT_NAME_INFORMATION ObjectNameInformation = nullptr;
IoQueryFileDosDeviceName(Data->Iopb->TargetFileObject, &ObjectNameInformation);
KdPrint(("Dos Letter Name: %wZ\n", ObjectNameInformation->Name));

Then we allocate space the name for the target file name which we’ll then “build” into a proper DOS file name:

auto dosName = ObjectNameInformation->Name;
auto NameLength = (USHORT)dosName.MaximumLength + Data->Iopb->TargetFileObject->FileName.MaximumLength + 2;
auto NameBuffer = ExAllocatePoolWithTag(PagedPool, NameLength, DRIVER_TAG);
if (NameBuffer == nullptr) {
	KdPrint(("Failed to allocate memory\n"));

NameString.Length = 0;
NameString.MaximumLength = (USHORT)NameLength;
NameString.Buffer = (PWCH)NameBuffer;

RtlCopyUnicodeString(&NameString, &symString);

RtlAppendUnicodeStringToString(&NameString, &ObjectNameInformation->Name);
KdPrint(("Full Source Path Name: %wZ\n", &NameString))

Once, we get the target file name we’ll build the full destination name as it appears after the file has been transferred to the recycle bin:

// Get DestinationFile DosName
auto destNameLength = (USHORT)dosName.MaximumLength + Data->Iopb->TargetFileObject->FileName.MaximumLength + 2 + 5; //We'll add .bkup at the end of the file extension
auto destNameBuffer = ExAllocatePoolWithTag(PagedPool, destNameLength, DRIVER_TAG);
if (destNameBuffer == nullptr) {
	KdPrint(("Failed to allocate memory\n"));

UNICODE_STRING destNameString;
destNameString.Length = 0;
destNameString.MaximumLength = (USHORT)destNameLength;
destNameString.Buffer = (PWCH)destNameBuffer;


RtlCopyUnicodeString(&destNameString, &binString);
RtlAppendUnicodeStringToString(&destNameString, &nameInfo->FinalComponent);

KdPrint(("Full Destination Recycle Path Name: %wZ\n", &destNameString));

Once we have both file names, we can simply copy the file to the Recycle Bin.

status = ntCopyFile(NameString, destNameString);
if (!NT_SUCCESS(status))
	KdPrint(("ntCopyFile() failed:%x\n", status));

Then we cleanup and free all the memory that we used:

ExFreePoolWithTag(NameBuffer, DRIVER_TAG);
ExFreePoolWithTag(destNameBuffer, DRIVER_TAG);

We then let the file be deleted and complete the pre operation:

		  Data->IoStatus.Status = STATUS_SUCCESS;
		  returnStatus = FLT_PREOP_COMPLETE;

    return returnStatus;

We can install the driver using it’s INF file and load the driver as shown:


User Mode Client #1 – Manages Protected Executable Names

This user mode client is used to add executable names that are monitored by the driver. To achieve that it uses 3 device control codes exposed by the driver: to add, remove and clear executable names from being monitored. The name for this client is ProtectExeConfig. I’m pretty sure you can come up with a better name. The commands to control it are below:

ProtectExeConfig.exe add DeleteTest.exe
ProtectExeConfig.exe remove DeleteTest.exe
ProtectExeConfig.exe clear

We’ll see it’s use in the next section.

User Mode Client #2 – Testing the Deletion Methods

Internally, there are only two ways to delete a file - IRP_MJ_CREATE with the FILE_DELETE_ON_CLOSE flag and IRP_MJ_SET_INFORMATION with FileDispositionInformation. This client is called DeleteTest and it tests both methods. First, we can see the file being deleted from cmd.exe using the del command:


We then add cmd.exe using ProtectExeConfig to the monitored executable name list:


We can see it’s a file it backed up to the Recycle Bin when we try to delete it from cmd.exe:


Finally, we can add DeleteTest to test it if can detect deletions from other processes:


We can see the options DeleteTest offers:


And we can see testing of the Delete method via IRP_MJ_SET_INFORMATION with FileDispositionInformation:


And the second delete option via IRP_MJ_CREATE with the FILE_DELETE_ON_CLOSE flag:



This was the largest chapter and the most time-consuming chapter to complete and grasp. However, it was well worth it. Extending this driver beyond the exercise handed out by the book an awesome and intense learning experience.


The sections discussing the exercises are written mostly for people who’ve gone through the entire book and got stuck while doing the exercises or those who just want to compare their solutions to alternative ones. This post is just a teaser of what’s possible while operating in kernel mode. I seriously couldn’t recommend this book enough.

Special Thanks

Special thanks to for reviewing my post.


Coming soon