1

I recently read the book "Windows Kernel Programming" by Pavel Yosifovich. In Chapter 9 - "Object and Registry Notifications" there is a project called "The Process Protector Driver", after I finish the book I try to create this project from 0 and add my upgrades. Every time I was trying to run my driver I got the same error:

Failed to register callbacks (status=C0000022)

I thought there is something wrong with my code so I decide to copy the code from the book and try it.. but I got the same error.

I load the Driver in VirtualBox Windows 10 32-bit like this (In CMD as Administrator):

sc create protect type= kernel binPath= C:\Users\Test\Desktop\ProcessProtectorDriver.sys

sc start protect

(left side is the DbgView tool from sysinternals) enter image description here

After a few searches about this I think my Driver need to be signed, so I try to disable driver signature verification like this:

bcdedit /set testsigning on

About the project:

  • I add the /INTEGRITYCHECK to Configuration Properties -> C/C++ -> Command Line (from the book)
  • I try the Driver in Debug mode

but I got the same error..

The Process Protector Driver Project Code:

Driver: https://github.com/zodiacon/windowskernelprogrammingbook/tree/master/chapter09/ProcessProtect

Client: https://github.com/zodiacon/windowskernelprogrammingbook/tree/master/chapter09/Protect

Programmer
  • 69
  • 1
  • 7
  • you also need Include page hashes when creating signature. when called [`SignerSignEx`](https://learn.microsoft.com/en-us/windows/win32/seccrypto/signersignex) or related - `SPC_INC_PE_PAGE_HASHES_FLAG` flag must be set – RbMm Jul 17 '21 at 19:29
  • Check the directory permissions where your service is located more info here https://stackoverflow.com/questions/4267051/error-5-access-denied-when-starting-windows-service – Richard Critten Jul 17 '21 at 19:44
  • @RichardCritten - how this (*directory permissions*) related to error from `ObRegisterCallbacks` ? – RbMm Jul 17 '21 at 22:56

1 Answers1

1

my mistake was I put the /INTEGRITYCHECK in the

Configuration Properties -> C/C++ -> Command Line

instead of in the

Configuration Properties -> Linker -> Command Line

The problem solved.

Programmer
  • 69
  • 1
  • 7