Adventures in Dead by Daylight (September 6th, 2016) - Part 4
OK so on Part 3 I never finished my table of wrapping up the
different acronyms and their relationships to one another in a
'pretty bow'. Let's see if we can finish that now:
WDM vs WDK (two separate approaches)
WDM (Windows Driver Model) - lower / lowest? level
WDK (Windows Drive Framework) - higher level with objects /
focuses on requirements
Both have DriverEntry points, but in WDM the I/O dispatch
routine maps to particular major IRP codes
In WDF the framework we register our own dispatch
routines, which receives IRPs from the I/O manager, parses them,
and evokes driver's event callback to deal with them
^ ok I wrote that from https://msdn.microsoft.com/en-us/windows/hardware/drivers/wdf/differences-between-wdm-and-kmdf?f=255&MSPPError=-2147217396 and
I honestly don't understand it completely
What is an IRP code?
What is I/O dispatch?
What is the I/O manager?
Anyways before we get into those details let's organize the
remaining acronyms:
ok wait this might make sense to me now....
WDM vs everything else
WDK is the umbrella term meaning drivers for Windows!
(10/universal)
WDF is the name of the framework
UMDF is user mode part of that framework
KMDF is kermal mode part of that framework
Are there any other acronyms? Let me look at part 3.
The only other acronym I saw was UDF which is the actual
universal framework for making things work on multiple Windows
devices... I think the following graph is fine for my
purposes:
Let me go ahead and pat myself on the back for this one.
Created at www.draw.io. Looks sexy.
So which one do we choose? I'm thinking KMDF seeing as it'll
be easier but I'm not sure that'll have the access I
desire...
I may have talked about this a bit already (I've certainly
given it thought before now) but with a better 'understanding' of
the relationships let's look at "Differences Between WDM and
WDF" one more time. https://msdn.microsoft.com/en-us/windows/hardware/drivers/wdf/differences-between-wdm-and-kmdf?f=255&MSPPError=-2147217396
Quotes:
- WDF drivers nevertheless require significantly fewer locks and less synchronization code than do WDM drivers.
- WDF supports a coherent object model in which objects are opaque to drivers, provide driver-configurable context areas, and are referenced by a handle. WDM objects are system-wide objects that are accessible to drivers and are referenced by pointers. A driver that corrupts a WDM object can corrupt the entire system. Corrupting a WDF object is not only more difficult—because the framework validates the data that the driver supplies—but also causes system-wide problems much less often.