Adventures in Dead by Daylight (September 6th, 2016) - Part 4: Windows driver models: WDM vs. WDF

OK so on Part 3 I never finished my table of wrapping up the different acronyms and their relationships to one another in a 'pretty bow'. Let's see if we can finish that now:

WDM vs WDK (two separate approaches)

WDM (Windows Driver Model) - lower / lowest? level

WDK (Windows Drive Framework) - higher level with objects / focuses on requirements

Both have DriverEntry points, but in WDM the I/O dispatch routine maps to particular major IRP codes

In WDF the framework we register our own dispatch routines, which receives IRPs from the I/O manager, parses them, and evokes driver's event callback to deal with them

^ ok I wrote that from https://msdn.microsoft.com/en-us/windows/hardware/drivers/wdf/differences-between-wdm-and-kmdf?f=255&MSPPError=-2147217396 and I honestly don't understand it completely

What is an IRP code?

What is I/O dispatch?

What is the I/O manager?

Anyways before we get into those details let's organize the remaining acronyms:

ok wait this might make sense to me now....

WDM vs everything else

WDK is the umbrella term meaning drivers for Windows! (10/universal)

WDF is the name of the framework

UMDF is user mode part of that framework

KMDF is kermal mode part of that framework

Are there any other acronyms? Let me look at part 3.

The only other acronym I saw was UDF which is the actual universal framework for making things work on multiple Windows devices... I think the following graph is fine for my purposes:

Let me go ahead and pat myself on the back for this one. Created at www.draw.io. Looks sexy.

So which one do we choose? I'm thinking KMDF seeing as it'll be easier but I'm not sure that'll have the access I desire...

I may have talked about this a bit already (I've certainly given it thought before now) but with a better 'understanding' of the relationships let's look at "Differences Between WDM and WDF" one more time. https://msdn.microsoft.com/en-us/windows/hardware/drivers/wdf/differences-between-wdm-and-kmdf?f=255&MSPPError=-2147217396

Quotes:

WDF drivers nevertheless require significantly fewer locks and less synchronization code than do WDM drivers.
WDF supports a coherent object model in which objects are opaque to drivers, provide driver-configurable context areas, and are referenced by a handle. WDM objects are system-wide objects that are accessible to drivers and are referenced by pointers. A driver that corrupts a WDM object can corrupt the entire system. Corrupting a WDF object is not only more difficult—because the framework validates the data that the driver supplies—but also causes system-wide problems much less often.