Tracking driver load and unload on windows OS

1. A method for a kernel driver in an operating system to detect loading of images into memory and unloading of the images from memory, the method comprising:

registering a callback routine for load-image notifications;

receiving a load-image notification for an image and recording loading of the image;

storing original code at an entry point of the image and patching redirect stub code over the original code at the entry point;

receiving, from the redirect stub code, a redirected call to the entry point to execute a routine in the image, the redirected call identifying a driver object representing the image;

determining if the image is a kernel-mode image of a specified type after receiving the redirected call to the entry point to execute the routine in the image;

based on the driver object, in response to determining the image is the kernel-mode image of the specified type, providing a mechanism to intercept unloading of the image; and

in response to the mechanism intercepting the unloading of the image, recording the unloading of the image.

2. The method of claim 1 , further comprising:

creating a data structure to store the entry point and the original code at the entry point; and

determining a size of the redirect stub code prior to storing the original code at the entry point, wherein the original code at the entry point comprising the same size as the redirect stub code.

3. The method of claim 1 , further comprising, unpatching the redirect stub code in the image with the original code at the entry point prior to determining if the image is the kernel-mode drivcrimage of the specified type.

4. The method of claim 3 , further comprising calling to the entry point with parameters from the redirected call to execute the routine in the image after unpatching the redirect stub code.

5. The method of claim 3 , wherein determining if the image is the kernel-mode drivcrimage of the specified type comprises analyzing semantics of the redirected call.

6. The method of claim 1 , wherein patching the redirect stub code over the original code at the entry point comprises identifying an empty space in code sections of the image, inserting the redirect stub code in the empty space, and modifying a pointer to the entry point in a header of the image to point the redirect stub code.

7. The method of claim 1 , wherein:

providing the mechanism to intercept unloading of the image comprises:

storing an original pointer to an unload routine from the driver object and patching a redirect pointer to the kernel driver over the original pointer in the drive object; and

receiving a call to unload the image; and

recording the unloading of the image is performed in response to the call to unload the image.

8. The method of claim 7 , further comprising:

unpatching the redirect pointer in the driver object with the original pointer; and

calling the original unload routine in the image with parameters from the call to unload the image.

9. The method of claim 1 , wherein:

providing the mechanism to intercept unloading of the image comprises:

storing an original unload routine from the image and patching an unload stub code over the original unload routine in the image; and

receiving, from the unload stub code, a redirected call to unload the image; and

recording the unloading of the image is performed in response to the redirected call to unload the image.

10. The method of claim 9 , further comprising:

unpatching the unload stub code in the image with the original unload routine; and

calling the original unload routine in the image with parameters from the redirected call to unload the image.

11. The method of claim 1 , further comprising:

walking driver objects in an object manager namespace; and

for each driver object, providing a mechanism to intercept unloading of a corresponding image.

12. A non-transitory, computer-readable storage medium encoded with instructions executable by a processor to provide a kernel driver in an operating system to detect loading of images into memory and unloading of the images from memory, the instructions comprising:

registering a callback routine for load-image notifications;

receiving a load-image notification for an image and recording loading of the image;

storing original code at an entry point of the image and patching redirect stub code over the original code at the entry point;

receiving, from the redirect stub code, a redirected call to the entry point to execute a routine in the image, the redirected call identifying a driver object representing the image;

determining if the image is a kernel-mode image of a specified type after receiving the redirected call to the entry point to execute the routine in the image;

based on the driver object, in response to determining the image is the kernel-mode image of the specified type, providing a mechanism to intercept unloading of the image; and

in response to the mechanism intercepting the unloading of the image, recording the unloading of the image.

13. The storage medium of claim 12 , wherein the instructions further comprise:

creating a data structure to store the entry point and the original code at the entry point; and

determining a size of the redirect stub code prior to storing the original code at the entry point, wherein the original code at the entry point comprising the same size as the redirect stub code.

14. The storage medium of claim 12 , wherein the instructions further comprise:

unpatching the redirect stub code in the image with the original code at the entry point prior;

calling to the entry point with parameters from the redirected call to execute the routine in the image; and

after unpatching the redirect stub code, determining if the image is the kernel-mode image of the specified type.

15. The storage medium of claim 12 , wherein patching the redirect stub code over the original code at the entry point comprises identifying an empty space in code sections of the image, inserting the redirect stub code in the empty space, and modifying a pointer to the entry point in a header of the image to point the redirect stub code.

16. The storage medium of claim 12 , wherein the instructions further comprise:

providing the mechanism to intercept unloading of the image comprising:

storing an original pointer to an unload routine from the driver object or the unload routine from the image;

patching a redirect pointer to the kernel driver over the original pointer in the driver object or an unload stub code over the unload routine in the image;

receiving a call to unload the image;

unpatching the redirect pointer in the driver object with the original pointer or the unload stub code in the image with the unload routine; and

calling the unload routine in the image with parameters from the call to unload the image; and

recording the unloading of the image is performed in response to the call to unload the image.

17. The storage medium of claim 12 , wherein the instructions further comprise:

walking driver objects in an object manager namespace; and

for each driver object, providing a mechanism to intercept unloading of a corresponding image.

18. A computer system, comprising:

a main memory;

a secondary memory storing an operating system and a kernel driver for the operating system;

a processor loading the kernel driver from secondary memory to main memory and executing the kernel driver to:

register a callback routine for load-image notifications;

receive a load-image notification for an image and record loading of the image;

store original code at an entry point of the image and patching redirect stub code over the original code at the entry point;

receive, from the redirect stub code, a redirected call to the entry point to execute a routine in the image, the redirected call identifying a driver object representing the image;

determine if the image is a kernel-mode image of a specified type after receiving the redirected call to the entry point to execute the routine in the image;

based on the driver object, in response to determining the image is the kernel-mode image of the specified type, provide a mechanism to intercept unloading of the image; and

in response to the mechanism intercepting the unloading of the image, recording the unloading of the image.