It's actually a Windows® XP driver that performs SSDT hooking. It replaces some functions (registry operations in my example code) with some self-defined kernel code which eventually passes the parameters to the correct system call.
For now I only test it on Windows® XP since it's much easier because XP is less secure of course.
I didn't test it on later Windows operating systems but I did read some post
saying that the most tricky part to port it to later Windows versions is that
memory holding SSDT is no longer writable with wp
bit set in cr0
. But
Windows provides a way to bypass the restriction using Memory Descriptor
List(MDL). Modifying cr0
will compromise your OS and is not recommended.
If you are skilled at Windows® driver dev, then just ignore this part (and probably you don't need this toy either).
First download VisualDDK which I use to compile the whole stuff. Then you can do whatever you want. Create a project and copy-paste my code or copy the directory and see if Visual Studio can recognize. If you have any problem, you can email me.
And there're plenty of tutorials on how to make drivers work with Windows (not so convenient like Linux though)