Velocidex
The compiled version cannot be used normally
My environment: VS2022 WDK version: Win10.0.26100.4202
Configuration type: Driver Widnwossdk version: 10.0.261000.0 Platform working set: WindowsKernelModeDriver10.0 Language standard: ISO++14 standard
The compiled program doesn't communicate properly with other programs. Is there any environment requirement? Could you please tell me your environment version?
If you want to use the compiled version you need to switch the system into test signing mode as described here
https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
I have set the test signature mode. The sys compiled by myself cannot be used, but the x64_test.sys in the source code can be used. So I want to ask what is the VS environment for your packaged compilation?
Not sure since I don't use visual studio.
Normally we just run msbuild in the top level. You can get that with the wdk download.
I think you also need to sign it with a test cert in order to get it loaded too
I use the sys generated by vs and it will automatically load a test signature certificate for me, which can be used normally. Can you tell me the vs version and wdk version number you are using?
I havent done this in a long time but last time I did, I just downloaded https://learn.microsoft.com/en-us/legal/windows/hardware/enterprise-wdk-license-2022 and went from there.
Are you not able to build the project? you mentioned you did get a .sys file - this is all you need.
Is there an issue with loading the sys file?
Yes, there is a problem. The one I compiled myself cannot interact, but the winpmem_x64_test.sys generated by your project can be used. I am very distressed and don't know what is going on.
You need to first check the event logs to see if the driver is properly loaded, then use windbgview to see the kernel log messages as the driver is initialized.
Once it is all looking good, you can check that the device handle is properly opened in the user space code and it should be able to communicate with the driver.
I also encountered the same problem. It's been solved. It's very simple; just use the older version of the driver.
I also encountered the same problem.
It's been solved. It's very simple; just use the older version of the driver.
我也遇到了同样的问题。
问题已解决。很简单，只需使用旧版本的驱动程序即可。
你好，我想请问一下，您说的使用旧版本的驱动程序是指的什么驱动程序呢？是VS吗？还是指的什么？我也遇到了同样的问题
