aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/nt_path_converter/control_codes.h12
-rw-r--r--src/nt_path_converter/device.c185
-rw-r--r--src/nt_path_converter/device.h13
-rw-r--r--src/nt_path_converter/main.c22
-rw-r--r--src/nt_path_converter/makefile1
-rw-r--r--src/nt_path_converter/nt2dos.c142
-rw-r--r--src/nt_path_converter/nt2dos.h12
-rw-r--r--src/nt_path_converter/sources3
-rw-r--r--src/sysenter/main.c98
-rw-r--r--src/sysenter/makefile1
-rw-r--r--src/sysenter/sources3
-rw-r--r--src/test/device.c200
-rw-r--r--src/test/device.h13
-rw-r--r--src/test/main.c24
-rw-r--r--src/test/makefile1
-rw-r--r--src/test/sources3
16 files changed, 733 insertions, 0 deletions
diff --git a/src/nt_path_converter/control_codes.h b/src/nt_path_converter/control_codes.h
new file mode 100644
index 0000000..b81de84
--- /dev/null
+++ b/src/nt_path_converter/control_codes.h
@@ -0,0 +1,12 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#pragma once
+
+#include <ntddk.h>
+
+#define CONVERT_NT_PATH CTL_CODE(0x8000, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
diff --git a/src/nt_path_converter/device.c b/src/nt_path_converter/device.c
new file mode 100644
index 0000000..90fcc98
--- /dev/null
+++ b/src/nt_path_converter/device.c
@@ -0,0 +1,185 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include "control_codes.h"
+#include "device.h"
+#include "nt2dos.h"
+
+#include <ntddk.h>
+
+static NTSTATUS device_open(DEVICE_OBJECT *device_object, IRP *irp)
+{
+ NTSTATUS status = STATUS_SUCCESS;
+
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = 0;
+ IoCompleteRequest(irp, IO_NO_INCREMENT);
+ return status;
+}
+
+typedef NTSTATUS (*ioctl_handler)(void *, unsigned long,
+ void *, unsigned long,
+ ULONG_PTR *);
+
+static NTSTATUS handle_convert_nt_path(void *in_buf,
+ unsigned long in_buf_size,
+ void *out_buf,
+ unsigned long out_buf_size,
+ ULONG_PTR *nbwritten)
+{
+ UNICODE_STRING uUnresolved, uResolved;
+ NTSTATUS status = STATUS_SUCCESS;
+
+ RtlInitUnicodeString(&uUnresolved, (WCHAR *) in_buf);
+ status = nt2dos(&uResolved, &uUnresolved);
+
+ if (!NT_SUCCESS(status))
+ return status;
+
+ *nbwritten = uResolved.Length;
+
+ if (out_buf_size < uResolved.Length)
+ {
+ status = STATUS_BUFFER_OVERFLOW;
+ goto FREE_RESOLVED;
+ }
+
+ RtlCopyMemory(out_buf, uResolved.Buffer, uResolved.Length);
+
+FREE_RESOLVED:
+ ExFreePool(uResolved.Buffer);
+
+ return status;
+}
+
+static NTSTATUS device_ioctl(DEVICE_OBJECT *device_object, IRP *irp)
+{
+ IO_STACK_LOCATION *io_stack_loc;
+ void* in_buf, *out_buf;
+ unsigned long in_buf_size, out_buf_size;
+ ioctl_handler handler;
+ NTSTATUS status = STATUS_UNSUCCESSFUL;
+
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = 0;
+ io_stack_loc = IoGetCurrentIrpStackLocation(irp);
+
+ in_buf = out_buf = irp->AssociatedIrp.SystemBuffer;
+ in_buf_size = io_stack_loc->Parameters.DeviceIoControl.InputBufferLength;
+ out_buf_size = io_stack_loc->Parameters.DeviceIoControl.OutputBufferLength;
+
+ switch (io_stack_loc->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case CONVERT_NT_PATH:
+ handler = handle_convert_nt_path;
+ break;
+ default:
+ status = irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
+ goto complete_request;
+ }
+
+ status = irp->IoStatus.Status = handler(in_buf, in_buf_size,
+ out_buf, out_buf_size,
+ &irp->IoStatus.Information);
+
+complete_request:
+ IoCompleteRequest(irp, IO_NO_INCREMENT);
+
+ return status;
+}
+
+typedef struct
+{
+ const wchar_t *path;
+ const wchar_t *symlink;
+} device_info;
+
+typedef struct
+{
+ DEVICE_OBJECT *object;
+ UNICODE_STRING path;
+ UNICODE_STRING symlink;
+} device;
+
+#define NUMOF_DEVICES 1
+
+static device_info devices_info[NUMOF_DEVICES] =
+{
+ {
+ L"\\Device\\nt_path_converter",
+ L"\\DosDevices\\nt_path_converter",
+ },
+};
+
+static device devices[NUMOF_DEVICES];
+
+static void destroy_device(int i)
+{
+ IoDeleteSymbolicLink(&devices[i].symlink);
+ IoDeleteDevice(devices[i].object);
+}
+
+void destroy_devices()
+{
+ int i;
+ for (i = 0; i < NUMOF_DEVICES; ++i)
+ destroy_device(i);
+}
+
+static NTSTATUS set_up_device(DRIVER_OBJECT *driver_object, int i)
+{
+ NTSTATUS status = STATUS_SUCCESS;
+
+ RtlInitUnicodeString(&devices[i].path, devices_info[i].path);
+ RtlInitUnicodeString(&devices[i].symlink, devices_info[i].symlink);
+
+ status = IoCreateDevice(driver_object,
+ 0,
+ &devices[i].path,
+ FILE_DEVICE_UNKNOWN,
+ FILE_DEVICE_SECURE_OPEN,
+ FALSE,
+ &devices[i].object);
+
+ if (!NT_SUCCESS(status))
+ return status;
+
+ devices[i].object->Flags |= DO_BUFFERED_IO;
+ devices[i].object->Flags &= ~DO_DEVICE_INITIALIZING;
+
+ if (!NT_SUCCESS(status = IoCreateSymbolicLink(&devices[i].symlink,
+ &devices[i].path)))
+ goto delete_device;
+
+ return status;
+
+delete_device:
+ IoDeleteDevice(devices[i].object);
+
+ return status;
+}
+
+NTSTATUS set_up_devices(DRIVER_OBJECT *driver_object)
+{
+ int i, j;
+ NTSTATUS status = STATUS_SUCCESS;
+
+ for (i = 0; i < NUMOF_DEVICES; ++i)
+ if (!NT_SUCCESS(status = set_up_device(driver_object, i)))
+ goto destroy_devices;
+
+ driver_object->MajorFunction[IRP_MJ_CREATE] = device_open;
+ driver_object->MajorFunction[IRP_MJ_DEVICE_CONTROL] = device_ioctl;
+
+ return status;
+
+destroy_devices:
+ for (j = 0; j < i; ++j)
+ destroy_device(j);
+
+ return status;
+}
diff --git a/src/nt_path_converter/device.h b/src/nt_path_converter/device.h
new file mode 100644
index 0000000..a5ecc31
--- /dev/null
+++ b/src/nt_path_converter/device.h
@@ -0,0 +1,13 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#pragma once
+
+#include <ntddk.h>
+
+NTSTATUS set_up_devices(DRIVER_OBJECT *);
+void destroy_devices();
diff --git a/src/nt_path_converter/main.c b/src/nt_path_converter/main.c
new file mode 100644
index 0000000..4d969de
--- /dev/null
+++ b/src/nt_path_converter/main.c
@@ -0,0 +1,22 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include "device.h"
+
+#include <ntddk.h>
+
+static void on_driver_unload(DRIVER_OBJECT *driver_object)
+{
+ destroy_devices();
+}
+
+NTSTATUS DriverEntry(DRIVER_OBJECT *driver_object,
+ UNICODE_STRING *registry_path)
+{
+ driver_object->DriverUnload = on_driver_unload;
+ return set_up_devices(driver_object);
+}
diff --git a/src/nt_path_converter/makefile b/src/nt_path_converter/makefile
new file mode 100644
index 0000000..5acbbd2
--- /dev/null
+++ b/src/nt_path_converter/makefile
@@ -0,0 +1 @@
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/src/nt_path_converter/nt2dos.c b/src/nt_path_converter/nt2dos.c
new file mode 100644
index 0000000..fb0fd80
--- /dev/null
+++ b/src/nt_path_converter/nt2dos.c
@@ -0,0 +1,142 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include <ntifs.h>
+
+#include "nt2dos.h"
+
+static NTSTATUS get_object_name_info(
+ void *object,
+ OBJECT_NAME_INFORMATION **object_name_info)
+{
+ unsigned long nbneeded;
+ NTSTATUS status = STATUS_SUCCESS;
+
+ status = ObQueryNameString(object, NULL, 0, &nbneeded);
+ if (status != STATUS_INFO_LENGTH_MISMATCH)
+ return status;
+ *object_name_info = ExAllocatePoolWithTag(PagedPool, nbneeded, '1l');
+ if (*object_name_info == NULL)
+ return STATUS_INSUFFICIENT_RESOURCES;
+ status = ObQueryNameString(object, *object_name_info, nbneeded, &nbneeded);
+ if (!NT_SUCCESS(status))
+ goto free_object_name_info;
+ return status;
+
+free_object_name_info:
+ ExFreePool(*object_name_info);
+
+ return status;
+}
+
+NTSTATUS nt2dos(UNICODE_STRING *u_resolved, UNICODE_STRING *u_unresolved)
+{
+ IO_STATUS_BLOCK io_status_block;
+ DEVICE_OBJECT *volume_object;
+ FILE_OBJECT *file_object;
+ HANDLE file;
+ OBJECT_ATTRIBUTES file_attrs;
+ OBJECT_NAME_INFORMATION *file_name_info, *volume_name_info;
+ UNICODE_STRING u_dos_name;
+ USHORT u_resolved_size;
+ NTSTATUS status = STATUS_SUCCESS;
+
+ InitializeObjectAttributes(&file_attrs,
+ u_unresolved,
+ OBJ_CASE_INSENSITIVE | OBJ_OPENIF,
+ NULL,
+ NULL);
+
+ status = ZwCreateFile(&file,
+ FILE_READ_ATTRIBUTES,
+ &file_attrs,
+ &io_status_block,
+ NULL,
+ FILE_ATTRIBUTE_NORMAL,
+ FILE_SHARE_READ | FILE_SHARE_WRITE,
+ FILE_OPEN,
+ FILE_SYNCHRONOUS_IO_NONALERT,
+ NULL, 0);
+
+ if (!NT_SUCCESS(status))
+ return status;
+
+ status = ObReferenceObjectByHandle(file,
+ FILE_READ_ATTRIBUTES,
+ *IoFileObjectType,
+ KernelMode,
+ &file_object,
+ NULL);
+ if (!NT_SUCCESS(status))
+ goto close_file;
+
+ status = get_object_name_info(file_object, &file_name_info);
+ if (!NT_SUCCESS(status))
+ goto close_file;
+
+ if (file_object->Vpb == NULL)
+ {
+ u_resolved->Buffer = ExAllocatePoolWithTag(
+ PagedPool, file_name_info->Name.Length, '1l');
+ if (u_resolved->Buffer == NULL)
+ {
+ status = STATUS_INSUFFICIENT_RESOURCES;
+ goto free_file_name_info;
+ }
+
+ RtlInitEmptyUnicodeString(u_resolved,
+ u_resolved->Buffer,
+ file_name_info->Name.Length);
+ RtlCopyUnicodeString(u_resolved, &file_name_info->Name);
+ goto free_file_name_info;
+ }
+
+ volume_object = file_object->Vpb->RealDevice;
+ status = get_object_name_info(volume_object, &volume_name_info);
+
+ if (!NT_SUCCESS(status))
+ goto free_file_name_info;
+
+ status = IoVolumeDeviceToDosName(volume_object, &u_dos_name);
+ if (!NT_SUCCESS(status))
+ goto free_volume_name_info;
+
+ u_resolved_size = file_name_info->Name.Length
+ - volume_name_info->Name.Length
+ + u_dos_name.Length;
+
+ u_resolved->Buffer = ExAllocatePoolWithTag(
+ PagedPool, u_resolved_size, '1l');
+ if (u_resolved->Buffer == NULL)
+ {
+ status = STATUS_INSUFFICIENT_RESOURCES;
+ goto free_dos_name;
+ }
+
+ RtlInitEmptyUnicodeString(u_resolved, u_resolved->Buffer, u_resolved_size);
+
+ RtlCopyUnicodeString(u_resolved, &u_dos_name);
+ file_name_info->Name.Buffer +=
+ volume_name_info->Name.Length / sizeof(wchar_t);
+ file_name_info->Name.Length -=
+ volume_name_info->Name.Length;
+ RtlUnicodeStringCat(u_resolved, &file_name_info->Name);
+
+free_dos_name:
+ ExFreePool(u_dos_name.Buffer);
+
+free_volume_name_info:
+ ExFreePool(volume_name_info);
+
+free_file_name_info:
+ ExFreePool(file_name_info);
+
+close_file:
+ ZwClose(file);
+
+ return status;
+}
diff --git a/src/nt_path_converter/nt2dos.h b/src/nt_path_converter/nt2dos.h
new file mode 100644
index 0000000..495202d
--- /dev/null
+++ b/src/nt_path_converter/nt2dos.h
@@ -0,0 +1,12 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#pragma once
+
+#include <ntstrsafe.h>
+
+NTSTATUS nt2dos(UNICODE_STRING *resolved, UNICODE_STRING *unresolved);
diff --git a/src/nt_path_converter/sources b/src/nt_path_converter/sources
new file mode 100644
index 0000000..02a42cd
--- /dev/null
+++ b/src/nt_path_converter/sources
@@ -0,0 +1,3 @@
+TARGETTYPE = DRIVER
+TARGETNAME = nt_path_converter
+SOURCES = device.c main.c nt2dos.c
diff --git a/src/sysenter/main.c b/src/sysenter/main.c
new file mode 100644
index 0000000..24d3ac4
--- /dev/null
+++ b/src/sysenter/main.c
@@ -0,0 +1,98 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include <ntddk.h>
+
+static __int64 old_msr_value = 0;
+static void *old_ki_fast_call_entry = NULL;
+
+static void __stdcall log_system_call()
+{
+ static LONG count = 0;
+ static const LONG throttle = 10000;
+
+ LONG n = InterlockedIncrement(&count);
+
+ if (n % throttle == 0)
+ DbgPrint("Another %ld of `sysenter`s (eax=)!\n", throttle);
+}
+
+static void __declspec(naked) new_ki_fast_call_entry()
+{
+ __asm
+ {
+ pushad
+ pushfd
+ mov ecx, 0x23
+ push 0x30
+ pop fs
+ mov ds, cx
+ mov es, cx
+ call log_system_call
+ popfd
+ popad
+ jmp [old_ki_fast_call_entry]
+ }
+}
+
+#define IA32_SYSENTER_EIP 0x176
+
+static void hook_sysenter()
+{
+ /*
+ __asm
+ {
+ mov ecx, IA32_SYSENTER_EIP
+ rdmsr
+ mov old_ki_fast_call_entry, eax
+ mov eax, new_ki_fast_call_entry
+ xor edx, edx
+ wrmsr
+ }
+ */
+
+ old_msr_value = __readmsr(IA32_SYSENTER_EIP);
+ old_ki_fast_call_entry = (void *) old_msr_value;
+ __writemsr(IA32_SYSENTER_EIP, new_ki_fast_call_entry);
+}
+
+static void unhook_sysenter()
+{
+ /*
+ __asm
+ {
+ mov ecx, IA32_SYSENTER_EIP
+ mov eax, old_ki_fast_call_entry
+ xor edx, edx
+ wrmsr
+ }
+ */
+
+ __writemsr(IA32_SYSENTER_EIP, old_msr_value);
+}
+
+static void on_driver_unload(DRIVER_OBJECT *driver_object)
+{
+ KTIMER timer;
+ LARGE_INTEGER time_out;
+
+ unhook_sysenter();
+
+ KeInitializeTimer(&timer);
+ time_out.QuadPart = -30000000; // 3 sec
+ KeSetTimer(&timer, time_out, NULL);
+
+ KeWaitForSingleObject(&timer, Executive, KernelMode, FALSE, NULL);
+}
+
+NTSTATUS DriverEntry(DRIVER_OBJECT *driver_object,
+ UNICODE_STRING *registry_path)
+{
+ driver_object->DriverUnload = on_driver_unload;
+ hook_sysenter();
+ return STATUS_SUCCESS;
+}
diff --git a/src/sysenter/makefile b/src/sysenter/makefile
new file mode 100644
index 0000000..5acbbd2
--- /dev/null
+++ b/src/sysenter/makefile
@@ -0,0 +1 @@
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/src/sysenter/sources b/src/sysenter/sources
new file mode 100644
index 0000000..2a52870
--- /dev/null
+++ b/src/sysenter/sources
@@ -0,0 +1,3 @@
+TARGETTYPE = DRIVER
+TARGETNAME = sysenter
+SOURCES = main.c
diff --git a/src/test/device.c b/src/test/device.c
new file mode 100644
index 0000000..43ac3bc
--- /dev/null
+++ b/src/test/device.c
@@ -0,0 +1,200 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include "device.h"
+
+#include <ntddk.h>
+
+static NTSTATUS device_open(DEVICE_OBJECT *device_object, IRP *irp)
+{
+ NTSTATUS status = STATUS_SUCCESS;
+
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = 0;
+ IoCompleteRequest(irp, IO_NO_INCREMENT);
+ return status;
+}
+
+typedef NTSTATUS (*ioctl_handler)(void *, unsigned long,
+ void *, unsigned long,
+ ULONG_PTR *);
+
+static NTSTATUS handle_say_hello(void *in_buf,
+ unsigned long in_buf_size,
+ void *out_buf,
+ unsigned long out_buf_size,
+ ULONG_PTR *nbwritten)
+{
+ DbgPrint("Hello, world!\n");
+ return STATUS_SUCCESS;
+}
+
+static NTSTATUS handle_exchange_ints(void *in_buf,
+ unsigned long in_buf_size,
+ void *out_buf,
+ unsigned long out_buf_size,
+ ULONG_PTR *nbwritten)
+{
+ unsigned int read;
+ unsigned int written = 0xdeadbeef;
+
+ if (in_buf_size != sizeof(read))
+ return STATUS_INVALID_BUFFER_SIZE;
+
+ RtlCopyMemory(&read, in_buf, in_buf_size);
+ DbgPrint("%08x\n", read);
+
+ if (out_buf_size < sizeof(written))
+ return STATUS_BUFFER_TOO_SMALL;
+
+ RtlCopyMemory(out_buf, &written, sizeof(written));
+ *nbwritten += sizeof(written);
+
+ return STATUS_SUCCESS;
+}
+
+#define SAY_HELLO CTL_CODE(0x8000, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define EXCHANGE_INTS CTL_CODE(0x8001, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+static NTSTATUS device_ioctl(DEVICE_OBJECT *device_object, IRP *irp)
+{
+ IO_STACK_LOCATION *io_stack_loc;
+ void* in_buf, *out_buf;
+ unsigned long in_buf_size, out_buf_size;
+ ioctl_handler handler;
+ NTSTATUS status = STATUS_UNSUCCESSFUL;
+
+ irp->IoStatus.Status = status;
+ irp->IoStatus.Information = 0;
+ io_stack_loc = IoGetCurrentIrpStackLocation(irp);
+
+ in_buf = out_buf = irp->AssociatedIrp.SystemBuffer;
+ in_buf_size = io_stack_loc->Parameters.DeviceIoControl.InputBufferLength;
+ out_buf_size = io_stack_loc->Parameters.DeviceIoControl.OutputBufferLength;
+
+ switch (io_stack_loc->Parameters.DeviceIoControl.IoControlCode)
+ {
+ case SAY_HELLO:
+ handler = handle_say_hello;
+ break;
+ case EXCHANGE_INTS:
+ handler = handle_exchange_ints;
+ break;
+ default:
+ status = irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
+ goto complete_request;
+ }
+
+ status = irp->IoStatus.Status = handler(in_buf, in_buf_size,
+ out_buf, out_buf_size,
+ &irp->IoStatus.Information);
+
+complete_request:
+ IoCompleteRequest(irp, IO_NO_INCREMENT);
+
+ return status;
+}
+
+typedef struct
+{
+ const wchar_t *path;
+ const wchar_t *symlink;
+} device_info;
+
+typedef struct
+{
+ DEVICE_OBJECT *object;
+ UNICODE_STRING path;
+ UNICODE_STRING symlink;
+} device;
+
+#define NUMOF_DEVICES 2
+
+static device_info devices_info[NUMOF_DEVICES] =
+{
+ {
+ L"\\Device\\test_device1",
+ L"\\DosDevices\\test_device1",
+ },
+ {
+ L"\\Device\\test_device2",
+ L"\\DosDevices\\test_device2",
+ },
+};
+
+static device devices[NUMOF_DEVICES];
+
+static void destroy_device(int i)
+{
+ IoDeleteSymbolicLink(&devices[i].symlink);
+ IoDeleteDevice(devices[i].object);
+}
+
+void destroy_devices()
+{
+ int i;
+ for (i = 0; i < NUMOF_DEVICES; ++i)
+ destroy_device(i);
+}
+
+static NTSTATUS set_up_device(DRIVER_OBJECT *driver_object, int i)
+{
+ NTSTATUS status = STATUS_SUCCESS;
+
+ DbgPrint("Setting up device...\n");
+ DbgPrint("\tPath: %ws\n", devices_info[i].path);
+ DbgPrint("\tSymlink: %ws\n", devices_info[i].symlink);
+
+ RtlInitUnicodeString(&devices[i].path, devices_info[i].path);
+ RtlInitUnicodeString(&devices[i].symlink, devices_info[i].symlink);
+
+ status = IoCreateDevice(driver_object,
+ 0,
+ &devices[i].path,
+ FILE_DEVICE_UNKNOWN,
+ FILE_DEVICE_SECURE_OPEN,
+ FALSE,
+ &devices[i].object);
+
+ if (!NT_SUCCESS(status))
+ return status;
+
+ devices[i].object->Flags |= DO_BUFFERED_IO;
+ devices[i].object->Flags &= ~DO_DEVICE_INITIALIZING;
+
+ if (!NT_SUCCESS(status = IoCreateSymbolicLink(&devices[i].symlink,
+ &devices[i].path)))
+ goto delete_device;
+
+ return status;
+
+delete_device:
+ IoDeleteDevice(devices[i].object);
+
+ return status;
+}
+
+NTSTATUS set_up_devices(DRIVER_OBJECT *driver_object)
+{
+ int i, j;
+ NTSTATUS status = STATUS_SUCCESS;
+
+ for (i = 0; i < NUMOF_DEVICES; ++i)
+ if (!NT_SUCCESS(status = set_up_device(driver_object, i)))
+ goto destroy_devices;
+
+ driver_object->MajorFunction[IRP_MJ_CREATE] = device_open;
+ driver_object->MajorFunction[IRP_MJ_DEVICE_CONTROL] = device_ioctl;
+
+ return status;
+
+destroy_devices:
+ for (j = 0; j < i; ++j)
+ destroy_device(j);
+
+ return status;
+}
diff --git a/src/test/device.h b/src/test/device.h
new file mode 100644
index 0000000..a5ecc31
--- /dev/null
+++ b/src/test/device.h
@@ -0,0 +1,13 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#pragma once
+
+#include <ntddk.h>
+
+NTSTATUS set_up_devices(DRIVER_OBJECT *);
+void destroy_devices();
diff --git a/src/test/main.c b/src/test/main.c
new file mode 100644
index 0000000..f6b4fbf
--- /dev/null
+++ b/src/test/main.c
@@ -0,0 +1,24 @@
+/**
+ * \file
+ * \author Egor Tensin <Egor.Tensin@gmail.com>
+ * \copyright This file is licensed under the terms of the MIT License.
+ * See LICENSE.txt for details.
+ */
+
+#include "device.h"
+
+#include <ntddk.h>
+
+VOID on_driver_unload(DRIVER_OBJECT *driver_object)
+{
+ DbgPrint("Unloading test driver...\n");
+ destroy_devices();
+}
+
+NTSTATUS DriverEntry(DRIVER_OBJECT *driver_object,
+ UNICODE_STRING *registry_path)
+{
+ DbgPrint("Loading test driver...\n");
+ driver_object->DriverUnload = on_driver_unload;
+ return set_up_devices(driver_object);
+}
diff --git a/src/test/makefile b/src/test/makefile
new file mode 100644
index 0000000..5acbbd2
--- /dev/null
+++ b/src/test/makefile
@@ -0,0 +1 @@
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/src/test/sources b/src/test/sources
new file mode 100644
index 0000000..245a1a7
--- /dev/null
+++ b/src/test/sources
@@ -0,0 +1,3 @@
+TARGETTYPE = DRIVER
+TARGETNAME = test
+SOURCES = device.c main.c