设备驱动程序如何像Process Monitor一样成为EXE
Process Monitor 和 Explorer 提供了一个 EXE 文件。 但他们包括一名司机。 -它在哪里。
通过 Windows 内部结构，
进程监视器的工作原理是从其可执行文件中提取文件系统过滤器设备驱动程序 启动后第一次运行它的映像（Procmon.exe），将驱动程序安装在内存中，然后从磁盘中删除驱动程序映像。
我想知道详细机制。
有一些关于这方面的代码吗？我在哪里可以找到它们。
或者你能给我解释一下吗？
谢谢。
Process Monitor and Explorer are supplied an EXE file.
But they include a driver. -Where is it.
By Windows Internals,
Process Monitor works by extracting a file system filter device driver from its executable
image (Procmon.exe) the first time you run it after a boot, installing the driver in memory, and then deleting the driver image from disk.
I would like to know the detail mechanism.
Are there some codes about that? Where can I find them.
Or could you explain me this.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
上次我查看时，它只是作为资源嵌入到可执行文件中。您可以使用 Resource Hacker 之类的工具来查看它。我想当进程启动时，它会从资源部分提取驱动程序并安装它。
Last time I looked it was just embedded into the executable as a resource. You can use something like Resource Hacker to see it. I guess when the process starts it extracts the driver from the resource section and installs it.
Windows 中的可执行文件可能包含“资源”部分等内容。它可以包含可执行文件可以在运行时访问的任何二进制数据。
诀窍是在链接期间将整个其他可执行文件（例如驱动程序的 SYS 文件）放入 EXE 中。然后在运行时 EXE 将其提取到 SYS 文件中。
然后可以动态加载该驱动程序（使用 SC 管理器）
Executable file in Windows may contain among other things "resource" section. It may contain any binary data, which executable may access at run-time.
The trick is to put the whole other executable (the SYS file of the driver for instance) inside an EXE during the link time. Then at runtime the EXE extract this into a SYS file.
Then this driver may be loaded on-the-fly (using SC-manager)