Geoff Chappell, Software Analyst
An array of KSE_HOOK structures provides the third level in the description of a driver shim. The second level of the description is an array of KSE_COLLECTION structures. The top top level is a KSE_SHIM structure.
Microsoft’s name for this structure is known from symbol files for a driver (NDIS.SYS) that registers a shim and uses C++ for instantiating its KSE_HOOK array as statically allocated data: the C++ decoration names the type. Microsoft’s names and types are not known for members, there being no type information in the symbol file.
The KSE_HOOK is 0x10 and 0x20 bytes in 32-bit and 64-bit Windows 10, respectively.
Offset (x86) | Offset (x64) | Size | Description |
---|---|---|---|
0x00 | 0x00 | dword | type of collection: 0 to hook function in shimmed driver’s Import Address Table; 1 to hook shimmed driver’s receipt of I/O requests and related notifications; 2 for last KSE_HOOK in array |
0x04 | 0x08 | pointer | for type 0 only: address of name of exported function to hook, as null-terminated ANSI string |
dword | for type 1 only: I/O callback code | ||
0x08 | 0x10 | pointer | address of hook routine |
0x0C | 0x18 | pointer | initially NULL; for type 0 only: receives forwarding address |
For the last hook in the array, i.e., for type 2, all other members are ignored.
Each KSE_HOOK must specify a hook routine to which a shimmed driver’s execution is to be diverted. If instead the pointer is NULL, then the shim that contains this KSE_HOOK cannot be registered.
When a registered shim is appllied to some driver, the Kernel Shim Engine (KSE) edits each KSE_HOOK.