KSE_HOOK

An array of KSE_HOOK structures provides the third level in the description of a driver shim. The second level of the description is an array of KSE_COLLECTION structures. The top top level is a KSE_SHIM structure.

Microsoft’s name for this structure is known from symbol files for a driver (NDIS.SYS) that registers a shim and uses C++ for instantiating its KSE_HOOK array as statically allocated data: the C++ decoration names the type. Microsoft’s names and types are not known for members, there being no type information in the symbol file.

The KSE_HOOK is 0x10 and 0x20 bytes in 32-bit and 64-bit Windows 10, respectively.

Offset (x86) Offset (x64) Size Description
0x00 0x00 dword type of collection:
0 to hook function in shimmed driver’s Import Address Table;
1 to hook shimmed driver’s receipt of I/O requests and related notifications;
2 for last KSE_HOOK in array
0x04 0x08 pointer for type 0 only: address of name of exported function to hook, as null-terminated ANSI string
dword for type 1 only: I/O callback code
0x08 0x10 pointer address of hook routine
0x0C 0x18 pointer initially NULL;
for type 0 only: receives forwarding address

For the last hook in the array, i.e., for type 2, all other members are ignored.

Each KSE_HOOK must specify a hook routine to which a shimmed driver’s execution is to be diverted. If instead the pointer is NULL, then the shim that contains this KSE_HOOK cannot be registered.

When a registered shim is appllied to some driver, the Kernel Shim Engine (KSE) edits each KSE_HOOK.