Submit your answer to bonse@is.s.u-tokyo.ac.jp.
Mail Subject must be <StudentID>-internals
Time Limit is 9/20 (SAT) , but 1st Exercise should be submited before 8/23(SAT).

At first, read "Lecture Note about Registry".

And Registry callback routine is described in "Registry Callbacks".

To do this exercise, you need to connect 2 machines by serial cable, so , prepare 2 computers with serial ports. You can borrow a serial cable from Hiraki Lab. And OS should be Windows XP SP1 or later.

Install Windows DDK(Device Driver Kit).You can install this from CD-R which are delivered in the lecture.

You need to use debugger.You can download from "Microsoft Debugger Page". Debugger will be installed in "C:\Program Files\Debugging Tools for Windows\" by default, so , you'd better add this directry into PATH environment variable.

Decide rolls of two machines.One is debug target machine (denote "target machine") and the other is debug operation machine(denote "debug machine"). target machine should be run in debug mode, so , add an entry in "C:\boot.ini" as follows.

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="WinXP Kernel Debug Mode" /fastdetect /debug /debugport=COM1 /baudrate=9600

/debugport specifies debugging port (COM1 port) and /baudrate specifies the speed of serial communication. /baudrate should be identical to the rate which is used in Windows COM1 driver. You can look this rate in device manager.

In debug machine (assumes PATH is correctly adjusted), you can debug by using kd or windbg via serial port. Below statement is an example of kd. This specifies a port and baudrate to kd.

kd -k com:port="com1",baud=9600

If you want to know more about debugger, see help ("debugger.chm"). This help is installed with debugger program.

The sample file, used in this exercise, is in src\general\cancel (under WINDDK directry). If you didn't install this sample, you can install from the CD-R. Detail information about the sample "cancel" is in "cancel.htm".This file is in "cancel" directry.

Experiment 1

Write empty callback routine. After that regist it in "DriverEntry" and unregist it in "CsampUnload". Initialization is done in "DriverEntry" and finalization is done in "CsampUnload". See Registry Callbacks again.

Experiment 2

Modify the callback routine your wrote in Experiment 1. Create a counter variable. When the TYPE of REG_NOTIFY_CLASS is RegNtSetValueKey, call InterlockedIncrement. This function increments the counter value exclusively.

Experiment 3

Add some process when the TYPE is REG_NOTIFY_CLASS¤¬RegNtPreCreateKey and RegNtPostCreateKey. You can get current thread by PsGetCurrentThread.

Make a list which holds the active call thread. When the TYPE is Pre , add to the list. And , when the TYPE is post search appropriate thread from the list. When detect a key creation failure , output to a message to debugger by DbgPrint routine.

Question 4

Use DPC(Deffered Procedure Call).