Decompiling "MS" drivers

Dec 12, 2013 3 Replies
D

Hi,



I've got some Kit that I want to repurpose. Of course, the hardware is undocumented; the software I'll gladly discard.



I think the devices are NT-based.



What's the easiest way to decompile the drivers for the devices in which I'm interested (assume I can find the associated files)? Ideally, an "offline" process (so I don't have to find NT-specific tools).



Best tools to do so? Ida Pro? Some MS beast?? (note: I don't care about salvaging the code -- just getting a feel for the hardware's "needs")



Thx,



--don


Vote
Twitter Facebook LinkedIn
D

IDAPro definately. The other most important tool is to know how drivers are put together.

Ie. get the DDK for the era you expect the driver to be. Compile the sample driver closest to what you have, disassemble it. Now you have a sample that you can see source code and the result, that you can tackle the total unknown and find what is boilerplate driver code vs. code custom to the device in question.

Doug McIntyre doug@themcintyres.us
Vote
Twitter Facebook LinkedIn
D

Hmm... good point. OTOH, it means I've now got to chase down a20? year old DDK.

Vote
Twitter Facebook LinkedIn
W

I second the IDAPro. It has been very useful ESPECIALLY for drivers. I've used it for that very thing in the past.

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required