Driver Shimming

• US 20120227057A1
• Filed: 03/04/2011
• Published: 09/06/2012
• Est. Priority Date: 03/04/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Lupu, Corneliu I., Petruta, Cristian G., Calinoiu, Silviu C., Jargalsaihan, Batsaihan, Matichuk, Chris Ernest
• Granted Patent: US 9,519,600 B2
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G06F 13/20 for access to input/output bus
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs
• CPC Class Codes: G06F 9/4411 Configuring for operating with peripheral devices; Loading of device drivers
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Abstract

Driver shimming techniques are described. In one or more implementations, an identification is made as to which interfaces and callbacks are utilized by a shim obtained for a driver of a computing device. The identified interfaces and callbacks are wrapped by the shim of the computing device such that calls to the wrapped interfaces and callbacks are intercepted by the shim.

Claims

1. A method comprising:

identifying which interfaces and callbacks are utilized by a shim obtained for a driver of a computing device; and

wrapping the identified interfaces and callbacks by the shim of the computing device such that calls to the wrapped interfaces and callbacks are intercepted by the shim.

2. A method as described in claim 1, wherein the wrapping of the identified interfaces and the callbacks configures the shim to modify both an input and output of an interface call.

3. A method as described in claim 1, wherein the wrapping includes replacing import address table (IAT) entries of the one or more application programming interfaces and saving the replaced import address table (IAT) entries in a hooking table.

4. A method as described in claim 1, wherein the wrapping includes replacing entries in a dispatch table for use in conjunction with an I/O request packet (IRP).

5. A method as described in claim 1, wherein the shim engine that performs the identifying and the wrapping is not involved in execution of the driver after the identifying and the wrapping.

6. A method as described in claim 1, wherein the wrapped interfaces are application programming interfaces (APIs) and the callbacks involve occurrence of events by the computing device.

7. A method as described in claim 1, wherein the wrapped interfaces involve communication with a kernel of an operating system.

8. A method as described in claim 1, wherein the wrapped interfaces involve communication with another driver that is executable on the computing device.

9. A method as described in claim 1, wherein the wrapped interfaces and the callbacks of the driver by the shim are executable to perform operations comprising:

capturing data via one or more hooks;

translating the data to mimic an earlier version of an operating system; and

communicating the translated data to the driver.

10. A method as described in claim 1, further comprising obtaining the shim via a network connection from a service provider responsive to communication of an identification of the driver that is to be installed on the computing device.

11. A method comprising:

intercepting an I/O request packet by a shim executed on a computing device that relates to communication with a driver that is executing on the computing device;

translating data, through the execution of the shim, that relates to the I/O request packet to be compatible with the driver; and

transmit the translated data through the execution of the shim for communication to the driver.

12. A method as described in claim 11, wherein the intercepting is performed using modifying entries in a dispatch table.

13. A method as described in claim 11, wherein the data that is intercepted is received from a kernel that is executed by the computing device.

14. A method as described in claim 11, wherein the data that is intercepted is received from another driver that is executed by the computing device.

15. A method as described in claim 11, wherein the data is involved in a callback to the driver.

16. A method as described in claim 11, wherein the intercepting and the translating are performed by respective ones of a plurality of said shims.

17. A method comprising:

initiating installation of a driver on a computing device;

identifying the driver to be installed;

based on the identification, determining that a shim is available for the driver to communicate with an operating system;

obtaining the shim for installation on the computing device;

identifying callbacks of the driver that correspond to the shim;

wrapping the callbacks by the shim such that calls to the callbacks are intercepted by the shim; and

modifying an in-memory image of the driver by the computing device using the wrapped callbacks.

18. A method as described in claim 17, wherein the wrapping includes modifying a dispatch table usable to communication I/O request packets (IRPs).

19. A method as described in claim 17, wherein the wrapping includes modifying an import access table (IAT) usable to communicate with an application programming interface (API).

20. A method as described in claim 17, further comprising:

intercepting an I/O request packet (IRP) by the shim that relates to communication with the driver;

translating data, by the shim, that relates to the I/O request packet (IRP) to be compatible with the driver; and

transmitting the translated data for communication to the driver.