Repository files navigation

ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel driver by importing at runtime.

Firstinitialize ZeroImport at the very beginning of your driver (DriverEntry).

// if you don't have access to a driver objectif (!zeroimport::init()){// error handling (normally zeroimport::init() should never fail!)}// if you have access to a driver object, this version of init is recommendedif (!zeroimport::init(pDriverObject)){// error handling (normally zeroimport::init() should never fail!)}

The following example shows how you could for example callMmIsAddressValid without statically importing the function in your driver. This can be, of course, applied to any imported function you want to call.

PVOID Address =0;// import and cache MmIsAddressValid at runtime and then call itif (ZR_IMP_CACHED(MmIsAddressValid)(Address)){// ...}// import (without caching) MmIsAddressValid at runtime and then call itif (ZR_IMP_NOT_CACHED(MmIsAddressValid)(Address)){// ...}// using the default shorter macroif (ZR_IMP(MmIsAddressValid)(Address)){// ...}

It's important to note that ZeroImport can import any type of exported symbol, not just functions. For example variables such asPsLoadedModuleList orPsInitialSystemProcess.

LIST_ENTRY PsLoadedModuleList;// We need to define PsLoadedModuleList manually so that ZeroImport knows the type of importPLIST_ENTRY pPsLoadedModuleList = ZR_IMP(PsLoadedModuleList);// ...PEPROCESS InitialProcess = *ZR_IMP(PsInitialSystemProcess);// PsInitialSystemProcess is already defined in ntddk.hif (!InitialProcess)// ...

• All Windows versions should be supported (literally all)
• C++11 and higher

• Difficult Static Analysis of your driver
• Avoidsunwanted IAT (Import Address Table) Hooks inside your driver placed by other loaded drivers

This shows the difference between the simple source-code and compiled pseudocode (decompiled in IDA Pro).As you can see,PsGetProcessId andPsInitialSystemProcess are not imported although I am using them in the example driver.

However ZeroImport needs to import just one function:MmGetSystemRoutineAddress to getPsLoadedModuleList and loop through the loaded system drivers and find ntoskrnl's base which is why you will always have at least one import in your driver. This isn't a big issue though because it doesn't defeat any of ZeroImport'suse purposes.

Most if not all imports you will ever need in a kernelmode driver on Windows are insidentoskrnl.exe so ZeroImport just searches ntoskrnl.exe's exported symbols at runtime and finds the right symbol by its name through hash-comparing. The names of the symbols that we want to import inside our code are hashed at compile-time for faster runtime and better security (seezeroimport::detail::HashString()).

The best part about ZeroImport is that it doesn't produce any strings in the compiled binary (driver), even at runtime it doesn't use or leave any string in memory. And thanks to the simple cashing system, the performance of your driver will be barely affected by this library.

Inspired bylazy-importer which does the same thing but only for usermode applications.