Not able to load ELAM driver

Question

Hi,

 

I have build elam sample driver that comes with Windows developer preview and test-signed with visual studio 2011, and also done testsiging on by using BCDEDIT command, but after creating the service when i restared the pc it gives me "automatic recovery process" and then it won't load that driver.

the same time regfilter driver from samples works fine.

Please help me do i need to do anything more.

Answer 1

Hi,

I have figured out the problem.

 

For Early -load Antimalware driver we have to use special EKU then sign it.

After doing this i am successfully able to load ELAM diver.

 

R

Answer 2

Hi,

I have also build ELAM sample driver that comes with Windows Developer Preview, but not able to load it and same message appears as "automatic recovery process".

I have tried to create certificate with makecert and sign driver using signtool but failed.

Can you please tell the commandlines you have used to create certificate and sign the driver?

Thanks in advance,

Amit Kulkarni.

 

Answer 3

Hi,

Now I have created certificate and signed the driver. Now OS starts normally without giving any message such as "automatic recovery process".

But if I see in debugger, following message appears

"IOINIT: Built-in driver \Driver\myelam failed to initialize with status - 0xC000000D"

Also, I have added DbgPrint in my DriverEntry, but it seems they are either not getting displayed or DriverEntry is not getting called.

Thanks & Regards,

Amit.

 

 

Answer 4

I have signed the binary in visual studio 11. Now it works fine.