2021-10-07 09:40:17 +03:00
|
|
|
|
# Copyright (c) Microsoft Corporation
|
|
|
|
|
# SPDX-License-Identifier: MIT
|
|
|
|
|
|
|
|
|
|
param ([Parameter(Mandatory=$True)] [string] $WorkingDirectory,
|
|
|
|
|
[Parameter(Mandatory=$True)] [string] $LogFileName)
|
|
|
|
|
|
|
|
|
|
Push-Location $WorkingDirectory
|
|
|
|
|
|
2022-07-08 22:58:56 +03:00
|
|
|
|
$BinaryPath = "$Env:systemroot\system32";
|
|
|
|
|
|
|
|
|
|
Import-Module $PSScriptRoot\common.psm1 -Force -ArgumentList ($LogFileName) -WarningAction SilentlyContinue
|
2021-10-07 09:40:17 +03:00
|
|
|
|
|
|
|
|
|
# eBPF Drivers.
|
|
|
|
|
$EbpfDrivers =
|
|
|
|
|
@{
|
|
|
|
|
"EbpfCore" = "ebpfcore.sys";
|
|
|
|
|
"NetEbpfExt" = "netebpfext.sys";
|
|
|
|
|
"SampleEbpfExt" = "sample_ebpf_ext.sys"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
|
# Uninstall eBPF components.
|
|
|
|
|
#
|
|
|
|
|
function Unregister-eBPFComponents
|
|
|
|
|
{
|
|
|
|
|
# Uninstall drivers.
|
|
|
|
|
$EbpfDrivers.GetEnumerator() | ForEach-Object {
|
|
|
|
|
# New-Service does not support installing drivers.
|
|
|
|
|
sc.exe delete $_.Name 2>&1 | Write-Log
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# Uninstall user mode service.
|
2021-10-21 07:18:31 +03:00
|
|
|
|
sc.exe delete eBPFSvc 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
|
|
|
|
|
# Delete the eBPF netsh helper.
|
2022-07-08 22:58:56 +03:00
|
|
|
|
netsh delete helper ebpfnetsh.dll 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
|
# Install eBPF components.
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
function Register-eBPFComponents
|
|
|
|
|
{
|
2022-07-08 22:58:56 +03:00
|
|
|
|
# Uninstall previous installations (if any).
|
2021-10-07 09:40:17 +03:00
|
|
|
|
Unregister-eBPFComponents
|
|
|
|
|
|
|
|
|
|
# Install drivers.
|
|
|
|
|
$EbpfDrivers.GetEnumerator() | ForEach-Object {
|
2022-07-08 22:58:56 +03:00
|
|
|
|
if (Test-Path -Path ("$BinaryPath\{0}" -f $_.Value)) {
|
|
|
|
|
Write-Log ("Installing {0}..." -f $_.Name) -ForegroundColor Green
|
|
|
|
|
# New-Service does not support installing drivers.
|
|
|
|
|
sc.exe create $_.Name type=kernel start=demand binpath=("$BinaryPath\{0}" -f $_.Value) 2>&1 | Write-Log
|
|
|
|
|
if ($LASTEXITCODE -ne 0) {
|
|
|
|
|
throw ("Failed to create $_.Name driver.")
|
|
|
|
|
} else {
|
|
|
|
|
Write-Log ("{0} driver created." -f $_.Name) -ForegroundColor Green
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (Test-Path -Path ("$BinaryPath\drivers\{0}" -f $_.Value)) {
|
|
|
|
|
Write-Log ("Installing {0}..." -f $_.Name) -ForegroundColor Green
|
|
|
|
|
# New-Service does not support installing drivers.
|
|
|
|
|
sc.exe create $_.Name type=kernel start=demand binpath=("$BinaryPath\drivers\{0}" -f $_.Value) 2>&1 | Write-Log
|
|
|
|
|
if ($LASTEXITCODE -ne 0) {
|
|
|
|
|
throw ("Failed to create $_.Name driver.")
|
|
|
|
|
} else {
|
|
|
|
|
Write-Log ("{0} driver created." -f $_.Name) -ForegroundColor Green
|
|
|
|
|
}
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# Install user mode service.
|
2022-07-08 22:58:56 +03:00
|
|
|
|
.\eBPFSvc.exe install 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
if ($LASTEXITCODE -ne 0) {
|
|
|
|
|
throw ("Failed to create eBPF user mode service.")
|
|
|
|
|
} else {
|
|
|
|
|
Write-Log "eBPF user mode service created." -ForegroundColor Green
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# Add the eBPF netsh helper.
|
2022-07-08 22:58:56 +03:00
|
|
|
|
netsh add helper ebpfnetsh.dll 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
|
2022-09-03 20:32:39 +03:00
|
|
|
|
function Enable-KMDFVerifier
|
|
|
|
|
{
|
|
|
|
|
# Install drivers.
|
|
|
|
|
$EbpfDrivers.GetEnumerator() | ForEach-Object {
|
|
|
|
|
New-Item -Path ("HKLM:\System\CurrentControlSet\Services\{0}\Parameters\Wdf" -f $_.Name) -Force -ErrorAction Stop
|
|
|
|
|
New-ItemProperty -Path ("HKLM:\System\CurrentControlSet\Services\{0}\Parameters\Wdf" -f $_.Name) -Name "VerifierOn" -Value 1 -PropertyType DWord -Force -ErrorAction Stop
|
|
|
|
|
New-ItemProperty -Path ("HKLM:\System\CurrentControlSet\Services\{0}\Parameters\Wdf" -f $_.Name) -Name "TrackHandles" -Value "*" -PropertyType MultiString -Force -ErrorAction Stop
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2021-10-07 09:40:17 +03:00
|
|
|
|
#
|
|
|
|
|
# Start service and drivers.
|
|
|
|
|
#
|
|
|
|
|
function Start-eBPFComponents
|
|
|
|
|
{
|
2022-07-08 22:58:56 +03:00
|
|
|
|
param([parameter(Mandatory=$false)] [bool] $Tracing = $false)
|
|
|
|
|
|
|
|
|
|
if ($Tracing) {
|
|
|
|
|
Write-Log "Starting ETW tracing"
|
|
|
|
|
Start-Process -FilePath "wpr.exe" -ArgumentList @("-start", "EbpfForWindows.wprp", "-filemode") -NoNewWindow -Wait
|
|
|
|
|
}
|
2021-11-03 18:33:40 +03:00
|
|
|
|
|
2021-10-07 09:40:17 +03:00
|
|
|
|
# Start drivers.
|
|
|
|
|
$EbpfDrivers.GetEnumerator() | ForEach-Object {
|
2022-07-08 22:58:56 +03:00
|
|
|
|
if (Test-Path -Path ("$BinaryPath\drivers\{0}" -f $_.Value)) {
|
|
|
|
|
Start-Service $_.Name -ErrorAction Stop | Write-Log
|
|
|
|
|
Write-Host ("{0} Driver started." -f $_.Name)
|
|
|
|
|
}
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
|
2022-10-10 20:17:03 +03:00
|
|
|
|
if (Test-Path -Path "ebpfsvc.exe") {
|
|
|
|
|
# Start user mode service.
|
|
|
|
|
Start-Service "eBPFSvc" -ErrorAction Stop | Write-Log
|
|
|
|
|
Write-Host "eBPFSvc service started."
|
|
|
|
|
}
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
|
2022-07-01 02:53:03 +03:00
|
|
|
|
#
|
|
|
|
|
# Update eBPF store.
|
|
|
|
|
#
|
|
|
|
|
function Update-eBPFStore
|
|
|
|
|
{
|
|
|
|
|
Write-Log "Clearing eBPF store"
|
|
|
|
|
.\export_program_info.exe --clear
|
|
|
|
|
|
|
|
|
|
Write-Log "Populating eBPF store"
|
|
|
|
|
.\export_program_info.exe
|
|
|
|
|
}
|
|
|
|
|
|
2021-10-07 09:40:17 +03:00
|
|
|
|
function Install-eBPFComponents
|
|
|
|
|
{
|
2022-09-03 20:32:39 +03:00
|
|
|
|
param([parameter(Mandatory=$false)] [bool] $Tracing = $false,
|
|
|
|
|
[parameter(Mandatory=$false)] [bool] $KMDFVerifier = $false)
|
2022-07-08 22:58:56 +03:00
|
|
|
|
|
2021-10-21 07:18:31 +03:00
|
|
|
|
# Stop eBPF Components
|
|
|
|
|
Stop-eBPFComponents
|
|
|
|
|
|
2021-10-07 09:40:17 +03:00
|
|
|
|
# Copy all binaries to system32.
|
|
|
|
|
Copy-Item *.sys -Destination "$Env:systemroot\system32\drivers" -Force -ErrorAction Stop 2>&1 | Write-Log
|
2022-07-08 22:58:56 +03:00
|
|
|
|
if (Test-Path -Path "drivers") {
|
|
|
|
|
Copy-Item drivers\*.sys -Destination "$Env:systemroot\system32\drivers" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
}
|
|
|
|
|
if (Test-Path -Path "testing\testing") {
|
|
|
|
|
Copy-Item testing\testing\*.sys -Destination "$Env:systemroot\system32\drivers" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
}
|
2021-10-07 09:40:17 +03:00
|
|
|
|
Copy-Item *.dll -Destination "$Env:systemroot\system32" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
Copy-Item *.exe -Destination "$Env:systemroot\system32" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
|
|
|
|
|
# Register all components.
|
|
|
|
|
Register-eBPFComponents
|
|
|
|
|
|
2022-09-03 20:32:39 +03:00
|
|
|
|
if ($KMDFVerifier) {
|
|
|
|
|
# Enable KMDF verifier and tag tracking.
|
|
|
|
|
Enable-KMDFVerifier
|
|
|
|
|
}
|
|
|
|
|
|
2021-10-07 09:40:17 +03:00
|
|
|
|
# Start all components.
|
2022-07-08 22:58:56 +03:00
|
|
|
|
Start-eBPFComponents -Tracing $Tracing
|
2022-07-01 02:53:03 +03:00
|
|
|
|
|
|
|
|
|
## TODO: Issue 1231, remove this step when this issue is fixed.
|
|
|
|
|
# Update eBPF store.
|
|
|
|
|
Update-eBPFStore
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function Stop-eBPFComponents
|
|
|
|
|
{
|
|
|
|
|
# Stop user mode service.
|
2021-10-21 07:18:31 +03:00
|
|
|
|
Stop-Service "eBPFSvc" -ErrorAction Ignore 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
|
|
|
|
|
# Stop the drivers.
|
|
|
|
|
$EbpfDrivers.GetEnumerator() | ForEach-Object {
|
2021-10-21 07:18:31 +03:00
|
|
|
|
Stop-Service $_.Name -ErrorAction Ignore 2>&1 | Write-Log
|
2021-10-07 09:40:17 +03:00
|
|
|
|
}
|
2022-07-08 22:58:56 +03:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function Uninstall-eBPFComponents
|
|
|
|
|
{
|
|
|
|
|
Stop-eBPFComponents
|
|
|
|
|
Unregister-eBPFComponents
|
|
|
|
|
.\export_program_info.exe --clear
|
|
|
|
|
Remove-Item "$Env:systemroot\system32\drivers\*bpf*" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
Remove-Item "$Env:systemroot\system32\*bpf*" -Force -ErrorAction Stop 2>&1 | Write-Log
|
|
|
|
|
wpr.exe -cancel
|
|
|
|
|
}
|