Kernel Drivers
Repo: AnyOne-Kernel (C, WDK). Two kernel
drivers feed the Endpoint Agent with the events user mode cannot see on its
own. Both build from the shared solution AnyEDR-Drivers.sln.
- AnyOneKcallback (built from the
AnyKDriver/project asaokclbk.sys) is a control device hosting the OS notify callbacks and the network filtering callouts. It streams events to the agent over a shared-memory ring buffer and takes control commands (isolation, ring setup) over device I/O controls. - AnyOneMinifilter (built from the
AnyMDriver/project asaomnflt.sys) is a Filter Manager minifilter that observes file activity. It sends events to the agent over a filter communication port, which also carries a small runtime command channel.
Why two drivers? They use three different kernel extension mechanisms: OS notify callbacks (process, thread, image, registry, handle events), the Windows Filtering Platform for network traffic, and a Filter Manager minifilter for file activity. The notify callbacks and WFP pair naturally in one ordinary kernel driver (AnyOneKcallback), but the minifilter has a distinct registration model and lifecycle, so it is simpler to develop as its own driver and repository (AnyOneMinifilter) for now. Merging the two into a single driver is planned.
AnyOneKcallback
A software-only driver loaded as a kernel service. It captures process, thread, image, registry, object, and network activity, and it also enforces host network isolation on command.
Component view
Blue is event and telemetry data flowing toward the agent. Orange is control, setup, and commands (callback registration, IOCTL control, isolation). Dashed arrows are internal dependencies and the ring signal.
Module layout
| File | Responsibility |
|---|---|
Driver.c | Entry point. Creates the control device and a separate raw device for the network filter, wires every subsystem together, restores isolation state on load, and tears everything down on unload. |
Callbacks.c | The OS kernel notify callbacks for process, thread, image, registry, and object activity. Builds telemetry events and also strips dangerous handle rights to protected processes for self-protection. |
WfpCallouts.c | Registers the network filtering session, callouts, and filters. Emits network connect, accept, and close telemetry and enforces isolation blocking. |
WfpSecurity.c | Stamps a SYSTEM-only access control list onto the isolation filter objects and the persisted-isolation registry key. |
Isolation.c | The network isolation state machine: the isolation flag, the lifeline allowlist, the block decision, and persistence across reboot and Safe Mode. |
EventFilter.c | A registry-path allowlist that drops non-persistence-relevant registry events before they reach the ring buffer. |
EventQueue.c | The shared-memory ring buffer: initialization, event push, copy-based drain, mapping into the agent, and the user notification event. |
IoctlHandler.c | The single dispatcher for every control request the agent sends: ring mapping, statistics, drain, isolation, lifeline, and protected-process registration. |
TelemetryCommon.h | The kernel-to-agent binary contract: device names, control codes, and event structs, kept byte-compatible with the Rust agent. |
DeviceContext.h | The per-device state: the ring buffer, the registry filter, the callback handles, and the protected-process list. |
Ring buffer
The agent maps the buffer once and then reads it directly, waiting on a named event that the driver signals on every push. The producer region is read-only to user mode, and the agent maps a separate read-write region holding only its read cursor, so the writer (kernel) and the reader (agent) never share writable memory. On overflow the driver sets a flag and increments a dropped-events counter instead of blocking. A copy-based drain control is the fallback path.
| Region | Writer | Purpose |
|---|---|---|
| control header (32 B) | kernel | Write index, dropped count, signalled flag, layout fields |
| events (default 16384 × 1160 B, about 17 MB) | kernel | The telemetry event slots |
| consumer (8 B) | agent | The read cursor, on its own read-write page |
Control surface
The agent drives the driver through device I/O controls in the range 0x801 to 0x823. Beyond ring setup, these also command host network isolation, tying this driver into Remediation.
| Category | Codes | Purpose |
|---|---|---|
| Ring setup | 0x810 / 0x811 / 0x817 | Map and unmap the ring buffer, and hand over the agent's notification event |
| Event pull | 0x805 | Copy-based drain, the fallback to the mapped ring |
| Statistics | 0x801 / 0x804 / 0x816 / 0x81A | Queue count, statistics, dropped count, and callback status |
| Isolation | 0x820 / 0x821 / 0x822 / 0x823 | Isolate, un-isolate, read status, and set the lifeline allowlist |
| Anti-tamper | 0x802 | Register a protected process (accepted only from the agent image) |
| Diagnostics | 0x818 / 0x819 | Network filter diagnostics and last status |
AnyOneMinifilter
A Filter Manager minifilter that watches file activity for ransomware, wiper, and tampering behavior, and defends the agent’s own files.
Component view
Blue is event data flowing toward the agent. Orange is control and setup (operation registration and config commands). Black dashed is an internal dependency, one module using another. The Command Handler is Driver.c’s message-notify callback, which reads and applies
g_Configand reports queue stats.
Module layout
| File | Responsibility |
|---|---|
Driver.c | Entry point. Registers the minifilter and its operation callbacks, starts filtering, creates the communication port, handles volume attach and detach, and runs the runtime command channel. |
Callbacks.c | The pre and post callbacks for every monitored file operation. Gathers evidence into per-file context and hands finished events to the dispatcher. |
PostCreateDecision.c | A pure decision function that classifies a file open's intent and decides whether to report it and as which event type. |
ProcUtils.c | Process trust logic: whitelisting the agent's own service, LocalSystem checks, and browser-process detection. |
Utils.c | File classification helpers (suspicious extensions, dropper locations, mark-of-the-web, decoy files) and the self-defense protection-rule engine. |
EventDispatcher.c | Builds the user-mode messages, queues them onto a worker thread, and sends them over the port. Critical alerts fall back to a synchronous send if the queue is full. |
Config.h | The runtime configuration (monitoring and self-defense toggles) and the queue and timeout constants. |
Driver.h | The master header: the message layout, the command protocol, and the per-file context structs. |
Monitored operations
The minifilter registers pre and post callbacks for file open, write, set-information, file-system control, and cleanup. Rather than report every operation, it defers most reporting to cleanup, when the final outcome is known, and it classifies open intent on the create path.
| Operation | What it detects |
|---|---|
| Create | Open intent, suspicious location and extension, mark-of-the-web, browser-dropped files, decoy access, and self-defense blocking of the agent's own files |
| Write | Write tracking (size, offset, running total, and a per-file write counter) |
| Set-information | Rename (capturing old and new path) and delete intent |
| File-system control | The zero-data wiper path (a write-equivalent that bypasses normal writes), plus reparse-point set and delete used for privilege escalation and evasion |
| Cleanup | The deferred emit point, sending the final delete or modify event once the handle closes |
External communication
| From | To | Data | Protocol |
|---|---|---|---|
| Windows kernel notify routines | AnyOneKcallback | Process, thread, image, registry, and object events | In-kernel callback registration |
| WFP filter engine | AnyOneKcallback | Network connect, accept, and close events | WFP callouts |
| AnyOneKcallback | Endpoint agent | Telemetry event stream | Shared-memory ring buffer (read-only map) plus a named signal event |
| Endpoint agent | AnyOneKcallback | Ring setup, drain, isolation, lifeline, protected-process registration | Device I/O control over \\.\AnyOneKcallback |
| Filter Manager | AnyOneMinifilter | File create, write, set-information, file-system control, and cleanup operations | Minifilter pre/post callbacks |
| AnyOneMinifilter | Endpoint agent | File, volume, and named-pipe events | Filter communication port \AnyOneMinifilterPort |
| Endpoint agent | AnyOneMinifilter | Runtime configuration commands (ping, get, set) | Filter communication port \AnyOneMinifilterPort |
Build and installation
The drivers build from the shared Visual Studio solution alongside the agent, and in a normal deployment the agent installs and starts both of them on its own startup rather than being registered by hand. The full procedures live in the Installation Guide, so they are not repeated here.
- Building the agent and both drivers from source: Building from Source.
- Enabling test signing and disabling Secure Boot on a test machine: Environment Setup.
- Installing on an endpoint, either the standard SOC dashboard installer or by manual service registration.
Kernel components
The key Windows and WDK facilities these drivers build on, for traceability.
| Area | Facilities |
|---|---|
| Framework | Kernel-Mode Driver Framework (WDF) control device and I/O queues; Filter Manager (FltMgr) for the minifilter |
| Notify callbacks | PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, CmRegisterCallbackEx, ObRegisterCallbacks |
| Network | Windows Filtering Platform callouts and filters (FwpsCalloutRegister0, FwpmFilterAdd0) |
| File system | Filter Manager operation callbacks, FltSendMessage, and communication ports |
| Toolchain | WDK with the MSVC v143 toolset, built for Release | x64 |