Microsoft's official Rust framework for developing Windows drivers. The codebase is a multi-crate workspace with clean layering: `wdk-sys` provides raw bindgen-generated FFI bindings to the Windows Driver Kit (WDM/KMDF/UMDF APIs) with feature-gated API subsets (gpio, hid, spb, storage, usb, wdf); `wdk` layers safe idiomatic wrappers on top (no-std formatting buffers, WDF spinlock/timer wrappers, print macros); `wdk-build` powers driver `build.rs` scripts by auto-detecting WDK installations via registry/env vars and emitting compiler flags, linker args, and cfg settings; and `cargo-wdk` is a Cargo extension CLI for scaffolding (`new`), building (`build`), and cleaning (`clean`) driver projects including signing and packaging. Supporting crates `wdk-alloc` and `wdk-panic` provide kernel-mode global allocation (ExAllocatePool2/ExFreePool) and panic handling (KeBugCheckEx/OutputDebugStringA+abort), while `wdk-macros` implements a proc macro for typesafe dispatch of WDF function-table calls. The architecture is a layered library plus CLI toolchain, not a monolith or service; it serves driver developers as both a framework and a build tool. Key entry points are the `cargo wdk` CLI, the `wdk_build::configure_wdk_binary_build()`/`configure_wdk_library_build()` functions invoked from build scripts, and the `wdk` public API. The primary build data flow is: Cargo `[package.metadata.wdk]` manifest metadata → `wdk-build` config → bindgen → generated FFI bindings → driver binary, with WDK/SDK version and install-path detection from registry keys and environment variables. External dependencies include the Windows Driver Kit, LLVM/Clang, bindgen, and Windows packaging/signing tools (signtool, inf2cat, stampinf, certmgr). Engineering quality is genuinely strong: clean crate separation, a testable provider abstraction in the CLI (exec/fs/metadata/wdk_build), secret-redacting command logging, trybuild compile-fail tests, macrotest snapshots pinned per stable/beta/nightly toolchain, emulated-workspace integration tests, and CI spanning multiple WDK/LLVM/Rust versions with CodeQL, cargo-audit, dependabot, and release-plz release automation. Known caveats: the bindgen pipeline is fragile against WDK header changes, a proc-macro cache does not invalidate when source types change, thousands of NTSTATUS constants are manually maintained, LLVM is pinned to 17.0.6 due to an upstream ARM64 bug, and the README explicitly states the project is not yet recommended for production driver use. The repository is Windows-only by domain necessity.
This repository is a personal study collection focused on Windows internals, combining condensed book notes (Windows Internals 6th/7th ed., Windows System Programming, .NET IL Assembler) with standalone sample code for Windows kernel drivers and user-mode utilities. The code is not a cohesive application but rather multiple independent Visual Studio projects demonstrating key Windows API patterns: WDM driver skeletons (skeleton, dispatch pass-through, IOCTL handling, keyboard filter, file system filter) and user-mode examples (heap enumeration, singly linked lists, Authenticode signature verification). The material is educational in nature, targeting developers and researchers learning Windows kernel-mode programming and system internals. While the code is functional and well-commented, it relies on the older WDM model and some deprecated API patterns, reflecting a ~2017 vintage. The file system filter driver and keyboard filter driver exhibit non-trivial driver engineering patterns that can serve as reusable templates, though they require the Windows Driver Kit to build. No tests, CI, or deployment configurations exist; the repo is purely a reference and learning resource.