Windows Kernel & Driver Development
0 likes952 views
The document discusses Windows kernel and driver development. It begins with introductions and an overview of the Windows kernel model. The presenter then discusses various topics related to Windows kernel and driver development like driver models, loading and debugging drivers, userland interaction, privileged instructions, and process monitoring. The document concludes by thanking the host and mentioning references like books and papers for further reading.
Windows Kernel & Driver Development
- 1. Introduction Windows Kernel Conclusions Windows Kernel & Driver Development Marcus Botacin1 1Informatics - Federal University of Parana (UFPR) - Brazil mfbotacin@inf.ufpr.br November 2018 Windows Kernel & Driver Development FAU @ Erlangen
- 2. Introduction Windows Kernel Conclusions Agenda 1 Introduction 2 Windows Kernel 3 Conclusions Windows Kernel & Driver Development FAU @ Erlangen
- 3. Introduction Windows Kernel Conclusions Agenda 1 Introduction 2 Windows Kernel 3 Conclusions Windows Kernel & Driver Development FAU @ Erlangen
- 4. Introduction Windows Kernel Conclusions About Me Malware Analyst (2012) BsC. Computer Engineer @ UNICAMP (2015) Sandbox Development MsC. Computer Science @ UNICAMP (2017) Hardware-Assisted Malware Analysis PhD. Computer Science @ UFPR (Present) Hardware-Assisted Malware Detection AntiVirus Evaluation Future Threats Contextual and Social Malware effects Windows Kernel & Driver Development FAU @ Erlangen
- 5. Introduction Windows Kernel Conclusions Windows Model: Kernel Entering Figure: https://blogs.msdn.microsoft.com/hanybarakat/2007/ 02/25/deeper-into-windows-architecture/ Windows Kernel & Driver Development FAU @ Erlangen
- 6. Introduction Windows Kernel Conclusions Function Prototypes: Multiple Contexts Wrapper 1 HANDLE OpenProcess ( 2 DWORD dwDesiredAccess , 3 BOOL bInheritHandle , 4 DWORD dwProcessId ) ; Complete Version 1 k e r n e l e n t r y NTSYSCALLAPI NTSTATUS NtOpenProcess ( 2 PHANDLE ProcessHandle , 3 ACCESS MASK DesiredAccess , 4 POBJECT ATTRIBUTES ObjectAttributes , 5 PCLIENT ID C l i e n t I d ) ; Windows Kernel & Driver Development FAU @ Erlangen
- 7. Introduction Windows Kernel Conclusions Functions: Undocumented things Figure: http://undocumented.ntinternals.net/ Windows Kernel & Driver Development FAU @ Erlangen
- 8. Introduction Windows Kernel Conclusions 64-bit Windows Kernel Patch Protection (KPP). Driver Signing. Session Isolation. API Changes (Ex versions) Windows Kernel & Driver Development FAU @ Erlangen
- 9. Introduction Windows Kernel Conclusions Agenda 1 Introduction 2 Windows Kernel 3 Conclusions Windows Kernel & Driver Development FAU @ Erlangen
- 10. Introduction Windows Kernel Conclusions Requirements VCC + WDK You don’t need Visual Studio but You need Visual Studio SysInternals (DebugView) Windows Kernel & Driver Development FAU @ Erlangen
- 11. Introduction Windows Kernel Conclusions Basics Driver Models: FileFilter, WDK & NDIS. Basics: Loading and Unloading. Debugging: Printing debug messages. Windows Kernel & Driver Development FAU @ Erlangen
- 12. Introduction Windows Kernel Conclusions Userland Interaction Loading Driver Object as a file. Writing IO routines. Windows Kernel & Driver Development FAU @ Erlangen
- 13. Introduction Windows Kernel Conclusions First Time Low Level Privileged instructions with intrinsics. Windows Kernel & Driver Development FAU @ Erlangen
- 14. Introduction Windows Kernel Conclusions Monitoring My First Process Callback. Windows Kernel & Driver Development FAU @ Erlangen
- 15. Introduction Windows Kernel Conclusions Agenda 1 Introduction 2 Windows Kernel 3 Conclusions Windows Kernel & Driver Development FAU @ Erlangen
- 16. Introduction Windows Kernel Conclusions References: Books Figure: https://blogs.msdn.microsoft.com/microsoft_press/2017/05/ 09/new-book-windows-internals-seventh-edition-part-1/ Windows Kernel & Driver Development FAU @ Erlangen
- 17. Introduction Windows Kernel Conclusions References: Books Figure: https://www.amazon.com/ Rootkits-Subverting-Windows-Greg-Hoglund/dp/0321294319 Windows Kernel & Driver Development FAU @ Erlangen
- 18. Introduction Windows Kernel Conclusions References: Papers Who watches the watchmen: A security-focused review on current state-of-the-art techniques, tools and methods for systems and binary analysis on modern platforms—ACM Computing Surveys. Enhancing Branch Monitoring for Security Purposes: From Control Flow Integrity to Malware Analysis and Debugging—ACM Transactions on Privacy and Security. Windows Sandbox → The other guys: automated analysis of marginalized malware—Journal of Computer Virology and Hacking techniques. Windows Kernel & Driver Development FAU @ Erlangen
- 19. Introduction Windows Kernel Conclusions Conclusions Thanks Thanks Tilo for hosting me. Thanks CTF guys for inviting me. Open to hear your questions. Contact mfbotacin@inf.ufpr.br https://github.com/marcusbotacin Windows Kernel & Driver Development FAU @ Erlangen