For The Win: The Art Of The Windows Kernel Fuzzing

on YouTube ↗46m

" summary

A kernel fuzzing framework targets Windows kernel objects — GDI and menu/cursor objects — by enumerating API functions with WinDbg, scripting create/operate/destroy sequences, and feeding randomized operation arrays to monitored VMs. Over a year it produces ~10–20 crashes with reproducible POCs including 3–4 Use‑After‑Free and a few race/logic bugs. The tool combines QEMU/KVM + symbolic execution to reach deep branches, needs CPU virtualization and ~4GB memory, and yields a working exploit that escalates a normal user to local SYSTEM escape.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 1:01About the speaker
3. 2:06Windows kernel objects
4. 5:34Fuzzing framework basics
5. 7:34Targeting functions
6. 13:19Fuzzing results
7. 15:41Next-gen fuzzing system
8. 23:23Symbolic execution
9. 26:39Heap overflow demo
10. 35:20Windows kernel exploit
11. 36:59TDI object isolation
12. 44:07Summary and future work

" related talks

• 34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.Sangjun Park, Yunjin Park, Jongseong Kim · CODE BLUE 2024
• 56mWindows Kernel Graphics Driver Attack SurfaceIlja van Sprundel · Black Hat USA 2014
• 50mWhat the FuzzCornelius Aschermann, Sergej Schumilo · Black Hat Europe 2019
• 32mIntroduction to Windows Kernel Mode DebuggingYamin Tian · BSidesSF 2018
• 28mkAFL: Hardware-Assisted Feedback Fuzzing for OS KernelsSebastian Schinzel, Thorsten Holz, Cornelius Aschermann, Sergej Schumilo, Robert Gawlik · 26th USENIX Security Symposium (USENIX Security '17)
• 46mD2T2 - Over The Edge: Pwning The Windows KernelRancho Han · Hack In The Box Amsterdam 2018
• 28mDigtool: A Virtualization-Based Framework for Detecting Kernel VulnerabilitiesJianfeng Pan, Guanglu Yan, Xiaocao Fan · 26th USENIX Security Symposium (USENIX Security '17)
• 40mCommSec D1 - The Life & Death of Kernel Object AbuseSalf ElSherei, Ian Kronquist · Hack In The Box Amsterdam 2018