Writing a Windows Kernel Driver in an hour or two
summary
Builds a small WDM driver and a userland client in about an hour that lets the client get powerful handles to protected processes (example: CSRSS) so it can list DLLs. Uses Visual Studio 2022 + Windows 11 SDK/WDK, installs with sc create/start in a VM with test-signing mode enabled, exposes a device via IoCreateSymbolicLink and handles requests with DeviceIoControl METHOD_BUFFERED. The kernel side calls ZwOpenProcess PROCESS_ALL_ACCESS and returns the handle; the demo compiles, loads, and successfully shows the protected process DLLs.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:56Project goal and limits
- 6:53Kernel drivers and APIs
- 13:09Setting up the development environment
- 18:05Modifying the user mode application for driver integration
- 24:44Kernel driver project
- 32:15Driver entry and device setup
- 41:03Symbolic links for access
- 45:17Device control routine
- 55:35Compiling the driver
- 56:16Installing the driver
- 57:43Testing with client app
- 1:00:29Q&A
related talks
43mDefeating Windows Anti-Exploit & Security Features with WHQL Kernel Drivers
56mWindows Kernel Graphics Driver Attack Surface
52mThe Linux Kernel Hidden Inside Windows 10
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
32mIntroduction to Windows Kernel Mode Debugging
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
46mFor The Win: The Art Of The Windows Kernel Fuzzing
01h 24mWindows Native API