Windows Drivers Series Part 1 - Overview
Introduction to the Windows driver exploitation series — who it's for, what tools you'll need, and why drivers are a great target.
Multi-part series
8 parts
Introduction to the Windows driver exploitation series — who it's for, what tools you'll need, and why drivers are a great target.
A history of Windows drivers and an explanation of what they are, the different types, and how they fit into the modern Windows kernel.
Setting up a driver development environment in Visual Studio and writing a minimal kernel driver that loads and unloads.
How IRPs, IO Stack Locations, and dispatch functions work together to let user-mode applications communicate with kernel drivers.
Building a driver that handles DeviceIoControl requests and exploring buffered, direct, and neither I/O methods.
Setting up a kernel debugger, loading a driver into IDA, rebasing the text segment, and tracing IRPs through a live driver.
Developing a kernel stack buffer overflow exploit against HackSysExtremeVulnerableDriver on 32-bit Windows 7 with token-stealing shellcode.
Porting the HEVD buffer overflow exploit to 64-bit Windows 8.1 and using ROP to bypass Supervisor Mode Execution Prevention.