Series

Multi-part series

Windows Drivers

8 parts

Introduction to the Windows driver exploitation series — who it's for, what tools you'll need, and why drivers are a great target.

A history of Windows drivers and an explanation of what they are, the different types, and how they fit into the modern Windows kernel.

Setting up a driver development environment in Visual Studio and writing a minimal kernel driver that loads and unloads.

How IRPs, IO Stack Locations, and dispatch functions work together to let user-mode applications communicate with kernel drivers.

Building a driver that handles DeviceIoControl requests and exploring buffered, direct, and neither I/O methods.

Setting up a kernel debugger, loading a driver into IDA, rebasing the text segment, and tracing IRPs through a live driver.

Developing a kernel stack buffer overflow exploit against HackSysExtremeVulnerableDriver on 32-bit Windows 7 with token-stealing shellcode.

Porting the HEVD buffer overflow exploit to 64-bit Windows 8.1 and using ROP to bypass Supervisor Mode Execution Prevention.