Note: I also followed this: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/boot-parameters-to-enable-debugging to get debugging working
Windows Drivers Part 2: IOCTLs
In this article, we are going to delve further into how a kernel driver works. In the first part, we talked about getting an environment set up. A lot of this comes from this article.
A driver is purely in kernel space, but it exists to service user space programs, and…
Loading a driver on the fly
In previous entries, the way we have loaded a device driver was to use OSR’s Driver Loader so that we could quickly install, uninstall, start, and stop the service. We did this because it was quicker than putting an entry in the registry (which requires a reboot to complete). So how to do you load…
Basic Shellcode — Stack Smashing (No DEP, No ASLR)
Ten years ago, the world was just recovering from the dot com bubble, running Windows XP SP1, worrying about all of the remote exploits that were flying around, and running code without Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR). Ten years…
More Driver Debugging
Attaching WinDbg to a VM to be able to get debugging output and create breakpoints is good, but if you don’t know how to use it, then its not terribly useful. However, in the cases we are working with (where we are developing and testing the code), we would have a lot more insight into what the driver…
