dkom.dev
kernel internals · reverse engineering · detection engineering
Field notes on Windows kernel internals, driver reverse engineering, and the detection engineering that comes after. Mostly things I wish I’d found written down when I went looking.
What ends up here: IOCTL dispatch reversing, EDR and anticheat kernel callbacks, process injection primitives, inline and EPT hooking, hypervisor internals (VT-x, EPT, Hyper-V), BYOVD, DSE and code-signing, and the telemetry that catches all of it. Working code and diagrams where they help.
recent posts
-
Finding unexported kernel symbols without a symbol server
A pattern scanner maps a PE as a section image, scans for a unique byte sequence with a wildcard mask, and decodes the RIP-relative displacement to recover the symbol …
-
DSE bypass: why CiValidateImageHeader is the right target
Driver Signature Enforcement is enforced by CiValidateImageHeader in CI.dll, not by g_CiOptions alone. Patching the function directly with a physical write or PTE flip …
-
[Hypervisor Part 3] Making Your Kernel Hook Invisible with EPT Shadow Pages
EPT shadow page hooks split a physical page into two views: one seen by reads (original bytes), one executed (hooked bytes). Integrity scanners see clean code. The CPU …
-
[Hypervisor Part 2] Hijacking Hyper-V's VM-Exit Handler from Inside the Guest
How the hypervisor detours Hyper-V’s VM-exit handler, the CPUID-based hypercall ABI including the bitfield bug that burned me, and how we resolve arbitrary process …
-
[Hypervisor Part 1] What a Hypervisor Actually Does (And Why Your Ring-0 Code Should Care)
A ground-up explanation of what hypervisors do at the CPU level, how Windows runs under Hyper-V by default, what a VM-exit is and when it happens, and why this matters …
-
Kernel UDP socket server via WSK: covert comms with no IOCTL surface
WSK lets a kernel driver bind a UDP socket and communicate with user mode without a device object, symbolic link, or IOCTL dispatch table. EnumDeviceObjects and …
-
Binary-searching your payload: how AV signatures work and how to find them
Defender flags your file but won’t tell you why. Binary search the file to isolate the triggering bytes, then read what those bytes are to understand what kind of …
-
Self-deleting executables: NTFS alternate data streams and POSIX semantics
How a running process can erase its own executable from disk using NTFS ADS renaming and FILE_DISPOSITION_FLAG_POSIX_SEMANTICS, and what forensic traces survive.
-
Anti-debug techniques and the telemetry each one generates
Ten anti-debug checks paired with the exact ETW providers, Sysmon event IDs, and forensic artifacts each one leaves behind – a reference for both sides of the …
-
Finding EPROCESS from the GS register
Most kernel code that needs a process structure starts from PsInitialSystemProcess or PsActiveProcessHead – both exported symbols. If the export table is …
-
The four callbacks an EDR kernel driver uses
PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, and ObRegisterCallbacks: what each one gives you, what it misses, and how …
-
Mapping kernel code without pool traces
MmAllocateIndependentPagesEx allocates pages directly from the PFN database, bypassing pool accounting entirely. Combine that with the Intel NAL BYOVD primitive and a …