Introductory

Windows kernel reversing: the intro

From zero to reading a Windows driver's IOCTL dispatch like a map. The intro nobody bothered to write.

14 lessons ~6 hours Introductory

$59 $39 Launch price. Lifetime access, every future module included.

get in touch to enroll already enrolled →

what you'll walk away with

Read a Windows kernel driver in a disassembler without drowning in noise.
Trace the path from a user-mode DeviceIoControl call to the kernel handler that services it.
Spot the IOCTL dispatch table and map every code to the function behind it.
Recognise the bug classes that actually matter in drivers, and why they happen.
Set up a safe kernel-debugging lab with WinDbg and a VM, the way pros run it.
Talk about ring-0 attack surface without sounding like you read one blog post.

Every kernel resource out there has the same problem. The tutorials stop at “hello world driver.” The exploit write-ups assume you already know everything. There’s a canyon in the middle, and nobody built a bridge.

This is the bridge.

You build a real kernel driver from source, load it in a debugger, and reverse it in Ghidra as if you had never seen the code. You chase a convincing false lead, learn why it is safe on close reading, and then find the actual bug: a missing ProbeForRead in a METHOD_NEITHER handler that turns one IOCTL into an arbitrary kernel read primitive.

By the end you have read the ntoskrnl PE header from ring 3 and verified every byte in WinDbg. You understand what a defender sees when this happens. And you know the complete loop: surface identification, handler mapping, careful code reading, primitive proof.

No padding. No 45-minute “what is a computer” intro. The first module is free.

who this is for

Reversers comfortable in user mode who want to cross into the kernel.
Vuln researchers eyeing driver attack surface for the first time.
Blue teamers and detection engineers who want to understand what they’re defending.
Curious people who can read C and aren’t scared of a disassembler.

curriculum

01
Setup and the mental model free preview 3 lessons
What kernel mode actually is, the user/kernel boundary, a safe lab with WinDbg, and your first look at the driver you will spend the rest of the course reversing.
02
How a driver gets reached 2 lessons
Device objects, symbolic links, IRP_MJ_DEVICE_CONTROL, and the full journey of a DeviceIoControl call traced in WinDbg.
- Device objects and IRPs
- Tracing the call
03
Walking the IOCTL dispatch 3 lessons
Finding the dispatch routine in Ghidra, decoding IOCTL codes by hand, and mapping all four handlers before reading a line of their body.
04
Reading disassembly without drowning 2 lessons
A triage workflow for unfamiliar handlers. Applied to two suspicious handlers, one of which turns out to be safe. Learn to verify before you accuse.
- Reversing workflow
- The red herring
05
The bug classes that matter 1 lesson
METHOD_NEITHER semantics, missing probe calls, and a full read of the vulnerable handler. Then compile and run the user-mode client to exercise every IOCTL.
- Bug classes and METHOD_NEITHER
06
Proving the primitive and the defender's view 3 lessons
Run the PoC, read ntoskrnl's PE header from ring 3, verify every byte in WinDbg. Then close the loop on what defenders see and how this gets caught.

who's teaching this

I’m Emil. I write dkom.dev and spend my days in the ring-0 trenches: drivers, hypervisors, injection, and the detection that tries to catch all of it. This course is the thing I wish existed when I started, minus the years of trial and error.

Read the free research on the blog to see how I work before you spend a krone.

questions

Do I need to already know assembly?

You need to read C and not panic at a disassembler. x64 assembly is covered as we go, in the context of real driver code rather than abstract instruction tables.

Is this a weaponised exploit course?

No. This is about reading and understanding drivers and their attack surface. You will find a real vulnerability in a real (training) driver and trigger a real kernel read primitive. The skills apply equally to offense, defense, and research.

What about lifetime access and updates?

You buy it once, you keep it. The kernel changes, and so does this course. New modules and corrections land for free.

What tools do I need, and do they cost money?

WinDbg (free), Ghidra (free), Visual Studio Community + WDK (free), and a Windows VM. No paid tooling is required.

I'm on the blue team. Is this useful to me?

Yes. The final module is built from the defender’s perspective: what telemetry fires, what Sysmon catches, what requires kernel-level instrumentation. You can’t write good detections for an attack surface you can’t read.

Refunds?

The first module is a free preview: three lessons, no paywall. If the paid content isn’t what I promised, email me within 14 days and I’ll refund you.

$59 $39 Launch price. Lifetime access, every future module included.

get in touch to enroll already enrolled →

# what you'll walk away with

# who this is for

# curriculum

# who's teaching this

# questions

what you'll walk away with

who this is for

curriculum

who's teaching this

questions