drivers
-
DSE bypass: why CiValidateImageHeader is the right target
Driver Signature Enforcement is enforced by CiValidateImageHeader in CI.dll, not by g_CiOptions alone. Patching the function directly with a physical write or PTE flip …
-
Kernel UDP socket server via WSK: covert comms with no IOCTL surface
WSK lets a kernel driver bind a UDP socket and communicate with user mode without a device object, symbolic link, or IOCTL dispatch table. EnumDeviceObjects and …
-
Finding EPROCESS from the GS register
Most kernel code that needs a process structure starts from PsInitialSystemProcess or PsActiveProcessHead – both exported symbols. If the export table is …
-
The four callbacks an EDR kernel driver uses
PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, and ObRegisterCallbacks: what each one gives you, what it misses, and how …
-
Thread start address inspection: how EDR kernel drivers catch shellcode
PsSetCreateThreadNotifyRoutine fires for every new thread. This post shows how an EDR kernel driver turns that callback into a start-address inspection pipeline, what the …
-
Handle stripping: how EDR kernel drivers protect their own process
ObRegisterCallbacks lets a kernel driver intercept every handle open before it completes. EDRs use this to strip dangerous access bits from any handle targeting their own …
-
Fingerprinting anti-cheat by its pool allocation pattern
BattleEye resolves ExAllocatePool at runtime via MmGetSystemRoutineAddress. Intercept that resolution and you can gate every pool allocation BE makes – returning …
-
Intercepting BattleEye's ObRegisterCallbacks at registration time
Removing BattleEye’s object callbacks is detectable. Intercepting the registration itself lets you subvert the callback’s effect while leaving it fully …
-
Code caves in signed kernel drivers
Unsigned executable memory in the kernel is an immediate red flag. Shellcode placed in the padding bytes of a legitimate signed Microsoft driver executes inside that …
-
Walking a Driver's IOCTL Dispatch by Hand
Finding the IOCTL dispatch table in a stripped kernel driver, decoding CTL_CODEs from first principles, and the triage methodology for prioritising attack surface before …
-
NtLoadDriver vs SCM: what each leaves behind
Creating a service through SCM and calling NtLoadDriver directly leave different artifacts. Knowing exactly what each approach leaves – event log entries, registry …