The document discusses Windows kernel and driver development. It begins with introductions and an overview of the Windows kernel model. The presenter then discusses various topics related to Windows kernel and driver development like driver models, loading and debugging drivers, userland interaction, privileged instructions, and process monitoring. The document concludes by thanking the host and mentioning references like books and papers for further reading.

1. Introduction Windows Kernel Conclusions
Windows Kernel & Driver Development
Marcus Botacin1
1Informatics - Federal University of Parana (UFPR) - Brazil
mfbotacin@inf.ufpr.br
November 2018
Windows Kernel & Driver Development FAU @ Erlangen

2. Introduction Windows Kernel Conclusions
Agenda
1 Introduction
2 Windows Kernel
3 Conclusions
Windows Kernel & Driver Development FAU @ Erlangen

3. Introduction Windows Kernel Conclusions
Agenda
1 Introduction
2 Windows Kernel
3 Conclusions
Windows Kernel & Driver Development FAU @ Erlangen

4. Introduction Windows Kernel Conclusions
About Me
Malware Analyst (2012)
BsC. Computer Engineer @ UNICAMP (2015)
Sandbox Development
MsC. Computer Science @ UNICAMP (2017)
Hardware-Assisted Malware Analysis
PhD. Computer Science @ UFPR (Present)
Hardware-Assisted Malware Detection
AntiVirus Evaluation
Future Threats
Contextual and Social Malware effects
Windows Kernel & Driver Development FAU @ Erlangen

5. Introduction Windows Kernel Conclusions
Windows Model: Kernel Entering
Figure: https://blogs.msdn.microsoft.com/hanybarakat/2007/
02/25/deeper-into-windows-architecture/
Windows Kernel & Driver Development FAU @ Erlangen

6. Introduction Windows Kernel Conclusions
Function Prototypes: Multiple Contexts
Wrapper
1 HANDLE OpenProcess (
2 DWORD dwDesiredAccess ,
3 BOOL bInheritHandle ,
4 DWORD dwProcessId ) ;
Complete Version
1 k e r n e l e n t r y NTSYSCALLAPI NTSTATUS NtOpenProcess (
2 PHANDLE ProcessHandle ,
3 ACCESS MASK DesiredAccess ,
4 POBJECT ATTRIBUTES ObjectAttributes ,
5 PCLIENT ID C l i e n t I d ) ;
Windows Kernel & Driver Development FAU @ Erlangen

7. Introduction Windows Kernel Conclusions
Functions: Undocumented things
Figure: http://undocumented.ntinternals.net/
Windows Kernel & Driver Development FAU @ Erlangen

8. Introduction Windows Kernel Conclusions
64-bit Windows
Kernel Patch Protection (KPP).
Driver Signing.
Session Isolation.
API Changes (Ex versions)
Windows Kernel & Driver Development FAU @ Erlangen

9. Introduction Windows Kernel Conclusions
Agenda
1 Introduction
2 Windows Kernel
3 Conclusions
Windows Kernel & Driver Development FAU @ Erlangen

10. Introduction Windows Kernel Conclusions
Requirements
VCC + WDK
You don’t need Visual Studio but You need Visual Studio
SysInternals (DebugView)
Windows Kernel & Driver Development FAU @ Erlangen

11. Introduction Windows Kernel Conclusions
Basics
Driver Models: FileFilter, WDK & NDIS.
Basics: Loading and Unloading.
Debugging: Printing debug messages.
Windows Kernel & Driver Development FAU @ Erlangen

12. Introduction Windows Kernel Conclusions
Userland Interaction
Loading Driver Object as a file.
Writing IO routines.
Windows Kernel & Driver Development FAU @ Erlangen

13. Introduction Windows Kernel Conclusions
First Time Low Level
Privileged instructions with intrinsics.
Windows Kernel & Driver Development FAU @ Erlangen

14. Introduction Windows Kernel Conclusions
Monitoring
My First Process Callback.
Windows Kernel & Driver Development FAU @ Erlangen

15. Introduction Windows Kernel Conclusions
Agenda
1 Introduction
2 Windows Kernel
3 Conclusions
Windows Kernel & Driver Development FAU @ Erlangen

16. Introduction Windows Kernel Conclusions
References: Books
Figure:
https://blogs.msdn.microsoft.com/microsoft_press/2017/05/
09/new-book-windows-internals-seventh-edition-part-1/
Windows Kernel & Driver Development FAU @ Erlangen

17. Introduction Windows Kernel Conclusions
References: Books
Figure: https://www.amazon.com/
Rootkits-Subverting-Windows-Greg-Hoglund/dp/0321294319
Windows Kernel & Driver Development FAU @ Erlangen

18. Introduction Windows Kernel Conclusions
References: Papers
Who watches the watchmen: A security-focused review on
current state-of-the-art techniques, tools and methods for
systems and binary analysis on modern platforms—ACM
Computing Surveys.
Enhancing Branch Monitoring for Security Purposes: From
Control Flow Integrity to Malware Analysis and
Debugging—ACM Transactions on Privacy and Security.
Windows Sandbox → The other guys: automated analysis of
marginalized malware—Journal of Computer Virology and
Hacking techniques.
Windows Kernel & Driver Development FAU @ Erlangen

19. Introduction Windows Kernel Conclusions
Conclusions
Thanks
Thanks Tilo for hosting me.
Thanks CTF guys for inviting me.
Open to hear your questions.
Contact
mfbotacin@inf.ufpr.br
https://github.com/marcusbotacin
Windows Kernel & Driver Development FAU @ Erlangen