This Notion page contains notes, blogs, and resources regarding advanced reverse engineering and exploitation techniques to aid you preparing for AWE course and OSEE certification by OffSec.

Table of Contents ☠︎︎ 目次

$$ ⋆༺𓆩☠︎︎𓆪༻⋆ $$

Windows Kernel Exploitation

Fundamental Internals 内部詳細解説

How a driver is invoked via user-mode:

                        +--------------------+
                        | Call ReadFile()    | App.exe
                        +--------------------+ 
                        +---------↓----------+
                        | Call NtReadFile()  | Kernel32.dll
                        +--------------------+
                        +---------↓----------+
                        | sysenter / syscall | ntdll.dll
                        +---------↓----------+
 User Mode
--------------------------------------↓-------------------------------------
 Kernel Mode
                        +---------↓----------+
                        | call NtReadFile()  | ntoskrnl.exe
                        +---------↓----------+
                        +--------------------+
                        | NtReadFile:        | ntoskrnl.exe
                        | Call driver        |
                        +---------↓----------+
                        +--------------------+
                        | Initiate I/O       | driver.sys
                        +--------------------+

IRP (I/O Request Packet): is a structure that contains information about the I/O operation (I.e Function) to be performed, such as the IO_STACK which holds I/O control code, the device object, the buffer for data transfer, and other relevant parameters.

IOCTL (Input/Output Control) Code: is a mechanism to send control commands to a device driver from user-mode applications.

Every IRP has an I/O Stack, and each I/O stack location consists of an IO_STACK_LOCATION structure, which contains information about the IRP and its operation, Major and *Minor functions, *DeviceObject, FileObject and arguments.

Most common IRP major functions: