Menu
Comprehensive kernel driver vulnerability analysis — IOCTL handlers, dangerous APIs, exploitation primitives
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | Kernel Mode Analysis |
| description | Comprehensive kernel driver vulnerability analysis — IOCTL handlers, dangerous APIs, exploitation primitives |
| tags | ["kernel","driver","windows","ioctl","vulnerability","privilege-escalation"] |
| allowed_tools | ["analyze_kernel_driver","search_kernel_vulnerabilities","list_ioctl_handlers","decompile_function","list_imports","search_strings","get_disasm"] |
Task: Kernel Mode Vulnerability Analysis. Perform a comprehensive security audit of a kernel-mode driver.
Identify vulnerabilities that could lead to:
Identify Driver Type
analyze_kernel_driver for automatic detectionLocate DriverEntry
Map IOCTL Handlers
list_ioctl_handlers to enumerate all handlersPattern: char buffer[128]; memcpy(buffer, user_buf, user_size);
Pattern: pool = ExAllocatePoolWithTag(size); copy(user_buf, pool, user_size);
Pattern: ObDereferenceObject(obj); ... obj->method();
Pattern: size = user_count * sizeof(struct); pool = ExAllocatePoolWithTag(size);
Pattern: IOCTL with METHOD_NEITHER, no ProbeForRead/ProbeForWrite
Pattern: Kernel addresses leaked to user mode
Flag these when found:
1. Find current process EPROCESS
2. Locate SYSTEM process EPROCESS
3. Copy SYSTEM token → Current process token
4. Trigger: cmd.exe runs as SYSTEM
1. Build pool overflow primitive
2. Spray kernel pool with controlled objects
3. Overflow adjacent object pointers
4. Achieve arbitrary kernel R/W
For each vulnerability found:
[Kernel Vulnerability] DriverName.IoctlCode
Type: Stack Buffer Overflow
Location: Driver+0x1234 (IOCTL handler)
Impact: Kernel code execution, SYSTEM privilege escalation
[Bug Details]
- IOCTL: 0x222003 (METHOD_NEITHER)
- Buffer: 128-byte stack buffer
- Copy: Unbounded memcpy from user input
- Missing: Size validation
[Exploitation]
1. Trigger IOCTL with oversized input
2. Overflow stack buffer
3. Control return address
4. Pivot to user-mode ROP chain
5. Copy SYSTEM token
[POC]
#include <windows.h>
HANDLE drv = CreateFile("\\.\\VulnDriver", ...);
DeviceIoControl(drv, 0x222003, payload, size, NULL, 0, &out, NULL);
system("cmd.exe"); // SYSTEM
Severity: CRITICAL
Bypasses: SMEP, SMAP, KPTI
analyze_kernel_driver - Full driver analysissearch_kernel_vulnerabilities - Pattern-based searchlist_ioctl_handlers - IOCTL enumerationdecompile_function - Detailed code analysislist_imports - API discoveryNext-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis