kernel-mode-analysis

name	Kernel Mode Analysis
description	Comprehensive kernel driver vulnerability analysis — IOCTL handlers, dangerous APIs, exploitation primitives
tags	["kernel","driver","windows","ioctl","vulnerability","privilege-escalation"]
allowed_tools	["analyze_kernel_driver","search_kernel_vulnerabilities","list_ioctl_handlers","decompile_function","list_imports","search_strings","get_disasm"]

Task: Kernel Mode Vulnerability Analysis. Perform a comprehensive security audit of a kernel-mode driver.

Analysis Goals

Identify vulnerabilities that could lead to:

• Kernel code execution
• Privilege escalation (user → kernel/SYSTEM)
• Information disclosure (kernel address leaks)
• System compromise

Mandatory First Steps

1. Identify Driver Type

   • Use analyze_kernel_driver for automatic detection
   • Check import list for kernel API signatures (Zw*, Ps*, Io*)
   • Identify device names and symbolic links

2. Locate DriverEntry

   • Usually at the binary entry point
   • Look for DRIVER_OBJECT initialization
   • Extract dispatch table assignments

3. Map IOCTL Handlers

   • Use list_ioctl_handlers to enumerate all handlers
   • Document each IOCTL code and its transfer type
   • Flag METHOD_NEITHER as high-risk

Vulnerability Categories

1. Stack Buffer Overflow

Pattern: char buffer[128]; memcpy(buffer, user_buf, user_size);

• Location: IOCTL handlers, dispatch routines
• Impact: Kernel code execution, system compromise
• Check: Missing size validation, bounded copies

2. Heap Overflow (Pool Overflow)

Pattern: pool = ExAllocatePoolWithTag(size); copy(user_buf, pool, user_size);

• Target: Pool allocation, object corruption
• Impact: Adjacent kernel object corruption
• Check: Allocation size vs copy size mismatch

3. Use-After-Free

Pattern: ObDereferenceObject(obj); ... obj->method();

• Location: Driver cleanup, object lifetime management
• Impact: Vtable hijack, arbitrary function call
• Check: Reference counting bugs, dangling pointers

4. Integer Overflow

Pattern: size = user_count * sizeof(struct); pool = ExAllocatePoolWithTag(size);

• Location: Allocation size calculations
• Impact: Wraparound → small alloc, large copy
• Check: Multiplication before allocation checks

5. Missing Validation (METHOD_NEITHER)

Pattern: IOCTL with METHOD_NEITHER, no ProbeForRead/ProbeForWrite

• Location: IOCTL handlers
• Impact: User pointers accessed directly
• Check: Look for raw user pointer access

6. Information Disclosure

Pattern: Kernel addresses leaked to user mode

• Targets: Kernel base, driver base, heap addresses
• Impact: KASLR bypass
• Check: Uninitialized memory, info leak vulnerabilities

Dangerous Kernel APIs

Flag these when found:

• MmCopyMemory - Check bounds validation
• ZwOpenProcess - EPROCESS access
• PsGetCurrentProcess - Current EPROCESS location
• IoAllocateMdl - MDL manipulation
• KeStackAttachProcess - Process attachment

Exploitation Primitives

Token Privilege Escalation

1. Find current process EPROCESS
2. Locate SYSTEM process EPROCESS
3. Copy SYSTEM token → Current process token
4. Trigger: cmd.exe runs as SYSTEM

Arbitrary Read/Write

1. Build pool overflow primitive
2. Spray kernel pool with controlled objects
3. Overflow adjacent object pointers
4. Achieve arbitrary kernel R/W

Mitigation Bypass

• SMEP - Stack pivot to user-mode, ROP-only exploit
• SMAP - Data-only attacks, disable CR4 bit 20
• KPTI - Info leak before KPTI, speculative execution
• CFG - Find compatible gadgets, bypass with indirect calls

Report Format

For each vulnerability found:

[Kernel Vulnerability] DriverName.IoctlCode
Type: Stack Buffer Overflow
Location: Driver+0x1234 (IOCTL handler)
Impact: Kernel code execution, SYSTEM privilege escalation

[Bug Details]
- IOCTL: 0x222003 (METHOD_NEITHER)
- Buffer: 128-byte stack buffer
- Copy: Unbounded memcpy from user input
- Missing: Size validation

[Exploitation]
1. Trigger IOCTL with oversized input
2. Overflow stack buffer
3. Control return address
4. Pivot to user-mode ROP chain
5. Copy SYSTEM token

[POC]
#include <windows.h>
HANDLE drv = CreateFile("\\.\\VulnDriver", ...);
DeviceIoControl(drv, 0x222003, payload, size, NULL, 0, &out, NULL);
system("cmd.exe"); // SYSTEM

Severity: CRITICAL
Bypasses: SMEP, SMAP, KPTI

Tools to Use

• analyze_kernel_driver - Full driver analysis
• search_kernel_vulnerabilities - Pattern-based search
• list_ioctl_handlers - IOCTL enumeration
• decompile_function - Detailed code analysis
• list_imports - API discovery