菜单
Comprehensive kernel driver vulnerability analysis — IOCTL handlers, dangerous APIs, exploitation primitives
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | Kernel Mode Analysis |
| description | Comprehensive kernel driver vulnerability analysis — IOCTL handlers, dangerous APIs, exploitation primitives |
| tags | ["kernel","driver","windows","ioctl","vulnerability","privilege-escalation"] |
| allowed_tools | ["analyze_kernel_driver","search_kernel_vulnerabilities","list_ioctl_handlers","decompile_function","list_imports","search_strings","get_disasm"] |
Task: Kernel Mode Vulnerability Analysis. Perform a comprehensive security audit of a kernel-mode driver.
Identify vulnerabilities that could lead to:
Identify Driver Type
analyze_kernel_driver for automatic detectionLocate DriverEntry
Map IOCTL Handlers
list_ioctl_handlers to enumerate all handlersPattern: char buffer[128]; memcpy(buffer, user_buf, user_size);
Pattern: pool = ExAllocatePoolWithTag(size); copy(user_buf, pool, user_size);
Pattern: ObDereferenceObject(obj); ... obj->method();
Pattern: size = user_count * sizeof(struct); pool = ExAllocatePoolWithTag(size);
Pattern: IOCTL with METHOD_NEITHER, no ProbeForRead/ProbeForWrite
Pattern: Kernel addresses leaked to user mode
Flag these when found:
1. Find current process EPROCESS
2. Locate SYSTEM process EPROCESS
3. Copy SYSTEM token → Current process token
4. Trigger: cmd.exe runs as SYSTEM
1. Build pool overflow primitive
2. Spray kernel pool with controlled objects
3. Overflow adjacent object pointers
4. Achieve arbitrary kernel R/W
For each vulnerability found:
[Kernel Vulnerability] DriverName.IoctlCode
Type: Stack Buffer Overflow
Location: Driver+0x1234 (IOCTL handler)
Impact: Kernel code execution, SYSTEM privilege escalation
[Bug Details]
- IOCTL: 0x222003 (METHOD_NEITHER)
- Buffer: 128-byte stack buffer
- Copy: Unbounded memcpy from user input
- Missing: Size validation
[Exploitation]
1. Trigger IOCTL with oversized input
2. Overflow stack buffer
3. Control return address
4. Pivot to user-mode ROP chain
5. Copy SYSTEM token
[POC]
#include <windows.h>
HANDLE drv = CreateFile("\\.\\VulnDriver", ...);
DeviceIoControl(drv, 0x222003, payload, size, NULL, 0, &out, NULL);
system("cmd.exe"); // SYSTEM
Severity: CRITICAL
Bypasses: SMEP, SMAP, KPTI
analyze_kernel_driver - Full driver analysissearch_kernel_vulnerabilities - Pattern-based searchlist_ioctl_handlers - IOCTL enumerationdecompile_function - Detailed code analysislist_imports - API discoveryNext-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis