Kernel Programming Master Class

Windows Kernel Programming
Master Class
Course Summary Table
Duration: 6 Days (48 hours)
Target Audience: Experienced windows developers, interested in developing
kernel mode drivers
Objectives: • Understand the Windows kernel driver programming
model
• Write drivers for monitoring processes, threads, registry
and some types of objects
• Write file system mini-filter drivers
• Write Windows Filtering Platform Callouts
Pre-Requisites: • At least one year of experience working with the
Windows API (user mode)
• Basic understanding of Windows OS concepts such as
processes, threads, virtual memory and DLLs
Software • Windows 10 or 11 64 bit (any SKU, latest stable version)
requirements: • Visual Studio 2022 (any SKU) + latest update
• Windows 11 SDK (latest)
• Windows 11 WDK (latest)
• Virtual Machine for testing and debugging
Instructor: Pavel Yosifovich
Abstract
The cyber security industry has grown considerably in recent years, with more sophisticated
attacks and consequently more defenders. To have a fighting chance against these kinds of
attacks, kernel mode drivers must be employed, where nothing (at least nothing from user
mode) can escape their eyes.
The course provides the foundations for the most common software device drivers that are
useful not just in cyber security, but also other scenarios, where monitoring and sometimes
prevention of operations is required. Participants will write real device drivers with useful
features that can then be modified and adapted to their particular needs.
The course includes tips and techniques employed by the instructor in their own projects,
based on years of experience.
Syllabus
• Module 1: Windows Internals quick overview

o Processes
o Virtual memory
o Threads
o System architecture
o User / kernel transitions
o Kernel Design
o Introduction to WinDbg
o Windows APIs
o Objects and handles
o Summary
• Module 2: The I/O System

o I/O System overview
o Device Drivers
o Driver Models
o Driver types
o Software drivers
o Driver and device objects
o Looking at Existing Drivers
o I/O Processing and Data Flow
o Accessing devices
o Asynchronous I/O
o Summary
• Module 3: Device Drivers Basics

o Setting up for Kernel Development
o Basic Kernel types and conventions
o C++ in a kernel driver
o Creating a driver project
o The kernel API
o Strings
o Linked Lists
o Object Attributes
o The DriverEntry function
o The Unload routine
o Installation
o Testing
o Debugging
o Summary
o Lab: write and deploy a simple driver; debug a driver
• Module 4: The I/O Request Packet

o Creating a device object
o Exporting a device name
o Building a driver client
o Driver dispatch routines
o Introduction to I/O Request Packets (IRPs)
o Completing IRPs
o Accessing User Buffers
o Handling DeviceIoControl calls
o Handling Asynchronous Operations
o Summary
o Lab: access any process; use Direct I/O
• Module 5: Kernel mechanisms

o Interrupt Request Levels (IRQLs)
o Deferred Procedure Calls (DPCs)
o Dispatcher objects
o Low IRQL Synchronization
o Spin locks
o Driver-Created Threads
o Work items
o Timers
o Summary
• Module 6: Programming Techniques

o Attaching to Processes Address Space
o Object to Handle
o Handle to Object
o Handle Duplication
o C++ RAII
o Advanced Memory Management
o Using Linked Lists
o Strings
• Module 7: Process and thread monitoring

o Motivation
o Process creation/destruction callback
o Specifying process creation status
o Thread creation/destruction callback
o Notifying user mode
o Writing a user mode client
o Preventing potentially malicious processes from executing
o Summary
o Lab: ProcMon-like process/thread operation monitoring
• Module 8: Object and Registry notifications

o Process/thread object notifications
o Pre and post callbacks
o Registry notifications
o Performance considerations
o Reporting results to user mode
o Summary
• Module 9: File system mini filters
o File system model
o Filters vs. mini filters
o The Filter Manager
o Filter registration
o Pre and Post callbacks
o File name information
o Contexts
o File system operations
o Filter to user mode communication
o Debugging mini-filters
o Lab: preventing certain file deletion
o Summary
• Module 10: Windows Filtering Platform

o WFP Architecture
o Layers, Filters, and Callouts
o WFP API
o WFP Management
o Callout Drivers
o Putting it all together
o Summary
• Module 11: Programming Techniques II

o Using Native APIs
o Trace Logging
o Hooking Drivers
o Plug & Play
o IRP Propagation
o Writing Generic Filter Drivers
o Completion Routines
o Driver Verifier
o Summary
• Module 12: Introduction to KMDF

o Why KMDF?
o KMDF Object Model
o KMDF vs. WDM
o Fundamental Objects
o DriverEntry and AddDevice
o I/O Request Flow
o INF Files
o Writing a Client
o Summary

Kernel Programming Master Class

Uploaded by

Copyright:

Available Formats

Kernel Programming Master Class

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Kernel Programming Master Class

Uploaded by

Copyright:

Available Formats

Windows Kernel Programming

Instructor: Pavel Yosifovich

• Module 1: Windows Internals quick overview

• Module 2: The I/O System

• Module 3: Device Drivers Basics

• Module 4: The I/O Request Packet

• Module 5: Kernel mechanisms

• Module 6: Programming Techniques

• Module 7: Process and thread monitoring

• Module 8: Object and Registry notifications

• Module 10: Windows Filtering Platform

• Module 11: Programming Techniques II

• Module 12: Introduction to KMDF

You might also like