u/RicochetTechin r/ReverseEngineering • Recommends
CREATE your own Windows DEVICE DRIVER with BUGS... then travel "behind the Blue Screen" into ring 0 with Windows Kernel Debugger!! 🖥️🪰🧑‍💻
0:00 / 0:00
#windbg#windowsdriverkit#kerneldebugging
CREATE and DEBUG a Windows KERNEL device driver!
AshleyPurringTech
3.2K subscribers • 1 video on Hallway
- Recommended by 1 person: 1 in engineering communities.
- Linked in the descriptionAshleyT3/tutorial-sample-code
Advanced. Deep dive for people who know the field.
11K views2 years ago1 recommendation
Systems programmingTools and practiceOperating systemsDebugging
A comprehensive tutorial on writing a Windows kernel driver and debugging page faults using WinDbg.
Peer into the Windows kernel ("ring 0") using Windows Kernel Debugger as you are introduced to Windows Device Driver Development. 💎✨ Highlights ✨💎 • Write a starter "hello world" Windows Device Driver! • Use Windows Kernel Debugger to peer into the kernel's depths! • Setup Windows Driver Kit, Visual Studio 2022, Debugging Tools for Windows. • Use WinDbg for kernel debugging, "peering into ring 0." • Intro to Page Faults (PFs). • Directly see a cause of PAGE_FAULT_IN_NONPAGED_AREA. • Add bugs to your driver to learn about kernel debugging, Page Faults, more! • Observe/compare/contrast various page faults. • Examine AMD/Intel processor page fault stacks/registers. • Use WinDbg !pte to examine "valid/invalid" addresses. • Much much more!!! ✨ Tutorial source code ✨ 1. git clone github.com/AshleyT3/tutorial-sample-code 2. All drivers within ./src/Intro-Windows-Driver-Development-and-Kernel-Debugging-Tutorial/... kmdrvhw-1-initial-driver kmdrvhw-2-use-after-free kmdrvhw-3-multi-bug-driver ✅ Companion video! Setup Windows KERNEL DEBUGGER on Azure Virtual Machines! youtu.be/YxvfNMi87Hk ✨ Table of Contents ✨ Start Intro Bug check intro Protection ring WHQL Testing All seeing, all powerful Bug check intro pt2 This video's goals Windows kernel debugging intro Doorway to ring 0 pt1 Cautionary words pt1 Windows Driver Kit setup Create a device driver Driver hardware id Build the driver Provision target intro Cautionary words pt2 Provision target prep Provision target Deploy prep Deploy driver Debug driver preface Doorway to ring 0 pt2 DriverEntry intro Host debugger setup Cautionary words pt3 Start debugger Break not working? Symbol path setup Observe frozen target .reload /f Debugger interactions recap !process 0 0 explorer.exe Interrupt command 'g' command Deploy driver 2 Driver service reg key DriverEntry intro pt2 DriverEntry breakpoint sxe ld Deploy to Break Examine callstack 'lm' list modules 'x' examine symbols 'bm' to set breakpoint BPs in workspace Break in DriverEntry Initial source window F9, bp current line F10 step All powerful pt2 Examine callstack 2 (Pnp, Fx) Bug check intro pt3 Memory management use-after-free (undetected) logical vs physical validity pool tag intro Pool tag in memory use-after-free non-paged pool !vm 0x20 pool tag pt2 invalid non-paged memory driver verifier, use-after-free revisited enable 'verifier' db poi(ptrWhy it's here
1 person recommends thisWhat people say. Recommended as an incredibly detailed, hands-on guide to Windows kernel driver development and debugging.