Overview
What You Should Expect
After this class, you should have a systematic understanding of Windows kernel to analyze rootkits and develop kernel-mode drivers for your job. You will also understand and apply kernel concepts to carry out forensic investigations on a Windows machine. In addition, you will be able read and understand research on Windows kernel and related subjects. You will no longer feel intimidated by the kernel after this class.
Intended Audience
Malware analysts, systems programmer, forensic analysts, security engineers, network security analysts, kernel enthusiasts.
About the Instructor
Bruce Dang is an information security researcher with interests in low-level systems. He is currently working at Veramine trying to make the world a safer place. He previously worked as a senior security development engineer lead at Microsoft; his team's focus spans all things product security related from hardware, OS, and web services. He specialises in reverse engineering and Windows kernel-level security projects. Before Microsoft, he worked as a developer in the financial sector. He was the first person to publicly discuss techniques of analyzing file format based exploits and has patents in the area of generic shellcode and exploit detection. His public research includes Microsoft Office exploit analysis, ROP detection, shellcode detection, and kernel driver decompilation techniques; on the malware side, he is known for first analyzing vulnerabilities in the Stuxnet worm. He has spoken at major security conferences worldwide, i.e., REcon (Canada), Blackhat (Vegas and Tokyo), Chaos Computer Club (Germany), Computer Antivirus Research Organization (Hungary), etc. In addition to sharing his knowledge at public conferences, he has also provided private training and lectures to government agencies. He is also the author of the bestselling reverse engineering textbook, Practical Reverse Engineering: x86, x64, Windows kernel, and obfuscation, published by John Wiley and Sons in 2014.
Course Outline
x86/x64 architecture and system
Review of x86/x64 system mechanisms for BIOS/kernel developers. We discuss concepts and data structures related to debug registers, control registers, modelspecific registers, segmentation, system calls, virtual memory mechanisms, privilege isolation, interrupts, and many more. For each concept, we explain how they can be used to write low-level software. Of course, we will also show how Windows use these mechanisms.
Windows kernel architecture
We describe the general architecture of the Windows kernel. This includes an overview of various subsystems such as process, memory management, executive, configuration management, and object management. In addition to explaining how the subsystems interact with each other, we also explain their programming interfaces and show how they can be used by developers do malicious or nonmalicious functionalities.
Debugging
Since the course will involve debugging and reverse engineering kernellevel software, we also explain the Windows kernel debugging subsystem. In the process, we will discuss how the kernel debugger works and show various debug/anti-debug techniques. We will also walk-through kernel debugging setup and introduce concepts relevant to kernel debugging.
Data structures
Reverse engineering and kernel forensics involve recovering and understanding various kernel data structures and their relationship. In this section, we describe and explain all fundamental Windows kernel data structures for security and forensics analysts. Some example structures include IDT, KPCR, KPRCB, DPC, E/KTHREAD, E/KPROCESS, etc.
Memory management
We dive into the core concepts of memory management in Windows. Coverage includes discussions of kernel pool allocator, paging, address space setup/teardown, page tables, address translations, and many more.
Processes and threads
We describe how processes and threads are implemented in Windows and the different ways they can be manipulated by kernelmode code. Examples include file hiding, thread injection, thread suspension, process tracking, and many more. We will also discuss the different interfaces exposed by the process manager.
Files and networking
The file and network subsystems are a good place for malware persistence and communication, respectively. This section explains how they work and how to program with them. Examples include file hiding, network packet inspection, traffic rerouting, kernelmode network programming.
User-kernel facilities
Windows provide many facilities for usermode programs to communicate with kernelmode services and vice versa. We explain how these mechanisms work and their implementation. We will also discuss how rootkits may use such mechanisms and implement some examples.
Drivers
Driver development is key to understanding rootkits and kernel forensics. In this section, we teach all the necessary concepts to writing drivers (or rootkits) for those without any kernel experience. You will learn about IRPs, IRQLs, dispatch handling, buffering methods, interrupts, native APIs, IOCTLs, DPCs, APCs, workitems, and many more kernel concepts. By the end of this class, you will certainly be comfortable writing your own drivers for forensics and securityrelated purposes.
Kernel/exploit development
Kernel exploits are frequently used to escalate from normal user to kernel privilege. This section discusses various classes of kernel vulnerabilities, how to spot them, and how they can be exploited. We will explain how to write your own kernelmode shellcode as well.
Every section in this course includes handson analysis and programming exercises.
Requirements
In order to get the most out of this class, you need to have some programming experience; if you are not comfortable with that, you can still understand the material and immediately apply it to your daily job, however you might need to work extra hard in class.
Hardware Requirements
Laptop running Windows as the host OS.
You will spend a lot of time tracing, debugging, and developing rootkits/drivers. Hence, for the purpose of this class, please bring a laptop running Windows as the host OS. In previous courses, some students brought MacBooks (running OS X and VMWare Fusion) and end up spending a lot of time fighting with configuration settings; while it is technically possible to have two Windows VMs (one target, one host), it is painfully slow and difficult.
The class involves toggling between VMs. Hence, if your laptop has an SSD, you will have a better experience.
Software Requirements
You should have the following software installed on your host OS:
Do not make the mistake of installing these software while in class as it will take many hours. In addition, you will need to have VM images for these OSes:
- Windows 10 RS2
- Windows 8.1 x64
- Windows 7 x86/x64 (you will need both because we will deal with both 32 and 64 bits rootkits/drivers)