The "Kernel-Bridge" project is a Windows kernel driver template, development framework and kernel-mode API and wrappers written on C++17.
- IO-ports (+ 'in/out/cli/sti' usermode forwarding by IOPL)
- System beeper
- MSRs (CPU Model Specific Registers)
- CPUID, TSC and performance counters (RDPMC)
- DMI/SMBIOS memory reading
- Physical memory (RW, allocations and mappings)
- Kernel memory management (allocations, mappings, transitions)
- Usermode memory management (allocations in processes etc.)
- Direct UM->KM and KM->UM memory transitions
- Obtaining processes handles from kernel
- Reading and writing memory of another processes
- Suspending/resuming/termination processes
- Creating kernel and usermode threads
- Memory mappings between usermode and kernel
- PCI configuration
- Processes protection using ObRegisterCallbacks
- Minifilter with usermode callbacks
- Processes and modules usermode callbacks
- Execution of custom usermode shellcodes
- Unsigned drivers, kernel and usermode libraries mapping
Driver template has full support of C++ static and global initializers and all of C++17 features (without C++ exceptions). All of API modules are easy-to-use and have no external dependiencies, so you can include them to your own C++ drivers. All of API functions are grouped into a logical categories into namespaces, so you can quickly find all functions you want.
- Support of METHOD_BUFFERED, METHOD_IN/OUT_DIRECT and METHOD_NEITHER
- Minifilter loading and filtering routines templates
- SAL-annotations and well-documented API
- Ready-to-use IOCTLs handling routine
- HLK tests passing
Download Microsoft Visual Studio Community and Windows Driver Kit.
For driver testing use VMware Player.
For load an unsigned drivers you should to enable Test-mode of Windows and disable signs checkings:
- Disable signatures checkings (allow to install unsigned drivers):
bcdedit.exe /set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING ON
- Enable signatures checkings (deny to install unsigned drivers):
bcdedit.exe /set loadoptions ENABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING OFF
- Enable support of kernel debugger (WinDbg and Kernel Debugger from WDK):
bcdedit.exe /debug on - enable support of kernel debugging
bcdedit.exe /debug off - disable it
For communication with usermode you can use a DriversUtils.h
from "DriversUtils" folder that have a functions to install a driver and communicate with it using DeviceIoControl. You can directly include CtlTypes.h
from "Kernel-Bridge/Kernel-Bridge/" folder to your usermode app for using Kernel-Bridge data types for requests.
/User-Bridge/API
- usermode API and wrappers for all functions of KB
/Kernel-Bridge/API
- standalone kernel API for using in C++ drivers
/Kernel-Bridge/Kernel-Bridge
- driver template files
/SharedTypes/CtlTypes
- shared types header required for UM and KM modules
/Kernel-Tests
- unit-tests for UM and KM modules and common functions
#include <Windows.h>
#include "CtlTypes.h"
#include "User-Bridge.h"
using namespace Processes::MemoryManagement;
...
KbLoader::KbLoad(L"N:\\Folder\\Kernel-Bridge.sys");
constexpr int Size = 64;
UCHAR Buffer[Size] = {};
BOOL Status = KbReadProcessMemory(
ProcessId,
0x7FFF0000, // Desired address in context of ProcessId
&Buffer,
Size
);
if (Status)
printf("All good!\r\n");
...
KbLoader::KbUnload();