Giter Club home page Giter Club logo

kernel-bridge's Introduction

The Kernel-Bridge Framework

The "Kernel-Bridge" project is a Windows kernel driver template, development framework and kernel-mode API and wrappers written on C++17.

✔ It support work with:

  • IO-ports (+ 'in/out/cli/sti' usermode forwarding by IOPL)
  • System beeper
  • MSRs (CPU Model Specific Registers)
  • CPUID, TSC and performance counters (RDPMC)
  • DMI/SMBIOS memory reading
  • Physical memory (RW, allocations and mappings)
  • Kernel memory management (allocations, mappings, transitions)
  • Usermode memory management (allocations in processes etc.)
  • Direct UM->KM and KM->UM memory transitions
  • Obtaining processes handles from kernel
  • Reading and writing memory of another processes
  • Suspending/resuming/termination processes
  • Creating kernel and usermode threads
  • Memory mappings between usermode and kernel

➰ In development and coming soon:

  • PCI configuration
  • Processes protection using ObRegisterCallbacks
  • Minifilter with usermode callbacks
  • Processes and modules usermode callbacks
  • Execution of custom usermode shellcodes
  • Unsigned drivers, kernel and usermode libraries mapping

Driver template has full support of C++ static and global initializers and all of C++17 features (without C++ exceptions). All of API modules are easy-to-use and have no external dependiencies, so you can include them to your own C++ drivers. All of API functions are grouped into a logical categories into namespaces, so you can quickly find all functions you want.

💦 Driver template has:

  • Support of METHOD_BUFFERED, METHOD_IN/OUT_DIRECT and METHOD_NEITHER
  • Minifilter loading and filtering routines templates
  • SAL-annotations and well-documented API
  • Ready-to-use IOCTLs handling routine
  • HLK tests passing

💨 Building and using:

Download Microsoft Visual Studio Community and Windows Driver Kit.
For driver testing use VMware Player.
For load an unsigned drivers you should to enable Test-mode of Windows and disable signs checkings:

- Disable signatures checkings (allow to install unsigned drivers):
bcdedit.exe /set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING ON

- Enable signatures checkings (deny to install unsigned drivers):
bcdedit.exe /set loadoptions ENABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING OFF

- Enable support of kernel debugger (WinDbg and Kernel Debugger from WDK):
bcdedit.exe /debug on   -  enable support of kernel debugging
bcdedit.exe /debug off  -  disable it

Communication with usermode apps:

For communication with usermode you can use a DriversUtils.h from "DriversUtils" folder that have a functions to install a driver and communicate with it using DeviceIoControl. You can directly include CtlTypes.h from "Kernel-Bridge/Kernel-Bridge/" folder to your usermode app for using Kernel-Bridge data types for requests.

Files hierarchy:

/User-Bridge/API - usermode API and wrappers for all functions of KB
/Kernel-Bridge/API - standalone kernel API for using in C++ drivers
/Kernel-Bridge/Kernel-Bridge - driver template files
/SharedTypes/CtlTypes - shared types header required for UM and KM modules
/Kernel-Tests - unit-tests for UM and KM modules and common functions

Example (using of KbReadProcessMemory):

#include <Windows.h>
 
#include "CtlTypes.h"
#include "User-Bridge.h"

using namespace Processes::MemoryManagement;

...
 
KbLoader::KbLoad(L"N:\\Folder\\Kernel-Bridge.sys");
 
constexpr int Size = 64;
UCHAR Buffer[Size] = {};
 
BOOL Status = KbReadProcessMemory(
    ProcessId,
    0x7FFF0000, // Desired address in context of ProcessId
    &Buffer,
    Size
);
 
if (Status)
    printf("All good!\r\n");
 
...
 
KbLoader::KbUnload();

kernel-bridge's People

Contributors

hoshimin avatar tarekwiz avatar

Watchers

James Cloos avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.