Skip to content

HoShiMin/Kernel-Bridge

Folders and files

NameName
Last commit message
Last commit date
Jul 25, 2020
Aug 18, 2023
May 31, 2020
Jul 11, 2020
Jul 11, 2020
Jan 6, 2019
May 31, 2020
Jan 13, 2019
Jul 11, 2020
Mar 8, 2021
May 31, 2020
May 31, 2020
May 31, 2020
Aug 15, 2018
Jan 16, 2019
Apr 8, 2022
Oct 30, 2018
Oct 30, 2018
Oct 30, 2018
Oct 30, 2018

Repository files navigation

The Kernel-Bridge Framework

The "Kernel-Bridge" project is a C++20-ready Windows kernel driver template, development framework and kernel-mode API and wrappers.

Precompiled and signed binaries with the SecureBoot support
Delphi bindings

βœ” Capabilities:

  • Hypervisor (both Intel VT-x/EPT and AMD-V/RVI) with the Hyper-V support
  • Extremely fast hypervisor-based memory interceptions and hiding (+ support of Write-only pages), VT-x only
  • Support of HookLib and Zydis
  • IO-ports (+ 'in/out/cli/sti' usermode forwarding by IOPL)
  • System beeper
  • MSRs, CPUID, TSC and performance counters (RDPMC)
  • DMI/SMBIOS memory reading
  • Physical memory (allocations, RW, mappings)
  • Kernel memory management (allocations, mappings, transitions)
  • Usermode memory management (allocations in processes etc.)
  • Direct UM->KM and KM->UM memory transitions
  • Direct PTE-based memory management
  • Direct MDL management
  • Obtaining processes/threads handles from kernel
  • Reading and writing memory of another processes
  • Suspending/resuming/termination processes
  • Creating kernel and usermode threads
  • Memory mappings between usermode and kernel
  • Remote code execution (APCs delivery)
  • Execution of custom usermode shellcodes
  • Unsigned drivers mapping
  • Processes, threads, handles and modules usermode callbacks (ObRegisterCallbacks & PsSet***NotifyRoutine)
  • Minifilter with usermode callbacks
  • PDB parsing
  • Signatures and patterns scanning
  • Sections management (to map \\Device\PhysicalMemory and more)
  • Python binding

➰ In development and plans:

  • Qt-based GUI for the kernel-hacking and memory researching framework
  • Kernel WinSock support
  • Extensions for the RTL: hooks, injections, disassembling
  • Kernel loadable modules with SEH support

Driver template has full support of C++ static and global initializers and all of C++20 features (without C++ exceptions). All of API modules are easy-to-use and have no external dependiencies, so you can include them to your own C++ drivers. All of API functions are grouped into a logical categories into namespaces, so you can quickly find all functions you want.

πŸ’¦ Driver template has:

  • Support of METHOD_BUFFERED, METHOD_IN/OUT_DIRECT and METHOD_NEITHER
  • Minifilter loading and filtering routines templates
  • SAL-annotations and self-documented API
  • Ready-to-use IOCTLs handling routine
  • Out-of-box STL support
  • Static Driver Verifier tests passing

πŸ’¨ Building and using:

Download Microsoft Visual Studio Community and Windows Driver Kit.
For driver testing use VMware Player.
For load an unsigned drivers you should to enable Test-mode of Windows and disable signs checkings:

- Disable signatures checkings (allow to install unsigned drivers):
bcdedit.exe /set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING ON

- Enable signatures checkings (deny to install unsigned drivers):
bcdedit.exe /set loadoptions ENABLE_INTEGRITY_CHECKS
bcdedit.exe /set TESTSIGNING OFF

- Enable support of kernel debugger (WinDbg and Kernel Debugger from WDK):
bcdedit.exe /debug on   -  enable support of kernel debugging
bcdedit.exe /debug off  -  disable it

Communication with usermode apps:

For communication with usermode you should use "User-Bridge" wrappers as standalone *.cpp/*.h modules or as *.dll.
All required headers are WdkTypes.h, CtlTypes.h and User-Bridge.h. For using an extended features like minifilter callbacks, you should also use FltTypes.h, CommPort.h and Flt-Bridge.h. Some of ready-to-use RTL-functions (like an unsigned drivers mapping) you can find in Rtl-Bridge.h.

Files hierarchy:

/User-Bridge/API/ - usermode API and wrappers for all functions of KB
/Kernel-Bridge/API/ - standalone kernel API for using in C++ drivers
/Kernel-Bridge/Kernel-Bridge/ - driver template files
/SharedTypes/ - shared types headers required for UM and KM modules
/CommonTypes/ - common user- and kernelmode headers and types
/Python-Bridge/ - Python binding
/Kernel-Tests/ - unit-tests for UM and KM modules and common functions

Example (using of KbReadProcessMemory):

#include <Windows.h>

#include "WdkTypes.h"
#include "CtlTypes.h"
#include "User-Bridge.h"

using namespace Processes::MemoryManagement;

...

// Loading as minifilter (it allows to use extended features):
KbLoader::KbLoadAsFilter(L"N:\\Folder\\Kernel-Bridge.sys", L"260000");

constexpr int Size = 64;
UCHAR Buffer[Size] = {};
 
BOOL Status = KbReadProcessMemory(
    ProcessId,
    0x7FFF0000, // Desired address in context of ProcessId
    &Buffer,
    Size
);

KbLoader::KbUnload();

About

Windows kernel hacking framework, driver template, hypervisor and API written on C++

Resources

License

Stars

Watchers

Forks

Packages

No packages published