Next Windows Kernel Programming Remote Class

The next public remote Windows kernel Programming class I will be delivering is scheduled for April 15 to 18. It’s going to be very similar to the first one I did at the end of January (with some slight modifications and additions).

Cost: 1950 USD. Early bird (register before March 30th): 1650 USD

I have not yet finalized the time zone the class will be “targeting”. I will update in a few weeks on that.

If you’re interested in registering, please email zodiacon@live.com with the subject “Windows Kernel Programming class” and specify your name, company (if any) and time zone. I’ll reply by providing more information.

Feel free to contact me for questions using the email or through twitter (@zodiacon).

The complete syllabus is outlined below:

Duration:	4 Days
Target Audience:	Experienced windows developers, interested in developing kernel mode drivers
Objectives:	·  Understand the Windows kernel driver programming model ·  Write drivers for monitoring processes, threads, registry and some types of objects ·  Use documented kernel hooking mechanisms ·  Write basic file system mini-filter drivers
Pre Requisites:	·  At least 2 years of experience working with the Windows API ·  Basic understanding of Windows OS concepts such as processes, threads, virtual memory and DLLs
Software requirements:	·  Windows 10 Pro 64 bit (latest stable version) ·  Visual Studio 2017 + latest update ·  Windows 10 SDK (latest) ·  Windows 10 WDK (latest) ·  Virtual Machine for testing and debugging

Instructor: Pavel Yosifovich

Abstract

The cyber security industry has grown considerably in recent years, with more sophisticated attacks and consequently more defenders. To have a fighting chance against these kinds of attacks, kernel mode drivers must be employed, where nothing (at least nothing from user mode) can escape their eyes.
The course provides the foundations for the most common software device drivers that are useful not just in cyber security, but also other scenarios, where monitoring and sometimes prevention of operations is required. Participants will write real device drivers with useful features they can then modify and adapt to their particular needs.

Syllabus

• Module 1: Windows Internals quick overview
  • Processes
  • Virtual memory
  • Threads
  • System architecture
  • User / kernel transitions
  • Introduction to WinDbg
  • Windows APIs
  • Objects and handles
  • Summary

 

• Module 2: The I/O System
  • I/O System overview
  • Device Drivers
  • The Windows Driver Model (WDM)
  • The Kernel Mode Driver Framework (KMDF)
  • Other device driver models
  • Driver types
  • Software drivers
  • Driver and device objects
  • I/O Processing and Data Flow
  • Accessing devices
  • Asynchronous I/O
  • Summary

 

• Module 3: Kernel programming basics
  • Setting up for Kernel Development
  • Basic Kernel types and conventions
  • C++ in a kernel driver
  • Creating a driver project
  • Building and deploying
  • The kernel API
  • Strings
  • Linked Lists
  • The DriverEntry function
  • The Unload routine
  • Installation
  • Testing
  • Debugging
  • Summary
  • Lab: deploy a driver

 

• Module 4: Building a simple driver
  • Creating a device object
  • Exporting a device name
  • Building a driver client
  • Driver dispatch routines
  • Introduction to I/O Request Packets (IRPs)
  • Completing IRPs
  • Handling DeviceIoControl calls
  • Testing the driver
  • Debugging the driver
  • Using WinDbg with a virtual machine
  • Summary
  • Lab: open a process for any access; zero driver; debug a driver

 

• Module 5: Kernel mechanisms
  • Interrupt Request Levels (IRQLs)
  • Deferred Procedure Calls (DPCs)
  • Dispatcher objects
  • Low IRQL Synchronization
  • Spin locks
  • Work items
  • Summary

 

• Module 6: Process and thread monitoring
  • Motivation
  • Process creation/destruction callback
  • Specifying process creation status
  • Thread creation/destruction callback
  • Notifying user mode
  • Writing a user mode client
  • Preventing potentially malicious processes from executing
  • Summary
  • Lab: monitoring process/thread activity; prevent specific processes from running; protecting processes

 

• Module 7: Object and registry notifications
  • Process/thread object notifications
  • Pre and post callbacks
  • Registry notifications
  • Performance considerations
  • Reporting results to user mode
  • Summary
  • Lab: protect specific process from termination; simple registry monitor

 

• Module 8: File system mini filters
  • File system model
  • Filters vs. mini filters
  • The Filter Manager
  • Filter registration
  • Pre and Post callbacks
  • File name information
  • Contexts
  • File system operations
  • Filter to user mode communication
  • Debugging mini-filters
  • Summary
  • Labs: protect a directory from file deletion; backup file before deletion