Win Kernel Modulo Reversing #1

Here’s something interesting I’ve been learning about lately. I’m still far from mastering it Windows kernel-mode reversing is honestly an ocean lmao. The deeper you go, the more you realize how much there is left to explore. This post is just a snapshot of what I’ve discovered so far while diving into kernel land

Windows Kernel Modulo Reversing: A Deep Technical Introduction

“User mode reversing teaches you how programs work. Kernel modulo reversing teaches you how the operating system really works.”

1. Introduction — What is Kernel Modulo Reversing?

Windows kernel modulo reversing is the process of analyzing, understanding, and debugging code that runs in Ring 0, the most privileged execution level of the CPU.

Unlike classic reversing of .exe files, kernel reversing focuses on:

Windows kernel (ntoskrnl.exe)

Core subsystems (win32k.sys, hal.dll)

Device drivers (*.sys)

Security and anti-cheat drivers

Rootkits and stealth malware

Kernel mode code has:

No Win32 API

Direct access to hardware, memory, processes, and the scheduler

The power to fully control or compromise the system

A single bug in kernel mode is often enough to:

Escalate privileges to NT AUTHORITY\SYSTEM

Bypass security boundaries

Hide processes, files, or network traffic

Completely crash the OS (BSOD)

This is why kernel reversing is central in:

Malware research

EDR / anti-cheat analysis

Windows exploit development

Advanced CTF challenges

2. Windows Architecture Refresher

Windows is split into two main execution layers :

1
User Mode (Ring 3)
2
  ├─ Applications
3
  ├─ services.exe
4
  ├─ browsers, games, malware.exe
5
  └─ ntdll.dll
6

7
Kernel Mode (Ring 0)
8
  ├─ ntoskrnl.exe  (core kernel)
9
  ├─ win32k.sys   (GUI subsystem)
10
  ├─ hal.dll      (hardware abstraction)
11
  └─ drivers (*.sys)

User-mode code cannot directly:

Access physical memory

Touch kernel structures

Control hardware

Manage scheduling

All sensitive operations transition into kernel mode via:

syscall / sysenter

Interrupts

I/O requests (IRPs)

Reversing kernel mode means understanding what happens after this boundary.

3. What Is a Windows Driver Internally?

A Windows driver is just a PE file (.sys) loaded into kernel space.

Its entry point is not main() but:

1
NTSTATUS DriverEntry(
2
    PDRIVER_OBJECT  DriverObject,
3
    PUNICODE_STRING RegistryPath
4
);

This function:

Initializes the driver

Registers callbacks

Creates device objects

Sets up IRP dispatch routines

Example skeleton:

1
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
2
{
3
    UNREFERENCED_PARAMETER(RegistryPath);
4

5
    DriverObject->DriverUnload = DriverUnload;
6

7
    DriverObject->MajorFunction[IRP_MJ_CREATE]  = DispatchCreate;
8
    DriverObject->MajorFunction[IRP_MJ_CLOSE]   = DispatchClose;
9
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
10

11
    return STATUS_SUCCESS;
12
}

From a reversing perspective, this function is your main().

4. IRPs — How User Mode Talks to Kernel Mode

All communication is done using IRPs (I/O Request Packets).

Typical flow:

1
Userland app → DeviceIoControl()
2
               ↓
3
        I/O Manager
4
               ↓
5
        IRP_MJ_DEVICE_CONTROL
6
               ↓
7
        Driver Dispatch Routine

Example vulnerable handler:

1
NTSTATUS DispatchIoctl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
2
{
3
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
4
    ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
5

6
    if (code == 0x222003)
7
    {
8
        char kernel_buf[0x100];
9
        memcpy(kernel_buf,
10
               Irp->AssociatedIrp.SystemBuffer,
11
               stack->Parameters.DeviceIoControl.InputBufferLength); //  bug
12
    }
13

14
    Irp->IoStatus.Status = STATUS_SUCCESS;
15
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
16
    return STATUS_SUCCESS;
17
}

In reversing:

You hunt for IRP_MJ_DEVICE_CONTROL

Then rebuild the IOCTL protocol

Then find bugs → exploitation → SYSTEM

5. What You Reverse in Practice

Kernel reversing usually targets:

1 Malware drivers

Process hiding (DKOM)

SSDT hooks

Object callbacks

Rootkits

2 Anti-cheat / EDR

Syscall filtering

Memory scanning

Hypervisor interfaces

3 Vulnerable drivers

Stack overflow

Pool overflow

Arbitrary R/W

Privilege escalation

4 Windows internals

Process manager

Memory manager

Object manager

6. Kernel Reversing Toolchain

Static analysis

IDA Pro

Ghidra

Binary Ninja

and the best one is dogbolt lmaaaaaaaaao

Load drivers with symbols:

1
srv*C:\symbols*https://msdl.microsoft.com/download/symbols

Symbols turn this:

1
sub_140003AF0

into this:

1
PsCreateProcessNotifyRoutine

Which is gold in kernel reversing.

Dynamic analysis

Kernel debugging is not optional.

Setup:

VMware / Hyper-V

Target VM: kernel debug enabled

Host: WinDbg

1
bcdedit /debug on
2
bcdedit /set testsigning on

Then attach WinDbg kernel debugger.

Core commands:

1
lm            // list drivers
2
!drvobj       // inspect driver
3
!process 0 1  // active processes
4
dt _EPROCESS  // kernel structures

7. Core Kernel Concepts You Must Reverse

Kernel objects

_EPROCESS (process)

_ETHREAD (thread)

_DRIVER_OBJECT

_DEVICE_OBJECT

Memory

NonPagedPool

MDLs

IRQL levels

Page tables

Callbacks

1
PsSetCreateProcessNotifyRoutine(...)
2
ObRegisterCallbacks(...)
3
CmRegisterCallback(...)

Malware loves them , and yeah, I can’t lie… I love them too

8. Typical Kernel Rootkit Techniques

Kernel reversing is learning to recognize these patterns in assembly.

9. Reversing Methodology

1. Load .sys in IDA

2. Find DriverEntry

3. Rebuild DRIVER_OBJECT

4. Locate:

Dispatch routines

IOCTL switch

Callbacks

5. Rename everything

6. Attach WinDbg

7. Trace IRPs

8. Observe kernel memory

9. Confirm behavior dynamically

This is where reversing becomes OS archaeology.

10. Conclusion

Windows kernel-mode reversing is where reverse engineering stops being about binaries — and becomes about operating system internals, security boundaries, and hardware control.

It’s the foundation of:

Modern malware research

Kernel exploit development

EDR and anti-cheat analysis

Advanced digital forensics

Mastering it means understanding Windows not as a user but as the system itself.