Contents
1 Introduction 1
2 Attack vectors 2
2.1 Directly from user mode 2
2.2 Public APIs 3
2.3 Undocumented APIs 3
2.4 Architectural flaws 4
2.5 Bugs and their exploitation 4
2.6 Subverting operating system initialization 6
2.7 Modifying kernel modules on disk 6
2.8 Hardware 6
3 Tools for the job 8
3.1 Static analysis 8
3.2 Dynamic analysis 9
4 Defensive measures 12
5 Further work 13
5.1 Fuzzing 13
5.2 Automated bug finding 14
5.3 Virtualization 14
6 Conclusion 15
7 References 16
Appendices
A NT kernel architecture 18
A.1 Terminology 18
A.2 Hardware based protection 18
A.3 Operating system memory layout and management 20
A.4 Public kernel interfaces 21
B CDFS driver disassembly 27
C Real world examples 32
4.1 The NT kernel compression library 32
4.2 Unvalidated structure initialization 34
4.3 An architectural flaw 35
4.4 Trusting user input 37

An NGSSoftware Insight Security Research (NISR) Publication
©2007 Next Generation Security Software Ltd