morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3626] [Feature] Windows kernel driver reverse engineering: IRP dispatch, IOCTLs, WDF/WDM callbacks, and INF correlation #1353

New issue

Open

opened 2026-10-16 21:04:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:35 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3626

Summary

Windows kernel drivers (.sys PE binaries) execute in Ring 0 with unrestricted system privileges. In security research, digital forensics, anti-cheat/EDR analysis, and hardware reverse engineering, drivers represent a critical analysis domain: uncovering Bring-Your-Own-Vulnerable-Driver (BYOVD) vulnerabilities, analyzing rootkits and kernel malware, auditing hardware abstraction layers, and inspecting kernel-to-user communication.

Currently, REA analyzes a .sys driver merely as a generic PE binary in Ghidra or Rizin. However, kernel drivers follow unique architectural paradigms that traditional executable analysis fails to illuminate:

Communication is mediated via I/O Request Packets (IRPs) dispatched through the DriverObject->MajorFunction[] table.
The user-mode attack surface is defined by I/O Control (IOCTL) codes, transfer mechanisms (METHOD_BUFFERED, METHOD_NEITHER), and device object symbolic links.
Modern drivers utilize the Windows Driver Framework (KMDF/WDF) or File System Minifilter frameworks, hiding dispatch logic behind framework event callbacks.
Drivers are defined by setup information (.inf) files that declare hardware IDs, service start types, and device access security descriptors (SDDL).

This feature proposal introduces dedicated Windows Kernel Driver Reverse Engineering to REA, automating DriverEntry tracing, MajorFunction dispatch recovery, IOCTL parameter decoding, WDF/minifilter callback extraction, and .sys ↔ .inf configuration correlation.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: Windows Driver (.sys) + .inf     |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | DriverEntry & WDM         |                                   | WDF / KMDF & Minifilter   |
           | MajorFunction[] Dispatch  |                                   | Framework Callback Parser |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | IOCTL Decoder & Transfer Analysis     |
                                     | (CTL_CODE, METHOD_NEITHER, Buffers)   |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Device Object & Symbolic  |                                   | INF File Correlation      |
           | Link Surface (DosDevices) |                                   | & SDDL Security Auditing  |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence / Driver Attack Surface  |
                                     | (IOCTL Dossier, Callbacks, Devices)   |
                                     +---------------------------------------+

1. `DriverEntry` & WDM `MajorFunction[]` Dispatch Recovery

Entry Point Analysis: Identify DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath).
Dispatch Table Extraction: Trace assignments to the DriverObject->MajorFunction array, identifying handlers for:
- IRP_MJ_CREATE (0x00), IRP_MJ_CLOSE (0x02), IRP_MJ_CLEANUP (0x12)
- IRP_MJ_READ (0x03), IRP_MJ_WRITE (0x04)
- IRP_MJ_DEVICE_CONTROL (0x0e) and IRP_MJ_INTERNAL_DEVICE_CONTROL (0x0f)
- DriverObject->DriverUnload and DriverObject->FastIoDispatch tables.
Device Object & Symbolic Link Recovery:
- Detect calls to IoCreateDevice / IoCreateDeviceSecure, extracting internal device names (e.g. \Device\KernelDriver).
- Detect calls to IoCreateSymbolicLink, extracting user-mode visible symbolic link names (e.g. \DosDevices\VulnerableLink or \\.\VulnerableLink).

2. IOCTL Decoding & Control Flow Inversion

IOCTL Discovery: Trace IoGetCurrentIrpStackLocation(Irp)->Parameters.DeviceIoControl.IoControlCode inside the IRP_MJ_DEVICE_CONTROL handler (switch statements, jump tables, or conditional trees).
CTL_CODE Macro Deconstruction: Deconstruct each identified 32-bit IOCTL value into its structural fields:
- DeviceType: (bits 16–31): e.g. FILE_DEVICE_UNKNOWN (0x22), FILE_DEVICE_DISK (0x07), FILE_DEVICE_NETWORK (0x12).
- Function: (bits 2–13): numeric custom function code.
- Method / Transfer Mechanism: (bits 0–1):
  - METHOD_BUFFERED (0): system-buffered copy.
  - METHOD_IN_DIRECT (1) / METHOD_OUT_DIRECT (2): memory descriptor lists (MDLs).
  - METHOD_NEITHER (3): raw user-mode pointers (critical attack surface for arbitrary kernel read/write vulnerabilities).
- Access: (bits 14–15): FILE_ANY_ACCESS (0), FILE_READ_ACCESS (1), FILE_WRITE_ACCESS (2), or Read/Write.
Buffer Length Constraints: Recover minimum input (InputBufferLength) and output (OutputBufferLength) requirements validated before execution.

3. WDF (KMDF / UMDF) Framework De-obfuscation

KMDF Initialization Tracking: Detect calls to WdfDriverCreate and parse WDF_DRIVER_CONFIG structures.
Event Callback Extraction: Trace WDF function tables to extract event handler addresses:
- Driver / Device events: EvtDriverDeviceAdd, EvtDevicePrepareHardware, EvtDeviceReleaseHardware.
- Queue / IO events: EvtIoDeviceControl, EvtIoInternalDeviceControl, EvtIoRead, EvtIoWrite, EvtIoDefault.
- Queue dispatch modes: Sequential, Parallel, Manual.

4. File System Minifilter Driver Analysis

Filter Registration: Detect registration with the Filter Manager (FltRegisterFilter).
Callback Parsing: Parse FLT_REGISTRATION and FLT_OPERATION_REGISTRATION structures, extracting:
- Monitored I/O operations (IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION).
- Pre-operation (PFLT_PRE_OPERATION_CALLBACK) and Post-operation (PFLT_POST_OPERATION_CALLBACK) callback routine addresses.
- Altitude string (e.g. "320000" FSFilter Activity Monitor) defining the driver's position in the minifilter stack.

5. INF File Correlation & SDDL Security Auditing

INF Setup Ingestion: Ingest companion .inf setup files alongside the .sys binary:
- Correlate Service Name, Display Name, ServiceType (Kernel Driver = 1), StartType (Boot = 0, System = 1, Auto = 2, Demand = 3), and ErrorControl.
- Extract Hardware IDs (PCI\VEN_XXXX&DEV_XXXX, USB\VID_XXXX&PID_XXXX, ACPI\...).
Security Descriptor (SDDL) Auditing:
- Parse device Security Descriptor Definition Language (SDDL) strings (from .inf directives like Security="..." or in-code IoCreateDeviceSecure).
- Flag overly permissive ACLs (e.g. D:P(A;;GA;;;WD) granting World/Everyone Generic All access), which expose kernel control directly to unprivileged local users.

Acceptance Criteria

Introduce analyze_kernel_driver in REA CLI and MCP contracts, accepting .sys and optional companion .inf files.
Locate DriverEntry and extract the MajorFunction[] dispatch table across synthetic 32-bit and 64-bit WDM driver fixtures.
Identify and decode all handled IOCTL codes into DeviceType, Function, Method, and Access fields.
Flag IOCTLs using METHOD_NEITHER with security warnings in structured evidence.
Extract EvtIoDeviceControl callbacks from synthetic KMDF test drivers.
Correlate .inf service settings and audit SDDL device permissions for security weaknesses.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#492 Inspect recovered native data types and layouts
#3599 [Feature] Passive DNS extraction and cybersecurity analysis primitives
#3624 [Feature] Native C++ semantic reconstruction

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3626 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Windows kernel drivers (`.sys` PE binaries) execute in Ring 0 with unrestricted system privileges. In security research, digital forensics, anti-cheat/EDR analysis, and hardware reverse engineering, drivers represent a critical analysis domain: uncovering Bring-Your-Own-Vulnerable-Driver (BYOVD) vulnerabilities, analyzing rootkits and kernel malware, auditing hardware abstraction layers, and inspecting kernel-to-user communication. Currently, REA analyzes a `.sys` driver merely as a generic PE binary in Ghidra or Rizin. However, kernel drivers follow unique architectural paradigms that traditional executable analysis fails to illuminate: - Communication is mediated via I/O Request Packets (IRPs) dispatched through the `DriverObject->MajorFunction[]` table. - The user-mode attack surface is defined by I/O Control (IOCTL) codes, transfer mechanisms (`METHOD_BUFFERED`, `METHOD_NEITHER`), and device object symbolic links. - Modern drivers utilize the Windows Driver Framework (KMDF/WDF) or File System Minifilter frameworks, hiding dispatch logic behind framework event callbacks. - Drivers are defined by setup information (`.inf`) files that declare hardware IDs, service start types, and device access security descriptors (SDDL). This feature proposal introduces dedicated **Windows Kernel Driver Reverse Engineering** to REA, automating `DriverEntry` tracing, `MajorFunction` dispatch recovery, IOCTL parameter decoding, WDF/minifilter callback extraction, and `.sys` ↔ `.inf` configuration correlation. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: Windows Driver (.sys) + .inf | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | DriverEntry & WDM | | WDF / KMDF & Minifilter | | MajorFunction[] Dispatch | | Framework Callback Parser | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | IOCTL Decoder & Transfer Analysis | | (CTL_CODE, METHOD_NEITHER, Buffers) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Device Object & Symbolic | | INF File Correlation | | Link Surface (DosDevices) | | & SDDL Security Auditing | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence / Driver Attack Surface | | (IOCTL Dossier, Callbacks, Devices) | +---------------------------------------+ ``` ### 1. `DriverEntry` & WDM `MajorFunction[]` Dispatch Recovery - **Entry Point Analysis:** Identify `DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)`. - **Dispatch Table Extraction:** Trace assignments to the `DriverObject->MajorFunction` array, identifying handlers for: - `IRP_MJ_CREATE` (0x00), `IRP_MJ_CLOSE` (0x02), `IRP_MJ_CLEANUP` (0x12) - `IRP_MJ_READ` (0x03), `IRP_MJ_WRITE` (0x04) - `IRP_MJ_DEVICE_CONTROL` (0x0e) and `IRP_MJ_INTERNAL_DEVICE_CONTROL` (0x0f) - `DriverObject->DriverUnload` and `DriverObject->FastIoDispatch` tables. - **Device Object & Symbolic Link Recovery:** - Detect calls to `IoCreateDevice` / `IoCreateDeviceSecure`, extracting internal device names (e.g. `\Device\KernelDriver`). - Detect calls to `IoCreateSymbolicLink`, extracting user-mode visible symbolic link names (e.g. `\DosDevices\VulnerableLink` or `\\.\VulnerableLink`). ### 2. IOCTL Decoding & Control Flow Inversion - **IOCTL Discovery:** Trace `IoGetCurrentIrpStackLocation(Irp)->Parameters.DeviceIoControl.IoControlCode` inside the `IRP_MJ_DEVICE_CONTROL` handler (switch statements, jump tables, or conditional trees). - **`CTL_CODE` Macro Deconstruction:** Deconstruct each identified 32-bit IOCTL value into its structural fields: - **DeviceType:** (bits 16–31): e.g. `FILE_DEVICE_UNKNOWN` (0x22), `FILE_DEVICE_DISK` (0x07), `FILE_DEVICE_NETWORK` (0x12). - **Function:** (bits 2–13): numeric custom function code. - **Method / Transfer Mechanism:** (bits 0–1): - `METHOD_BUFFERED` (0): system-buffered copy. - `METHOD_IN_DIRECT` (1) / `METHOD_OUT_DIRECT` (2): memory descriptor lists (MDLs). - `METHOD_NEITHER` (3): raw user-mode pointers (**critical attack surface** for arbitrary kernel read/write vulnerabilities). - **Access:** (bits 14–15): `FILE_ANY_ACCESS` (0), `FILE_READ_ACCESS` (1), `FILE_WRITE_ACCESS` (2), or Read/Write. - **Buffer Length Constraints:** Recover minimum input (`InputBufferLength`) and output (`OutputBufferLength`) requirements validated before execution. ### 3. WDF (KMDF / UMDF) Framework De-obfuscation - **KMDF Initialization Tracking:** Detect calls to `WdfDriverCreate` and parse `WDF_DRIVER_CONFIG` structures. - **Event Callback Extraction:** Trace WDF function tables to extract event handler addresses: - Driver / Device events: `EvtDriverDeviceAdd`, `EvtDevicePrepareHardware`, `EvtDeviceReleaseHardware`. - Queue / IO events: `EvtIoDeviceControl`, `EvtIoInternalDeviceControl`, `EvtIoRead`, `EvtIoWrite`, `EvtIoDefault`. - Queue dispatch modes: Sequential, Parallel, Manual. ### 4. File System Minifilter Driver Analysis - **Filter Registration:** Detect registration with the Filter Manager (`FltRegisterFilter`). - **Callback Parsing:** Parse `FLT_REGISTRATION` and `FLT_OPERATION_REGISTRATION` structures, extracting: - Monitored I/O operations (`IRP_MJ_CREATE`, `IRP_MJ_READ`, `IRP_MJ_WRITE`, `IRP_MJ_SET_INFORMATION`). - Pre-operation (`PFLT_PRE_OPERATION_CALLBACK`) and Post-operation (`PFLT_POST_OPERATION_CALLBACK`) callback routine addresses. - Altitude string (e.g. `"320000"` FSFilter Activity Monitor) defining the driver's position in the minifilter stack. ### 5. INF File Correlation & SDDL Security Auditing - **INF Setup Ingestion:** Ingest companion `.inf` setup files alongside the `.sys` binary: - Correlate Service Name, Display Name, ServiceType (Kernel Driver = 1), StartType (Boot = 0, System = 1, Auto = 2, Demand = 3), and ErrorControl. - Extract Hardware IDs (`PCI\VEN_XXXX&DEV_XXXX`, `USB\VID_XXXX&PID_XXXX`, `ACPI\...`). - **Security Descriptor (SDDL) Auditing:** - Parse device Security Descriptor Definition Language (SDDL) strings (from `.inf` directives like `Security="..."` or in-code `IoCreateDeviceSecure`). - Flag overly permissive ACLs (e.g. `D:P(A;;GA;;;WD)` granting World/Everyone Generic All access), which expose kernel control directly to unprivileged local users. --- ## Acceptance Criteria 1. Introduce `analyze_kernel_driver` in REA CLI and MCP contracts, accepting `.sys` and optional companion `.inf` files. 2. Locate `DriverEntry` and extract the `MajorFunction[]` dispatch table across synthetic 32-bit and 64-bit WDM driver fixtures. 3. Identify and decode all handled IOCTL codes into DeviceType, Function, Method, and Access fields. 4. Flag IOCTLs using `METHOD_NEITHER` with security warnings in structured evidence. 5. Extract `EvtIoDeviceControl` callbacks from synthetic KMDF test drivers. 6. Correlate `.inf` service settings and audit SDDL device permissions for security weaknesses. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #492 Inspect recovered native data types and layouts - #3599 [Feature] Passive DNS extraction and cybersecurity analysis primitives - #3624 [Feature] Native C++ semantic reconstruction

bsakaguchi referenced this issue

2026-10-17 21:10:41 +00:00

[PR #1355] [CLOSED] docs: clarify README setup command, mention IDA, and update Node badge #2821

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1353

No description provided.

Rows
Columns