mrexodia / driver_unpacking

Ghetto user mode emulation of Windows kernel drivers.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

driver_unpacking

Ghetto user mode emulation of Windows kernel drivers. See the Kernel driver unpacking blog post for a practical application.

Usage

You can use MakeUsermode to convert the driver to a user-mode program, it will then import the fake ntoskrnl.exe which acts as an emulator. It is meant as a way to conduct simple research and only a few APIs are implemented. A more comprehensive tool is speakeasy, but this allows you to debug drivers in x64dbg.

Related utility: SysShellHandler.

About

Ghetto user mode emulation of Windows kernel drivers.


Languages

Language:C 82.8%Language:C++ 17.0%Language:C# 0.2%