CODEWITHSUNDEEP
windowskerneldrivers
Jim
Jim

Reputation: 11

Differences in kernel mode and drivers

I am just trying to understand the differences to patching into the kernel and writing a driver.

It is my understanding that a kernel mode driver can do anything the kernel can do, and is similar in some ways to a linux module.

Why then, were AV makers so upset when Microsoft stopped them from patching into the Windows kernel?

What kind of stuff can you do through kernel patching that you can't do through a driver?

Upvotes: 1

Views: 370

Answers (2)

wj32
wj32

Reputation: 8423

It's true that a kernel-mode driver can do anything the kernel can do - after all, they both run in ring 0. The key question here is: how difficult is it? Patching things relies on internal details that may change between different kernel releases. For example, the system call number of NtTerminateProcess will change between versions, so a driver which hooks the SSDT will break between versions (although the system call number can be obtained through other means). Reading or modifying fields of internal structures such as EPROCESS or ETHREAD is risky as well, because again, these structures change between versions. None of this is impossible for a driver to do, but it's hard.

If an official interface is provided for hooking, Microsoft can guarantee compatibility between versions as well as being able to control who can do what (e.g. only signed drivers can use the object manager callbacks). However, Microsoft can't do this for everything, because some things are just implementation details that drivers shouldn't know about.

Upvotes: 0

Luke
Luke

Reputation: 11421

In this context patching the kernel means modifying its (undocumented?) internal structures in order to achieve some functionality, typically hooking various functions (e.g. opening a file). You are not supposed to go messing around with internal kernel structures that do not belong to you. In the past Microsoft did not provide official hooks for some things, so security companies reverse engineered the internals and hooked the kernel directly. Recently Microsoft has provided official hooks for some things, so the need to hook the kernel directly is not as strong.

Upvotes: 1

Related Questions