Kernel-mode primitives (kernel/*)

← maldev README · docs/index

The kernel/* package tree exposes userland-callable kernel read/write primitives by abusing signed-but-vulnerable third-party drivers (BYOVD). Userland obtains kernel R/W without loading an unsigned driver — defeats HVCI on hosts older than the 2021-09 vulnerable-driver block-list update.

flowchart LR
    Caller -->|Driver.Install| Lifecycle["NtLoadDriver +<br>SCM CreateService/Start"]
    Lifecycle --> SignedSys["RTCore64.sys (signed)"]
    SignedSys --> IOCTL["IOCTL 0x80002048 / 0x8000204C"]
    IOCTL --> Kernel["arbitrary kernel R/W"]
    Kernel -->|consumed by| KCB["evasion/kcallback"]
    Kernel -->|consumed by| LSASS["credentials/lsassdump"]

Decision tree

Per-package pages

• byovd-rtcore64.md — RTCore64.sys (CVE-2019-16098). Microsoft-attested signed; refused on HVCI hosts ≥ 2021-09 vulnerable-driver block-list.

Common contract

Every concrete BYOVD driver implements three interfaces from the umbrella package:

• kernel/driver.Reader — ReadKernel(addr, buf) (int, error).
• kernel/driver.ReadWriter — adds WriteKernel(addr, data).
• kernel/driver.Lifecycle — Install / Uninstall / Loaded. Idempotent install; best-effort uninstall.

Sentinel errors: ErrNotImplemented, ErrNotLoaded, ErrPrivilegeRequired (caller lacks SeLoadDriverPrivilege).

MITRE ATT&CK rollup

See also

• docs/techniques/evasion/kernel-callback-removal.md
• docs/techniques/credentials/lsassdump.md
• docs/architecture.md — layering rules