1.3 KiB
1.3 KiB
API Reference: Analyzing Windows Driver Malware
Overview
scripts/analyst.py inspects a Windows .sys driver: it confirms the PE native subsystem and kernel
imports, then flags IRP/IOCTL dispatch, arbitrary read/write primitives, and callback registration,
mapping them to capabilities and BYOVD risk. It reads bytes statically and never loads the driver.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | struct, regex, JSON, file IO |
Core functions
inspect(path)
Returns driver confirmation, subsystem, kernel imports, dispatch/RW/callback indicators, capabilities, and a BYOVD-risk flag.
Indicator classes
- Dispatch:
IoCreateDevice,IoCreateSymbolicLink,IRP_MJ_DEVICE_CONTROL. - RW primitives:
MmMapIoSpace,ZwMapViewOfSection,MmCopyMemory. - Callbacks:
PsSetCreateProcessNotifyRoutine,ObRegisterCallbacks.
Usage
python scripts/analyst.py inspect driver.sys
Sources
- Windows Driver Kit (WDM/IRP, IOCTL) — https://learn.microsoft.com/windows-hardware/drivers/
- MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
- BYOVD arbitrary-RW IOCTL patterns and kernel callbacks from public driver-abuse research