38 lines
1.3 KiB
Markdown
38 lines
1.3 KiB
Markdown
# API Reference: Analyzing Windows Driver Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` inspects a Windows `.sys` driver: it confirms the PE native subsystem and kernel
|
|
imports, then flags IRP/IOCTL dispatch, arbitrary read/write primitives, and callback registration,
|
|
mapping them to capabilities and BYOVD risk. It reads bytes statically and never loads the driver.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | struct, regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `inspect(path)`
|
|
Returns driver confirmation, subsystem, kernel imports, dispatch/RW/callback indicators,
|
|
capabilities, and a BYOVD-risk flag.
|
|
|
|
## Indicator classes
|
|
|
|
- Dispatch: `IoCreateDevice`, `IoCreateSymbolicLink`, `IRP_MJ_DEVICE_CONTROL`.
|
|
- RW primitives: `MmMapIoSpace`, `ZwMapViewOfSection`, `MmCopyMemory`.
|
|
- Callbacks: `PsSetCreateProcessNotifyRoutine`, `ObRegisterCallbacks`.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py inspect driver.sys
|
|
```
|
|
|
|
## Sources
|
|
|
|
- Windows Driver Kit (WDM/IRP, IOCTL) — https://learn.microsoft.com/windows-hardware/drivers/
|
|
- MITRE ATT&CK T1068 Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
|
|
- BYOVD arbitrary-RW IOCTL patterns and kernel callbacks from public driver-abuse research
|