Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
summary
Digtool is a binary-code-only framework that builds a custom hypervisor with shadow page table monitoring and a lightweight CPU emulator to capture kernel object allocation, memory accesses, thread scheduling and function calls in real Windows 7 and Windows 10 kernels and drivers. It hooks allocator/free paths and watches page-level access to detect 45 zero-day vulnerabilities including out-of-bounds, use-after-free and TOCTOU, reports exact instruction contexts, and logs reproduction traces for each detected bug.
AI-written summary · about
chapters (9)
- 0:00Intro
- 3:33Architecture
- 6:28Implementation
- 14:14Model Access
- 17:12Time of Use
- 18:24Memo Detection
- 20:03Out of Bounds
- 21:15Advantages
- 22:29Future Work
related talks
46mFor The Win: The Art Of The Windows Kernel Fuzzing
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
46mD2T2 - Over The Edge: Pwning The Windows Kernel
32mIntroduction to Windows Kernel Mode Debugging
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
56mWindows Kernel Graphics Driver Attack Surface
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel