DeathNote of Microsoft Windows Kernel
summary
Research uncovers a small kernel component nicknamed DeathNote module inside NTOS that exposes CIFS-style log parsing to user mode and sandboxed entities. Reverse engineering extracts the CIFS base log file layout and the runtime CSE table (pulled from WinDbg), then a fuzzer reloads the kernel image, emulates CSE checks, applies semantic mutation filters and exercises IOCTLs. The pipeline yields about 56 crashes in days, produces reproducible bugs including a sandbox-reachable privilege escalation, and results in three reports currently verified by Microsoft.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:37agenda
- 6:38Sandbox targets
- 10:15tm indirection
- 14:36CLFS - state fuzzing
- 21:35CLFS state, dummy, enhanced
- 23:33BLF (Base Log File) Format
- 24:28Record Header
- 26:32Control Record
- 27:26Base Log Record
- 28:44Container Record
- 30:18Symbol Header
- 30:50Client Context
- 31:38Container Context
- 33:30Record Parameter
- 35:57Use of Acquire MetadataBlock
- 36:59Symbol Hash Function
- 37:14Enhanced CLFS format fuzzing
related talks
30mThe Next Generation of Windows Exploitation: Attacking the Common Log File System
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
46mFor The Win: The Art Of The Windows Kernel Fuzzing
39mFuzzing the Native NTFS Read-Write Driver (NTFS3) in the Linux Kernel
32mIntroduction to Windows Kernel Mode Debugging
25mData-Only Pwning Microsoft Windows Kernel
46mD2T2 - Over The Edge: Pwning The Windows Kernel