3

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question.

After reading a section of 'Practical Malware Analysis' discussing the Native API I decided to have a look at some of ntdll.dll's exported functions. I came across the NtLoadDriver which simply loads a specified driver from the registry.

Would this driver exist in user space, or in kernel space? Is it even possible for a non kernel mode driver to exist?

If it's that simple to load a driver in kernel mode (I'm assuming it's not) then why don't we see more malware in the form of drivers?

Any insight or clarification would be greatly appreciated.

  • Right on top of your link there's a link to the higher level entry "Driver Support Routines" which says "Driver support routines are routines that the Windows operating system provides for kernel-mode drivers to use." That might give you a hint why this is not used for malware. – Vitaly Osipov Mar 9 '16 at 20:35
9

Would this driver exist in user space, or in kernel space?

Kernel space.

Is it even possible for a non kernel mode driver to exist?

You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.

What we typically think of as a "driver" is a kernel-mode driver.

If it's that simple to load a driver in kernel mode (I'm assuming it's not) then why don't we see more malware in the form of drivers?

The first thing that NtLoadDriver() does is check that the caller's token has SeLoadDriverPrivilege, which even administrators' tokens don't have by default.

Other reasons we don't see much malware in the form of drivers:

  • It's more difficult to develop (malicious) kernel-mode code than it is to develop (malicious) user-mode code. Since it's rare that a malware author would need to do something that can only be done from kernel-mode, there's usually not much value in writing a malicious driver.
  • Modern versions of Windows have very strict driver-signing requirements with regard to allowing a driver to load. Getting a legitimate driver-signing certificate is not easy to do for a malware author, and once Microsoft discovers that said certificate is being used to sign malicious drivers, Microsoft will revoke the certificate and prevent all Windows installations from loading drivers signed with that certificate.
  • Awesome, that clears things up a lot. Thank you! – Jacob Persi Mar 9 '16 at 19:01
  • A small side note: Malicious Drivers are often called rootkits. These are more common in unix land. Also, installing rootkits often happens with kernel exploitation and not with the NtLoadDriver function. – Stolas Apr 5 '16 at 9:28
  • The Driver Signing Enforcement (DSE) on Windows wouldn't be a problem at all for an experienced Malware Developer: github.com/hfiref0x/TDL – Skyküff Apr 11 '16 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.