Analyzing Windows kernel driver

Question

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging checks so using WinDbg isn't an option. I have tried VMWare gdb stub connected with IDA but tracing seems to doesn't work, it hangs and even few hours aren't enough. Have you any ideas how to do it in the simplest way?

Answer 1

It’s not geared towards exactly this purpose but you can probably make something based on Bochspwn:

Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks.

Answer 2

These days you may be able to use Icebox (and related projects) to achieve the required level introspection into the driver.

I am unsure if this will be yielding the results you hope for, but it builds on an idea I first came across at the VirusBulletin conference in 2013. The whole thesis can be found here. Icebox appears to build on the same principle and is completely FLOSS, whereas the original CXPInspector by Willems and Hund never was (to the best of my knowledge). Their initial work was commercialized into something known as VMRay today.

It's not exactly tracing you will get with this, but the authors of the seminal work remarked at the conference how they often managed to pin down a particular page access to a particular function call, so this approach provides more introspection than one would think at first glance.