WindowsDanger is an open-source project that help developers to Learn Windows Kernel and other x86 Features.
But, We are NOT modify/patch Windows Code
We Directly Modify x86 Context Instead
So, We will not bypass PatchGuard, Using Official Test-Mode Instead
This driver Dreamed to assist developers accessing and manipulating system resources more conveniently. By installing and launching this driver, you can elevate all threads to Ring0, allowing for full control over low-level hardware and system resources.
This project is still under development. For more quick access, please use the QEMU_Danger_x86 project.
Ke386SetIoAccessMap and Ke386IoSetAccessProcess is NOT available in Win10/Server 2019 and above. It's better to learn how the x86 CPU work within TSS and IOPM.
Currently achieved:
- Disable Write-Protection by modifiy CR0
- Hack Ring3 Segment in GDT to Ring0
- Insert new user-callable IDT entries 78H and 79H, 78H will return back normally, while 79H will hack user thread's CS & SS to Ring0
- Disable SMAP/SMEP by modify CR4
- Adapt Multi-Processor System
Known Issues:
- After EXE entered Ring0, the kernel-thread-switch may not working properly, and will result in BSOD. To avoid this, we need back to Ring3 quickly after we played !! See InterruptTester for more details.
Ideas:
- Use soft
intinstruct from Ring3, and hack stack for return CS RPL -> 0, theniretq.
- Elevate any threads to Ring0 for full control over low-level system resources by simply
int 079h - Facilitate hardware debugging and reverse engineering tasks
- Tested on Windows Server 2022 x64, on Hyper-V
MUST Attach Kernel Debugger to prevent BSOD, because int 3 will trigger BSOD without Kernel Debugger.
- Download the latest version of the WindowsDanger driver.
- Copy the driver file to an appropriate directory (e.g.,
C:\Windows\System32\drivers). - Run the following command with administrator privileges to install the driver:
sc create WindowsDanger type= kernel binPath= C:\Windows\System32\drivers\WindowsDanger.sys- Start the driver:
sc start WindowsDanger-
IoCTL_Caller: Send Requests to our Kernel Driver. Supported Commands:
- 0 : Disable Write-Protection by modifiy CR0
- 1 : Hack Ring3 Segment in GDT to Ring0
- 2 : Mapping CR3 to a Virtual Address
- 3 : Insert new user-callable IDT entries 78H and 79H
- 4 : Disable SMAP/SMEP by modify CR4
-
InterruptTester: Test our new IDT entries 78H and 79H
- 78H : Return back normally
- 79H : Hack current thread's CS & SS to Ring0 !!
Please note, before you use int 079h, you must Hack the GDT, Disable SMAP/SMEP, and Insert new IDT entries by (1, 4, 3).
- Stop the driver:
sc stop WindowsDanger- Remove the driver:
sc delete WindowsDanger- Delete the driver file.
- Lab Experiment HandBooks: Contains Microsoft Learn Student Ambassador Workshop
- Download the WinDbg Preview tool from the Microsoft Store or Non Store
- Install WDK
- Read Kernel Debugging Document on the Microsoft Learn
- Read My Experiment log for more details
- Cource: Arch2001_x86-64_OS_Internals
WindowsDanger is licensed under the MIT License. Please refer to the LICENSE file for more information.
We welcome your contributions to the WindowsDanger project! Please see CONTRIBUTING.md for how to get started.
If you encounter any issues while using WindowsDanger, or have any suggestions and feedback, please submit your concerns on the Issues page.
WindowsDanger is intended for learning and research purposes only. The use of this driver may result in system instability, data loss, or other unintended consequences. The project authors and contributors are not responsible for any damages or losses resulting from the use of this driver. By using WindowsDanger, you agree to assume all risks.