Title: Windows 8 User Mode Drivers: Reliability Panacea, or Security Nightmare?

Presented at REcon 2012, June 15, 2012, 1 p.m. (60 minutes)

The UMDF 1.11 (User-Mode Driver Framework) that ships with Windows 8 (and back-ported to Vista and Windows 7) now allows user-mode DLLs hosted by the WUDF Hosting Process (i.e.: "User-mode Drivers") to:1) Handle interrupts in user-mode2) Map device RAM (MMIO registers) to user-mode memory, read-write3) Map/access device I/O ports to user-mode, and access them through READ_PORT_XXX and WRITE_PORT_XXX commandsBecause these DLLs are considered "user-mode", they are not part of the Code Integrity/Kernel Mode Code Signing Policies present on 64-bit Windows, and can be loaded without a CA-issued certificate.If this sounds scary to you, you need to come to this talk.

TBA


Presenters:

Links:

Similar Presentations: