Abusing the NT Kernel Shim Engine

Presented at REcon 2016, June 19, 2016, 2 p.m. (60 minutes).

The Kernel Shim Engine is the kernel’s analogue to the user-mode shim engine (ShimEng). Although the latter now has had some pretty good research done on it, the KSE remains a mystery. First introduced in Windows XP as merely a Plug-and-Play compatibility layer for custom registry flags, it morphed into a nearly-full blown Shim Engine implementation, with the ability to misuse it for both persistence and stealth hooks in the kernel. In this talk, you’ll learn how to use the KSE for hooking drivers (dispatch tables, IRPs, and entrypoints) as well as kernel APIs both legitimatelly and illegitimately. You’ll also see some WinDBG scripts & techniques for detecting and enumerating installed kernel shims for forensic purposes. Finally, a tool called DriverMon is planned for release at the conference, which uses the KSE to provide ProcMon for Drivers.

Presenters:

• Alex Ionescu

Links:

• https://recon.cx/2016/talks/abusing-the-nt-kernel-shim-engine.html
• https://infocon.org/cons/REcon/REcon 2016/REcon 2016 videos/alex-ionescu-Abusing-the-NT-Kernel-Shim-Engine.mp4

Similar Presentations:

• Black Hat USA 2011 / Exploiting the iOS Kernel
• REcon 2008 / NetWare kernel stack overflow exploitation
• Black Hat USA 2022 / To Flexibly Tame Kernel Execution With Onsite Analysis