flare-kscldr's Introduction

Kernel Shellcode Loader

FLARE kernel shellcode loader. For discussion and example usage, see the blog: Loading Kernel Shellcode.

Build

Building the Driver

Open a WDK build prompt
Run ez.cmd to build and sign the driver and build the user-space app
Output files will be in the bin directory

The user-space executable will install the driver if it is not already installed.

Building the User-Space Application Without msvcrt (optional)

Open a Visual Studio build prompt
Change to this directory
Type rc.exe resource.rc
Type cl.exe /Fekscldr.exe /I..\inc kscldr_u.c resource.res

Target Setup

One-time setup:

Run bcdedit /set testsigning on
Set up kernel debugging (likely entails bcdedit /set debug on).
Not essential, but if you want to see debug output, be sure to adjust the following setting:
```
[HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter]
"DEFAULT"=dword:00000008
```
The setting is literally named DEFAULT (as opposed to the (Default) value that is present under all registry keys). For details, see: Getting DbgPrint Output To Appear In Vista and Later
Reboot.
Copy the user-space executable kscldr.exe to the target machine. It will install the driver when you run it.

Optional Target Setup

Sure, you can install the driver manually if you really want to:

sc create kscldr type= kernel start= demand binPath= %CD%\kscldr.sys

The spaces after the equals are important, alas.

Running It

Open either SysInternals' DbgView or your kernel debugger
Run kscldr.exe your_kernel_shellcode.bin

If compiled with CFG_EN_ENFORCE_BREAKPOINT disabled (see inc\config.h), then the tool requires an additional requirement indicating whether to issue a kernel breakpoint prior to entering the shellcode.

Recommend Projects