Methodology for Static Reverse Engineering of Windows Kernel Drivers

Published

2020-04-15 18:34

Collected

2026-10-17 10:08

---
id: 9800
title: "Methodology for Static Reverse Engineering of Windows Kernel Drivers"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2020/04/15/methodology-for-static-reverse-engineering-of-windows-kernel-drivers/"
published_at: "2020-04-15T18:34:00Z"
phying_url: "https://phying.com/item/9800"
lang: en
---

# Methodology for Static Reverse Engineering of Windows Kernel Drivers

## Summary

Introduction Attacks against Windows kernel mode software drivers, especially those published by third parties, have been popular with many threat groups for a number of years. Popular and well-documented examples of these vulnerabilities are the CAPCOM.sys arbitrary function execution, Win32k.sys local privilege escalation, and the EternalBlue pool corruption. Exploiting drivers offers interesting new perspectives not available to us […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2020-04-15T18:34:00Z
- **Original:** https://specterops.io/blog/2020/04/15/methodology-for-static-reverse-engineering-of-windows-kernel-drivers/
- **Phying News:** https://phying.com/item/9800