Automating Windows Kernel Analysis With Symbolic Execution

No ratings

Presented at BsidesCleveland 2019 by

Spencer Mcintyre

Symbolic Execution is changing the art of vulnerability research. This talk willdiscuss using the popular angr framework specifically as used within the contextof the Windows kernel. Due to the technology being newer, there are inherentshort comings in compatibility which will be discussed with recommendations onhow to address them with detailed examples. This portion of the talk will goover some technical details of the Windows kernel, how binaries are loaded, somecontrol flow routines and how they impact simulation within the angr framework.Finally a case study will be provided on utilizing angr for the purpose ofautomating the analysis necessary to triage kernel mode drivers.Attendees will leave the talk with an understanding of what symbolic executionis from a high level and familiarity with the basic functionality provided bythe angr framework. Finally, attendees will see an example of applying angr tosolve a real world problem while addressing the current limitations.