Remote Kernel Debugging (HEVD-Part 1)
This post will setup the VMs for Debugger(Win10 x86) and Debuggee(Win7 x86) for the Kernel Debugging using HEVD (HackSysExtremeVulnerableDriver) as case study.
The tools that we need for our installation
Host
1. Binary Ninja (personal/trial)
Debugger VM
2. HEVD 2.0 pdb
Debuggee VM
1. HEVD 2.0 sys
3. Python 2.7 ( python 3.0+)
Install Window 10 VM (Debugger)
Install Window 7 (Debuggee)
Once the OS have successfully installed on both VM. Download and Install it.
(Debugger)
(Debuggee)
==================================Debugger VM==================================
Add follow sympath for WinDbg on Debugger VM
Variable Name : _NT_SYMBOL_PATH
Variable Value : SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols
Click ok and Shut Down the VM.
Edit the .vmx file configuration.
serial0.present = "TRUE"
serial0.fileType = "pipe"
serial0.fileName = "\\.\pipe\com_1"
serial0.pipe.endPoint = "server"
Boot up the VM (Debugger) machine and turn on WinDBG.
and click Ok
Let go to Debuggee VM and setup
==================================Debuggee VM==================================
Run follow command on Debuggee VM at cmd.exe (Run as administrator)
bcdedit /copy {current} /d “Debug”
bcdedit /debug {} on
bcdedit /dbgsettings
Start the OSR Driver Loader
Specify the configuration as above and point to the location of HEVD.sys
Register Service
Start Service and Shut Down the VM
Edit the .vmx file configuration.
serial0.present = "TRUE"
serial0.fileType = "pipe"
serial0.fileName = "\\.\pipe\com_1"
serial0.pipe.endPoint = "client"
and boot the Debuggee VM
=====================Back to Debugger Machine and check on the WinDBG=====================
We can see that t he \\.\com1 is connected and is showing Window 7 Kernel Version 7601
Let stop the Kernel Process for awhile and inspect the HEVD is running.
Run lm m HEVD* , to check if HEVD is in the module list.
If yes > Installation is done
If no > Setup once more, something is missing.
Comments
Post a Comment