← All talks

Kernel Driver Libraries and IOCTL Codes #shorts

BSides Frankfurt1:16384 viewsPublished 2026-01Watch on YouTube ↗
About this talk
Discover kernel driver libraries, external functions, and ioctl codes, including attach, readmemory, writememory, checkwritablememory, and killprocess. Attach moves process memory from target to current process. #bsidesfrankfurt #bsides #bsidesfra #juansacco
Show transcript [en]

refer your libraries. Yeah, libraries that you will use in kernel. So it's not that you can choose call any library. They are libraries that going to be implemented for a kernel driver. And then I'm calling external functions in this in this particular case, but it's it's not uh it's not something that is going to come by standard. I'm calling m M copy virtual memory to interact with the memory and then IO create driver directly from the kernel. But this is where it goes standard. First I define the the IOCTL codes. Yeah. And then the structure. Sorry if I go too fast. It's because we don't have that much time. Uh so um this is uh basically the IOTL codes. I I

have five different IOCL codes. Uh I have attach read memory memory check write memory and kill process. Why? What? What do you think I have that? So what it's going to do first attach is going to allow me to attach a process and then move the process memory from that target process into my target process into the process remember. Yes. >> Yes. There you go. Um, so that's attach