PLATINUMPICK

KO | EN

gitlite — search

#react #typescript #golang #android #deep-learning #linux #docker #macos #java #cli #security #pytorch #ios #openai

(★ 73)

Windows Kernel-Mode Shellcode Development Framework (WKMSDF)

PLATINUMPICK Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# PLATINUMPICK

## VERSION

- `v1.0`

## BRIEF

Project `PLATINUMPICK` is a `C++20` framework for building `Windows` `x64` kernel-mode shellcode.

It derives from project [SILVERPICK](https://github.com/winterknife/SILVERPICK) and, as such, leverages:
1. `Visual Studio Code` as the code editor
2. `MinGW-w64` as the compiler toolchain
3. `GNU Make` as the build system

Please note that this project is using [MSYS2](https://www.msys2.org/).

## USAGE

While writing `PIC` in `C/C++` using the `PLATINUMPICK` framework, you have to take into consideration the following rules:

1. Treat the `payload` function as the _(pseudo) entry point_.

2. All string literals must be declared as _stack strings_.

a. You may use the `STACK_STRING(Name, String)` macro for this purpose.

3. _Global variables_ may not be used anywhere in the code.

4. `Native API` functions may be used only via _run-time dynamic linking_ after ensuring that the function prototype is available in the corresponding header file.

a. You may use the `GET_NTOSKRNL_BASE()` macro to get the image base address of the kernel image via `IDT` scandown.

b. You may use the `INITIALIZE_FUNCTION_POINTER(Function)` macro to declare and initialize an exported symbol pointer.

c. You may use the `RESOLVE_FUNCTION_POINTER(ModuleBase, Function)` macro to resolve said symbol's address via manual `PE` parsing.

5. The `payload` function must be called at `IRQL 0` or `PASSIVE_LEVEL` to ensure payload safety.

a. You may use _work items_ or _passive-level `DPCs`_ for this purpose.

```cpp
/// @brief PIC start function
/// @param None
/// @return None
EXTERN_C NO_INLINE VOID __stdcall payload(
    VOID
) {
    // Init local variables
    PVOID pNtoskrnl = nullptr;
    INITIALIZE_FUNCTION_POINTER(DbgPrint);
    STACK_STRING(sstrFormat, "%ws\n");
    STACK_STRING(sstrText, L"hello world from kernel-mode shellcode!");

// Get the image base address of ntoskrnl.exe
    pNtoskrnl = GET_NTOSKRNL_BASE();
    if (pNtoskrnl == nullptr)
        goto cleanup;

// Resolve nt!DbgPrint
    RESOLVE_FUNCTION_POINTER(pNtoskrnl, DbgPrint);
    if (DbgPrint == nullptr)
        goto cleanup;

// Print to attached debugger
    DbgPrint(sstrFormat.data(), sstrText.data());

// Cleanup
cleanup:
    return;
}
```

## BUILDING

```console
code .
Ctrl+` OR Ctrl+Shift+B
make clean
make pic
```

## TESTING

You may wish to use the [FLARE kernel shellcode loader](https://github.com/mandiant/flare-kscldr) to test the generated code on a test `VM` created and configured using the [CodeMachine System setup for kernel development and debugging guide](https://codemachine.com/articles/system_setup_for_kernel_development.html).

![kscldr-plpi](https://raw.githubusercontent.com/winterknife/PLATINUMPICK/master/Misc/kscldr-plpi.png)

## TESTED OS VERSIONS

- `Windows 11 25H2 Build 26200 Revision 8655 64-bit`

## MITIGATIONS

1. Enable [HVCI](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement). It leverages hardware virtualization capabilities such as `Intel EPT` + `Intel MBEC` (or its software equivalent, `RUM`) to provide strong code guarantees, i.e., only properly signed kernel pages can become executable.

2. If that is not an option, use [WDAC](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) to block _known bad_ drivers that enable dynamic kernel-mode code execution (e.g., the `Capcom` driver). Ideally, you should use an allowlist consisting of _known good_ drivers.

## REFERENCES

1. [IDT Scandown](http://uninformed.org/index.cgi?v=3&a=4&p=6)
2. [kernel-shellcode.cpp](https://gist.github.com/Barakat/34e9924217ed81fd78c9c92d746ec9c6)
3. [DynamicKernelShellcode](https://github.com/DownWithUp/DynamicKernelShellcode)
4. [ksc4cpp](https://github.com/CitrusIce/ksc4cpp)
5. [KernelRuntimeImport](https://github.com/Shinn-Home/KernelRuntimeImport)
6. [kli](https://github.com/hypervisor/kli)
7. [scfw](https://github.com/vmi-rs/scfw)
8. [Meltdown Reloaded: Breaking Windows KASLR by Leaking KVA Shadow Mappings](https://web.archive.org/web/20250604112638/https://labs.bluefrostsecurity.de/blog/2020/06/30/meltdown-reloaded-breaking-windows-kaslr/)
9. [GuestAgent.c](https://gist.github.com/tandasat/bf0189952f113518f75c4f008c1e8d04)
10. [multi_arch_kernel_queue_apc.asm](https://raw.githubusercontent.com/rapid7/metasploit-framework/refs/heads/master/external/source/shellcode/windows/multi_arch_kernel_queue_apc.asm)
11. [eternalblue_kshellcode_x64.asm](https://raw.githubusercontent.com/worawit/MS17-010/refs/heads/master/shellcode/eternalblue_kshellcode_x64.asm)
12. [Windows-Kernel-Shellcode](https://github.com/r0keb/Windows-Kernel-Shellcode)
13. [Remote Windows Kernel Exploitation: Step Into the Ring 0](https://blackhat.com/presentations/bh-usa-05/BH_US_05-Jack_White_Paper.pdf)
14. [Finding the Base of the Windows Kernel](https://wumb0.in/finding-the-base-of-the-windows-kernel.html)
15. [TransitionalPeriod: Multi Ring Kernel To UserMode Payload](https://github.com/RobinFassinaMoschiniForks/TransitionalPeriod)

PLATINUMPICK

PLATINUMPICK Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

PLATINUMPICK

PLATINUMPICK Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README