DetectManualMapDriver

简体中文

Overview

DetectManualMapDriver is an experimental Windows kernel driver solution that collects four proof-of-concept projects for detecting manually mapped or shellcode-style kernel drivers from different angles.

The repository focuses on:

• enumerating kernel pool allocations,
• walking kernel PTEs to find executable memory,
• spotting suspicious CFG data-pointer redirections, and
• scanning suspicious executable regions for import-stub patterns.

This repository is intended to document implementation ideas in code. It is not a production-ready product, and some PoCs rely on build-specific pattern matching.

Origin

This repository is a code-experiment and implementation companion to the Kanxue forum article "无痕"驱动的检测与分析：重映射驱动靶场构造、扫描与特征剥离，附源码. The projects here mirror and validate the detection ideas discussed in that post.

Features

• Four experimental PoCs that focus on different kernel-memory detection angles.
• A composable workflow: PoolPageWalk or PTE_Walk can be used to locate suspicious executable memory first, then ScanImportFeature can be used to inspect the candidate region in more detail.
• A separate detection path for CFG/data-pointer hook scenarios through ScanDataPtrHook.

Projects

PoolPageWalk

Enumerates entries stored in PoolBigPageTable and prints the virtual address and size of each big pool allocation.

Supported versions:

• Windows 10 1803 and later: most builds
• Windows 11: most builds

PTE_Walk

Walks kernel PTEs in the higher-half address space, filters executable pages, merges continuous ranges, and skips executable pages already backed by known loaded modules.

Supported versions:

• Theoretically supports most Windows 10 builds
• Theoretically supports most Windows 11 builds

ScanDataPtrHook

Scans __guard_dispatch_icall call sites to find suspicious CFG/data-pointer replacements whose callback addresses do not belong to normal loaded modules.

Supported versions:

• Tested on most Windows 10 builds starting from build 19041
• Tested on most Windows 11 builds

ScanImportFeature

Scans a suspicious executable pool region for FF 25 import-style stubs and reports entries whose resolved targets land inside expected modules such as ntoskrnl.exe or WDF modules.

Supported versions:

• Does not rely on OS-build-specific signatures or hardcoded system offsets
• Theoretically supports most Windows 10 builds
• Theoretically supports most Windows 11 builds

Supported Environment

• Toolchain: Visual Studio 2017 + WDK 10
• Driver model: KMDF
• Architecture: currently tested on x64 only
• OS scope: Windows 10 / Windows 11 x64 lab or VM environments
• Compatibility note: some projects depend on build-specific signatures and may require updates on newer Windows builds

Build

1. Install Visual Studio 2017 and WDK 10.
2. Open DetectManualMapDriver.sln.
3. Select the x64 platform and either Debug or Release.
4. Build the whole solution or build one project at a time:
   • PoolPageWalk
   • PTE_Walk
   • ScanDataPtrHook
   • ScanImportFeature
5. The generated .sys files will be placed in the corresponding build output directory.

Notes

• This repository contains experimental research PoCs rather than a turnkey detector.
• Some projects still include debugging-oriented assumptions, such as debug breakpoints or locally chosen test ranges.
• Use these drivers in a controlled kernel debugging environment.