Developing a kernel patch or driver for windows?

Question

How long, approximately, would it take to develop a kernel patch or driver for the windows NT kernel/series of kernels, that would introduce new functionality, or replace existing functionality?

For example, to add in a different encryption algorithm, or to implement some sort of new security model.

What are the advantages/disadvantages between actually writing a kernel patch, and a driver?

Can a driver be theoretically bypassed, in a way a kernel patch cannot?

I understand the windows kernel is proprietary and it is hard to write a kernel patch for it, but this is exactly what several companies, notably AV companies do, without cooperation from Microsoft, so it is possible...

Answer 1

A different encryption algorithm

This is done by extending the encryption provider. There is a framework where you can do that.

new security model

What new security model?

• If you want more specific control over one application, you build a sandbox.
• If you want more specific control over an OS, you put the OS into a virtual machine.
• If you have something completely new, you have to write a new kernel. Right management is really a broad topic, where you have to touch every entry point to get your solution to work.

Can a driver be theoretically bypassed, in a way a kernel patch cannot?

No and yes ... How do you think a driver changes a security model?

but this is exactly what several companies, notably AV companies do.

No, they don't. They have a kernel driver, which hooks into the right functions. Most AV software hooks the ReadFile/WriteFile/CreateFile APIs, in which they check for 'malicious code-sequences'. This is not a security model. Its just a binary 'May access/may not access' check.

Answer 2

Well, Christopher is wrong above...Kernel Patches are used quite a lot in Windows land.

Just to quote from the wiki: wikipedia.org/wiki/Kernel_Patch_Protection

"Since patching the kernel is technically permitted in x86 editions of Windows, several antivirus software developers use kernel patching to implement antivirus and other security services. This kind of antivirus software will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection has been criticized for forcing antivirus makers to redesign their software without using kernel patching techniques."

ACL's are far from state of the art, something like RBAC is far more functional.

Anyway, I think a kernel patch is a better solution, as there wont be performance overhead when you switch from usermode, and you can provide additional system calls and functionality nativley.