YOUR FIRST KERNEL DRIVER (FULL GUIDE)

Подписаться 145 тыс.

Просмотров 123 тыс.

50% 1

To try everything Brilliant has to offer-free-for a full 30 days, visit brilliant.org/cazz/. The first 200 of you will get 20% off Brilliant’s annual premium subscription.
NOTE: To anyone struggling with freezes/crashes -- Disable Debug in the msconfig advanced options!
In this video we use Visual Studio to code an IOCTL driver for any version of Windows. The driver itself implements a custom way to read/write process memory. Alongside this we program a "user mode" application which can communicate with the driver to send it requests. This combination will effectively bypass most user mode anti-cheats out there.
Fair warning though, this is an introduction to kernel development in the world of game hacking, it does not use advanced techniques and WILL NOT bypass any decent kernel anti-cheats like Battleye or Easy Anti-Cheat. Not to mention the safety (or lack thereof) of kdmapper which has its own detection problems.
This video is meant to introduce someone who is comfortable with internal/external game hacking to the world of kernel development. We set up a virtual machine and I teach you how to debug it as well.
I encourage you to use the times stamps down below and a big shoutout to Madz for the idea 😘
💎 Source code is available for my Patrons!
/ cazzwastaken
💎 Join our community over on Discord!
/ discord
→ X (Twitter): / cazzwastaken
→ GitHub: github.com/cazzwastaken
→ Email: cazzwastaken@gmail.com
⏰Chapters⏰
00:00 Introduction
02:17 Installing Visual Studio
04:18 Installing WDK (Windows Driver Kit)
05:44 Installing VMWare Player
07:00 Obtaining an OS Disk Image
08:38 Setting up the VM (Virtual Machine)
11:05 Configuring Windows & Installing VMWare Tools
12:01 Setting up VM for Kernel Debugging
13:30 Installing WinDbg
13:56 Configuring VM Windows for Debugging
15:03 Disabling Anti-Virus
16:24 Setting up the Host for Kernel Debugging
18:26 Setting up WinDbg
19:10 Testing kernel debugging
19:57 Acquiring kdmapper
22:47 Setting up the Solution (Master project)
23:37 Creating the UM project (User Mode)
27:32 Creating the KM project (Kernel Mode
30:20 Undocumented Windows Functions
31:22 IOCTL Codes
34:07 UM/KM Request Struct
35:17 Coding DriverEntry
39:02 Coding driver_main
42:22 Setting up Driver Major Functions
46:56 Coding driver::device_control
55:20 Coding a test User Mode program
57:48 Creating UM Driver Framework
01:02:17 Implementing Read/Write Process Memory
01:06:14 Attaching to "notepad" example
01:09:11 Debugging our Driver Test
01:15:20 Getting CS2 offsets
01:16:53 Coding the CS2 "cheat"
01:22:55 Testing the CS2 "cheat"
01:23:40 Outro
📝Resources 📝
→ Visual Studio: visualstudio.microsoft.com/do...
→ Windows Driver Kit: learn.microsoft.com/en-us/win...
→ VMWare Player: www.vmware.com/products/works...
→ Windows 11: www.microsoft.com/software-do...
→ Secure Boot: learn.microsoft.com/en-us/win...
→ Latest WinDbg: learn.microsoft.com/en-us/win...
→ kdmapper: github.com/TheCruZ/kdmapper
→ CS2 offsets: github.com/a2x/cs2-dumper
→ Reading KM Debug Messages: learn.microsoft.com/en-us/win...
👀 References 👀
github.com/beans42/kernel-rea...
⚡See More ⚡
→ Learn Game Hacking: • How to LEARN HACKING
→ Reverse Engineering: • Learn Reverse Engineer...
→ Chams: • REAL CSGO CHAMS - DRAW...
→ CreateMove: • Hook CreateMove From S...
→ Internal Menu: • IMGUI INTERNAL DIRECTX...
→ Aimbot: • MAKE AIMBOT IN 10 MINUTES
🌌 Disclaimer 🌌
This video was sponsored by Brilliant.
This video was created for educational purposes.
Shout out to ‪@lucid_horizons‬ for the thumbnail ⭐

Опубликовано:

5 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 485

@cazz 5 месяцев назад

To try everything Brilliant has to offer-free-for a full 30 days, visit brilliant.org/cazz/. The first 200 of you will get 20% off Brilliant’s annual premium subscription.

@popcornpizza8869 5 месяцев назад

W sponsorship

@Cameraman-lr4vb 4 месяца назад

get_module_base is not working

@IshaqIbrahim3 Месяц назад

Timeline: 43:30 Programming The Windows Driver Model by Walter Oney and Windows Kernel Programming by Pavel Yosifovich warned against touching the IRP after calling IoCompleteRequest(). Did you take that into consideration? I noticed that you touched the IRP after calling IoCompleteRequest() by following with return irp->IoStatus.Status. They pointed out that it could lead to system crash.

@Giuseppe-ij5qz 5 месяцев назад

"Look I can even do it backwards." Absolute monster XD

@obiotwastaken 4 месяца назад

yes.

@sudowtf 5 месяцев назад

I was going to propose to Cazz if he could make slightly longer videos and this man just drops over an hour of content😂 Dude’s already absolutely going off the rails in all the good ways. Definitely gonna watch this whole! ❤ my guy

@hooliganez Месяц назад

After "dcdedit /debug on" and rebooting, things can start going crazy. Slow boot, freezes time-to-time. As far as I have read - this is UEFI/BIOS nuances. bcdedit can be slower on UEFI systems due to synchronization between NVRAM (which holds UEFI boot variables) and the BCD (Boot Configuration Data) stored in the registry. If anybody faces this - do not freak out. Just disable kernel debugging. Things should go back to normal 💪

@gastervb 2 месяца назад

Why haven't I seen this channel earlier? There is a lot of stuff that I can learn about windows and game cheats. Now I need to watch every single video to know everything. Thanks for your work.

@biigsmokee 5 месяцев назад

Finding resources this good is extremely difficult, thanks for releasing this content for free legend

@user-ew5pb5nj2k 5 месяцев назад

it's not you people just can't read

@dkkogmaw1311 5 месяцев назад

its legit not your just a paster sadly

@buddy3852 5 месяцев назад

@@dkkogmaw1311on god. He thinks he’s learning something from the video. These people have lost their mind

@timnonik2736 5 месяцев назад

@@buddy3852 Are you serious? Its literally a step-by-step how to access any process memory from a self written kernel driver. But sure, thats not useful to anyone.

@buddy3852 5 месяцев назад

@@timnonik2736 Yes, I am very serious. This is the most common, easiest, most plastered source/PoC of 'bypassing' an anti-virus / anti-cheat in the world. If you don't actually understand how it works, you will achieve and learn nothing. And saying it's "self-written" is a fucking joke. Typing it out on your own doesn't make it self-written. That's like saying "Well I hook something else than he does, so it's unique!"

@chavo6613 5 месяцев назад

Thank you so much Cazz for sharing all your knowledge with us man 🔥

@phynae 5 месяцев назад

Thanks Cazz! I learned so much from you in the past few weeks. Humanity can be proud to have you. Keep going. You are my main source when it comes to c++ and game hacking in general!

@t.n.a.1703 3 месяца назад

This video is awesome and I learned a lot. Thank you very much cazz! It would be great if you could make more videos about drivers. e.g. minifilters, anti-delete for our cheat solutions or kernel mode bypasses.

@RichardBejtlich 10 дней назад

Just the first 30 minutes of the setup is gold -- very well explained, thank you. 🙏

@Eloii_Xia 5 месяцев назад

Thank you for sharing these valuable resources! Much appreciated ❤

@justaspeedrunner 5 месяцев назад

I have no intention to make a kernel cheat, I don't even use windows, and yet here I am anyway

@cazz 5 месяцев назад

“I don’t even use windows” is based, glad you’re here bru

@execute214 5 месяцев назад

same, arch user here

@juanm3058 5 месяцев назад

oml what are you using then

@nikos4677 5 месяцев назад

@@execute214 btw...

@AlizJaytay 5 месяцев назад

⁠@iaros.hbro i stg. I tried to install some standard libraries or something one time and gave up and haven’t tried to develop on windows since

@turb0004 5 месяцев назад

It's incredible. Thanks for your work. Your videos are always interesting but this one is the best. I'm waiting for more 👏

@goozjeesh46 5 месяцев назад

wow i have been waiting for this! thank you!

@REZOLVER 5 месяцев назад

Amazing video! Thanks for this detailed tutorial!

@trechosdesucessooficial 5 месяцев назад

Bro this is like a course omg thank you for this knowledge u are the best!

@Martin_Val 5 месяцев назад

I was waiting for this!!! ❤❤

@Ace-vq7jm 5 месяцев назад

Thank you for making videos man, and not only just making them but putting in so much effort. I just wish I had this level of motivation towards something lol

@GoblinProductions69 4 месяца назад

Great Video as always. Where did you learn stuff like that anyway?

@Joelmatic 5 месяцев назад

This is amazing, Thanks you for this video.

@mariobabic9326 5 месяцев назад

thank u so much brother this is exactly the video i needed

@nairbotisol9339 5 месяцев назад

Amaizing tutorial! Thanks.

@Compyler 5 месяцев назад

THE RETURN OF THE KING Welcome back Cazz 👑

@TBaxxx 5 месяцев назад

Thank you cazz ❤🔥🔥

@thecircusb0y1 5 месяцев назад

LOVE YOUR CHANNEL , Please please please keep it up.

@I.walk_with_a_stick 5 месяцев назад

DUDE NO WAY I WAS SEARCHING YESTERDAY FOR A TUT AND CAZZ SAVED THE DAY TODAY!!!!!!

@w42s 5 месяцев назад

Hello coded it up yesterday works like a charm I love it. Thanks so much! but I gotta rather picky question just simply why the bool in_air reversed?

5 месяцев назад

I use Linux exclusively on literally all my devices but boy do I enjoy this kind of content, pop corn ready

@abuelo_gen 5 месяцев назад

You are awesome, keep going and i hope you success

@anoxidus 10 дней назад

Crowdstrike should watch this

@Adrian00213 5 месяцев назад

great stuff!! 🥰 One anticheat i am trying to brake hopefully with this guid is using TLS callback as way to know if user is doing sketchy stuff. Would this method bypass the check? Is there another way i could bypass the TLS callbacks?

@nolancao2878 5 месяцев назад

thanks a lot for this.

@LukeTKC 5 месяцев назад

Damn lol, just discovered your channel start of this month when coding for my DMA cs2 cheat, you videos helped with some additional knowledge. pretty convenient how you start uploading now again😂 Welcome back

@Michtar 5 месяцев назад

hi tkcz

@PXINXYZ 5 месяцев назад

Wtf real tkcz?!?

@mariobabic9326 5 месяцев назад

which dma device are u using for cs2? also why do you use dma when u can simply use a kernel driver like shown in the video?

@airtrack9540 5 месяцев назад

@@mariobabic9326 Maybe Faceit?

@itzlaith 5 месяцев назад

@@mariobabic9326 dma for faceit cheating

@FloofyPlasma 5 месяцев назад

LOL perfect timing, was just considering making one a few days ago.

@modifyingmemory 2 месяца назад

thanks for the upload

@inqmusician2 2 месяца назад

MS devs back in the day didn't call the blue screen "blue screen of death". They call it simply blue screen or a BugCheck. BugCheck(or KeBugCheck) is a function down in the NT API that allows to raise the blue screen in the event that something down in the kernel. I'm here mostly for malware development, because the knowledge between cheat development and malware development is interchangeable. Like creating drivers and making malware that is invisible to the antiviurs or an IDS program. Or bypasssing anticheats, that are behaving like antiviruses themselves. The more you live, the more you learn.

@zxuiji 5 месяцев назад

Thanks, I'm planning on writing a driver api wrapper in the future to minimise differences between linux and msw so this was helpful for that future plan. For now though I'll be focusing on a separate more important project for ending the need for compiling *.exe/*.elf/*.dll/*.so directly (in most cases, certain exceptions apply, underlying wrappers can still be used though)

@Luzum 5 месяцев назад

I've been waiting for this for so long, very anticipated, can't wait to start. Thanks cazz!

@kianjs 5 месяцев назад

Cazz gives me a tingly feeling with these videos

@roKoTHC 5 месяцев назад

I'd recommend using physical memory for communication. Create a r/w struct in your application and have the driver grab/fill data through physical memory reads and writes.

@murderspree 4 месяца назад

Could you elaborate on why?

@senkuu2318 5 месяцев назад

first time in my entire life leaving a comment when a video posted recently

@krillinbaldhead9863 5 месяцев назад

p2c in shambles after this comes out, good job Cazz !!!

@bezik572 4 месяца назад

Thank you for your video! It was pretty clear, however, could you please tell me, how did you find the IoCreateDriver and the other if it isn't documented? How can I find the other functions which are not documented? Thank you!

@adamjung9547 5 месяцев назад

thank you just what I've been looking for i'm early:)

@egely1337 5 месяцев назад

great content!

@henriquematias1986 5 месяцев назад

Amazing content!! As a side note, i was wondering: I got a firewire soundcard that has no drivers for the latest Windows.. Considering we know what is the FireWire chip you think we could code one ourselves? Is there such a thing as reverse engineering a driver already made and then updating it?

@ningu1036 5 месяцев назад

CAZZZZ FINALLY LETS GOOO!!!

@Tapsby7 Месяц назад

Hey man! Tysm for the video, truly appreciate it. Just wanted to ask how to go about a driver that works for AC’s that run on KM and not UM, for example EAC. Asking because I want to code a driver for Apex

@gabirican4813 2 месяца назад

Thanks!

@dexx0 5 месяцев назад

yoooo bro DROPPEDDDD

@llozyyyy8567 5 месяцев назад

LOVE U CAZZ

@patrick_pati5036 3 месяца назад

Nice video would you do that same thing for a Normal Injector ?

@xeigar 3 месяца назад

hello can i ask if i the cs hack will work to cs2? if i change the basics and the assets?

@EL_ARTEM 5 месяцев назад

If you want to use this without KDMapper (I have AMD chip, so i use disable DSE instead): just write everything in DriverEntry function and delete IoCreateDriver implementation. To load just use (cmd -admin): sc create your_service_name type= kernel binPath= c:\yourDriver\yourDriver.sys then disable DSE sc start your_service_name

@ai_coding 3 месяца назад

So if u make ur own kernel driver it will be detected by AV? Unless u get it signed off by Microsoft?

@andrew_111 5 месяцев назад

It made my day

@pandabeaarr1851 15 дней назад

I’m getting an errors- violated CI chase policy and Failed to create driver kernel. Why. Code was built successfully

@Andoxico 5 месяцев назад

Do you have any resources for studying how to bypass kernel level anti-cheats?

@alexandrohdez3982 5 месяцев назад

I do enjoy 👏👏👏👏👏👏

@sugus8869 3 месяца назад

Is it possible to program and debug a kernel driver directly in the virtual machine? During the tutorial some programs stopped working and I had to format my PC. I only have one computer, if I change things that make other programs that I need daily not work, it's a problem. I thought about doing everything in the virtual machine, I downloaded VMware Workstation Pro, and installed Visual Studio in the virtual machine, but now I don't know how to debug xD

@tin13001 2 месяца назад

You should do a part 2 continue building on this driver. Swap out IOCTL for UM-KM shared memory, pointer/function hooking, callbacks. Maybe impersonate a PatchGuard thread? ;)

@lucidmiller 5 месяцев назад

everything worked just fine until 19:23 when I launch VMware to test the connection & I get an error message that reads: Transport (VMDB) error -14: Pipe connection has been broken. I google the error & did everything suggested but nothing worked. Guess I'm just not gonna use VMware then

@malcoder 2 месяца назад

MORE PLEASE!

@christianross2567 5 месяцев назад

"I really hope this doesn't ruin cs2" UD cheats are like 5 bucks a month already lol. Great video, as always. Really appreciate your hard work.

@oroelcobaya06 5 месяцев назад

if you want to sell a cs2 cheat, just paste aimstar's src and change its menu

@user-mb1qe8je2v 15 дней назад

It's such a whelsome feeleing trying to learn something while U understand only 10% of what's going on there))

@icz 5 месяцев назад

I liked your vid before started watching

@Zarrmo 5 месяцев назад

1:21:07 how u enabled showing "vKey" near VK_SPACE ?

@rikoboo 4 месяца назад

legend is spoon feeding us, watch it whole dont skip u dont wanna miss anything important

@tomifilep1 Месяц назад

Thanks this is very informative video but can you make a video for vanguard bypass for Leauge of Legends? or just how to disassemble the vanguard. sys and find how to bypass

@rlynotabot 5 месяцев назад

How did I miss this channel ?

@Lojdika 4 месяца назад

A tutorial for user mode driver (UMDF V2) would be greatly appreciated. This video is invaluable, nevertheless.

@davidh4678 Месяц назад

is this stil working ? i have error 433 when createfile on driver from user mode app

@ImmuneLion318 4 месяца назад

My Question Is Since KdMapper Abuses An Intel Driver Vuln What Happens If You Have An AMD Cpu, Which I Have I Haven't Checked But I'm Assuming I'm Missing This Intel Driver So What Would Be My Immediate Solution For Mapping.

@Reality-rg9ud 6 дней назад

I've never tried to code a driver before, this video made me give it a try and no matter what i do, i have followed the video and everything you said, i can read memory fine but if i go to write memory anywhere i get a STATUS_PARTIAL_COPY, the header of this status code mentions protection conflicts related to this, even if the memory i am trying to write to is not even in read only i tried changing protection using ZwProtectVirtualMemory but also fails with 0xC0000008 error, what is going on here?

@julius3066 5 месяцев назад

i fully rebuild the code from the its amazing!!

@Jujudo 3 месяца назад

This is the sickest thing ever

@tixxrz7180 3 месяца назад

What should I look up if I want to find/pay a dev to develop a chair or series of chairs for me?

@ignasskarzinskas7126 5 месяцев назад

So hi cazz. I'm having a really strange problem. When enabling debug with "bcdedit /debug on" and restarting my pc, it boots up very slow, and starts to freeze a lot. Have you encountered this, and if you had do you have any possible solution to this?

@user98292 3 месяца назад

im having the same problem, my computer freezes after startup. how did you fix it?

@TVSh0rts 5 месяцев назад

Do you know any other articles/tutorials/resources that teach more advanced stuff about kernels?

@skysport9110 15 дней назад

@sepremz 5 месяцев назад

Thanks bud

@wessss9877 3 месяца назад

Just how detectable is this for a game that has actual anti cheat? (battleye destiny2)

@AbdullahYazbahar 5 месяцев назад

Me: wow, really cool NoOne: CS2 devs watching carefully

@StrongerFX 5 месяцев назад

ty cazz S2

@godzab 5 месяцев назад

More please 🙏

@akakamaz7382 5 месяцев назад

im too incompetent to make a cheat, nor do i want to make one, but youtube continues to recomend me this channel

@Bukharian-gw8mv 5 месяцев назад

whats the harm in trying, go for it.

@akakamaz7382 5 месяцев назад

@@Bukharian-gw8mv the harm is me getting baned 😂, or geting a virus by downloading the tools 🙄, or corruping my os onto oblivion given that the tutorial is a kernel cheat 😫

@Bukharian-gw8mv 5 месяцев назад

@@akakamaz7382 😂 lmao and for that reason alone in trying it on my spare laptop.

@G5XD 4 месяца назад

@@akakamaz7382⁠getting banned is so easily avoidable. You’re definitely not gonna get a virus, and the incredible part about a VM is you won’t fuck your pc.

@fatallware 2 месяца назад

new to this all, will this work on win11?

@ruohki 5 месяцев назад

Hmm, followed the tutorial, but somehow the um application cannot contact the driver. It simply won't find it using CreateFile. Any suggestions? Edit: Loading it with kdm seems to work. At least it won't blue screen and all relevant debug messages are printed.

@kebabranu4489 4 месяца назад

so do i have to buy windows for the vm ????

@manhvo242 3 месяца назад

This is an absolute W

@youngv3ru 5 месяцев назад

Thats a good tutorial actually. Its very helpful. Definetely Recommend this guy!

@Mezbelelik 4 месяца назад

How can I call the game function? I couldn't find any resources on this topic. For example, I want to call the jump function. Could you create a video about it?

@jarjava11 5 месяцев назад

It's interesting, I created the driver without problems in C++ but I load it in C#. I want to make a trainer in Windows Form. I have created classes to read float, int, string but it is giving me wrong values. If you could help with that in some way

@popcornpizza8869 5 месяцев назад

Nice

@jordanwright6854 3 месяца назад

I figured you were South African but when I heard the "yoh if I could spell" I knew

@shialex2553 5 месяцев назад

u have to make big video about esp(internal) on cs2, it is gonna be interesting

@Kutila622 4 месяца назад

Well, driver working, my cheat is working, but any idea to fix the "Failed to create the driver handle" after restarting the PC ? If i want it to work again after rebooting i need to modify the 4 names of the driver and use Kdmapper again... Any fix to this ? I don't want to rename it everytime and map it everytime with kdmapper if their is a way for both, please let me know.

@hustlecrowe 4 месяца назад

You shouldn't need to modify the driver at all, but you do need to map the driver using kdmapper each time you restart, because restarting your PC will cause the driver to no longer be loaded.

@aboveall777 4 месяца назад

hey bro i want to ask u is visual studio not anymore safe which alternative should i use?

@r0xt0 4 месяца назад

visual studio is safe use it

@Toothlessv 4 месяца назад

bro cazz you said that these work for ghost of tabor so how do i do it

@noahsndergaard9297 5 месяцев назад

Keep up the good work Cazz, you're always so down to earth. So it's always so chill to watch your vids🥇

@a_talking_potato8390 2 месяца назад

Im trying to make a valorant color triggerbot but i just cant figure it out. Ive tried for hours and nothing is working, could you maybe make a video about triggerbots or something? Love your videos