HEVD Windows Kernel Exploitation Tutorial

What it is

Chapter 0 of a 5-part HEVD (HackSys Extreme Vulnerable Driver) Windows kernel exploitation series by mdanilor. This installment is pure environment setup for a two-machine kernel debugging rig; the exploitation itself is deferred to later chapters. The author collaborated with others and notes their angle is depth on SMEP and KPTI bypass, plus a "rare, if not unique" sysret approach to KPTI.

Preconditions / Affected

• A hypervisor that exposes SMEP to the guest. The page states VirtualBox does not support SMEP; use recent Hyper-V or VMware. Author recommends Hyper-V for better kernel-debugging performance and warns VMware "will most certainly have performance issues."
• A Windows 10 guest (debuggee) downloaded from Microsoft, and a Windows host (debugger). Host can itself be virtualized.
• Windows SDK on the host (ships WinDbg).

What to do

On the debuggee, as Administrator, enable network kernel debugging:

bcdedit /debug on
bcdedit /dbgsettings net hostip:<HOST IP ADDR HERE> port:50000

This prints a key; copy it to the host. In WinDbg on the host: File → Kernel Debugging, keep port 50000, paste the key, OK, then reboot the guest to attach. On Hyper-V advanced mode the connection drops until you resume with F5.

Install and start the driver on the debuggee (Administrator). The service will error on start if no debugger is attached — attach first, then rerun:

sc create HEVD binPath= <Path to HEVD root folder>\driver\vulnerable\x64\HEVD.sys type= kernel
sc start HEVD

Enable DbgPrint output in WinDbg (pause first):

ed nt!Kd_IHVDRIVER_Mask 8

Validate by stopping/starting HEVD and confirming debug messages appear. Enable the Memory, Call Stack, and Disassembly views. The author uses a host↔guest shared folder to pass the exploit binary and HEVD.sys, avoiding a Visual Studio install on the guest (setup of the share is omitted as hypervisor-specific).

Caveats

This chapter delivers no vulnerability analysis, exploit code, or mitigation-bypass detail — those (kASLR, SMEP, KVA Shadow/KPTI, ROP, sysret shellcode) are promised for Chapters 1–4. The author does not know why VirtualBox lacks SMEP support. Act on this only if you intend to follow the full series.