Kernel Driver Update for Windows 11 Compatibility
Budget: $100 – $300 CAD
# Windows Kernel Driver - Add Windows 11 Support
## Project Overview
I have a fully functional Windows kernel driver that uses function pointer hooking in win32kbase.sys, specifically targeting NtGdiPolyPolyDraw+0x366. The driver works perfectly on Windows 10 but fails on Windows 11 due to structural changes in win32kbase.sys that make the hardcoded offset invalid.
## Current Implementation
- Hooks a function pointer at NtGdiPolyPolyDraw+0x366 in win32kbase.sys
- Uses .data pointer hooking technique for secure kernel-usermode communication
- Provides memory read/write operations, process module enumeration, and memory allocation
- Comprehensive error handling and status reporting
## Technical Resources Provided
- **Complete source code**: https://github.com/pablogg32/gdi-internals
- **Automated usermode test suite** with instant verification of all driver functions
- **Clear pass/fail reporting** for communication, read/write operations, memory allocation, and module enumeration
- **Works perfectly on Windows 10** - your job is adding Windows 11 support while maintaining compatibility
###**Important Code Modification Notice**
The uploaded source contains an **intentional security modification** to prevent misuse:
In `WKDRIVER/main.cpp`, line:
target_func += 0x123; // <-- This is intentionally wrong
**For Windows 10, this should be:**
target_func += 0x366; // <-- Working Windows 10 offset
This change was made to prevent casual copy-paste usage while allowing you to assess the complete project structure. **The 0x366 offset only works on Windows 10** - this is precisely why Windows 11 support is needed, as Microsoft changed the internal structure of win32kbase.sys making this hardcoded offset invalid on newer versions.
The selected freelancer will receive the correct Windows 10 offset and your task is to implement dynamic detection or version-specific offsets that work for both operating systems.
## What I Need
**Primary Goal**: Research and locate the equivalent hook point in Windows 11's win32kbase.sys
**Implementation Requirements**:
- Implement dynamic offset detection or version-specific offsets to maintain Windows 10 compatibility
- Ensure the hook mechanism functions identically on both OS versions
- Support multiple Windows 11 versions (21H2, 22H2, 23H2+)
## Technical Requirements
- The hook point must be a reliable function pointer in win32kbase.sys .data section
- Should maintain the same calling convention and behavior as the Windows 10 implementation
- Must work with Memory Integrity/HVCI disabled
- No changes to the communication protocol or usermode interface
## Required Skills & Tools
**Reverse Engineering**:
- IDA Pro, Ghidra, or x64dbg experience
- Pattern recognition and signature scanning
- Binary diffing between Windows versions
**Windows Kernel Development**:
- WDK (Windows Driver Kit)
- Kernel debugging and driver development
- Understanding of driver loading via kdmapper: https://github.com/TheCruZ/kdmapper
**Windows Internals Knowledge**:
- Deep understanding of win32k subsystem
- Knowledge of kernel structures and calling conventions
- Experience with Windows version differences
## Testing & Verification
**Driver Loading Process**:
1. Build kdmapper from https://github.com/TheCruZ/kdmapper into executable
2. Drag `WKDRIVER.sys` onto the kdmapper executable - this loads the driver
3. Run `WKUSER.exe` to test driver functionality
**Test Suite Features**:
- Automatically verifies all driver functions work correctly
- Provides instant feedback on your changes
- Tests communication, memory operations, process enumeration
- Clear success/failure reporting for each component
- No guesswork - you'll know immediately if your solution works
## Deliverables
1. **Updated driver source code** supporting both Windows 10 and Windows 11
2. **Brief technical documentation** explaining:
- New hook point location methodology
- How version detection works
- Any limitations or considerations
3. **Verification** that all existing functionality works on both OS versions
## Ideal Candidate
- Experience with Windows kernel reverse engineering
- Familiarity with win32k subsystem hooking
- Comfortable with driver development projects
## Project Overview
I have a fully functional Windows kernel driver that uses function pointer hooking in win32kbase.sys, specifically targeting NtGdiPolyPolyDraw+0x366. The driver works perfectly on Windows 10 but fails on Windows 11 due to structural changes in win32kbase.sys that make the hardcoded offset invalid.
## Current Implementation
- Hooks a function pointer at NtGdiPolyPolyDraw+0x366 in win32kbase.sys
- Uses .data pointer hooking technique for secure kernel-usermode communication
- Provides memory read/write operations, process module enumeration, and memory allocation
- Comprehensive error handling and status reporting
## Technical Resources Provided
- **Complete source code**: https://github.com/pablogg32/gdi-internals
- **Automated usermode test suite** with instant verification of all driver functions
- **Clear pass/fail reporting** for communication, read/write operations, memory allocation, and module enumeration
- **Works perfectly on Windows 10** - your job is adding Windows 11 support while maintaining compatibility
###**Important Code Modification Notice**
The uploaded source contains an **intentional security modification** to prevent misuse:
In `WKDRIVER/main.cpp`, line:
target_func += 0x123; // <-- This is intentionally wrong
**For Windows 10, this should be:**
target_func += 0x366; // <-- Working Windows 10 offset
This change was made to prevent casual copy-paste usage while allowing you to assess the complete project structure. **The 0x366 offset only works on Windows 10** - this is precisely why Windows 11 support is needed, as Microsoft changed the internal structure of win32kbase.sys making this hardcoded offset invalid on newer versions.
The selected freelancer will receive the correct Windows 10 offset and your task is to implement dynamic detection or version-specific offsets that work for both operating systems.
## What I Need
**Primary Goal**: Research and locate the equivalent hook point in Windows 11's win32kbase.sys
**Implementation Requirements**:
- Implement dynamic offset detection or version-specific offsets to maintain Windows 10 compatibility
- Ensure the hook mechanism functions identically on both OS versions
- Support multiple Windows 11 versions (21H2, 22H2, 23H2+)
## Technical Requirements
- The hook point must be a reliable function pointer in win32kbase.sys .data section
- Should maintain the same calling convention and behavior as the Windows 10 implementation
- Must work with Memory Integrity/HVCI disabled
- No changes to the communication protocol or usermode interface
## Required Skills & Tools
**Reverse Engineering**:
- IDA Pro, Ghidra, or x64dbg experience
- Pattern recognition and signature scanning
- Binary diffing between Windows versions
**Windows Kernel Development**:
- WDK (Windows Driver Kit)
- Kernel debugging and driver development
- Understanding of driver loading via kdmapper: https://github.com/TheCruZ/kdmapper
**Windows Internals Knowledge**:
- Deep understanding of win32k subsystem
- Knowledge of kernel structures and calling conventions
- Experience with Windows version differences
## Testing & Verification
**Driver Loading Process**:
1. Build kdmapper from https://github.com/TheCruZ/kdmapper into executable
2. Drag `WKDRIVER.sys` onto the kdmapper executable - this loads the driver
3. Run `WKUSER.exe` to test driver functionality
**Test Suite Features**:
- Automatically verifies all driver functions work correctly
- Provides instant feedback on your changes
- Tests communication, memory operations, process enumeration
- Clear success/failure reporting for each component
- No guesswork - you'll know immediately if your solution works
## Deliverables
1. **Updated driver source code** supporting both Windows 10 and Windows 11
2. **Brief technical documentation** explaining:
- New hook point location methodology
- How version detection works
- Any limitations or considerations
3. **Verification** that all existing functionality works on both OS versions
## Ideal Candidate
- Experience with Windows kernel reverse engineering
- Familiarity with win32k subsystem hooking
- Comfortable with driver development projects