YOUR FIRST KERNEL DRIVER (FULL GUIDE)
Рет қаралды 101,502
Күн бұрынTo try everything Brilliant has to offer-free-for a full 30 days, visit brilliant.org/cazz/. The first 200 of you will get 20% off Brilliant’s annual premium subscription.
In this video we use Visual Studio to code an IOCTL driver for any version of Windows. The driver itself implements a custom way to read/write process memory. Alongside this we program a "user mode" application which can communicate with the driver to send it requests. This combination will effectively bypass most user mode anti-cheats out there.
Fair warning though, this is an introduction to kernel development in the world of game hacking, it does not use advanced techniques and WILL NOT bypass any decent kernel anti-cheats like Battleye or Easy Anti-Cheat. Not to mention the safety (or lack thereof) of kdmapper which has its own detection problems.
This video is meant to introduce someone who is comfortable with internal/external game hacking to the world of kernel development. We set up a virtual machine and I teach you how to debug it as well.
I encourage you to use the times stamps down below and a big shoutout to Madz for the idea 😘
💎 Source code is available for my Patrons!
/ cazzwastaken
💎 Join our community over on Discord!
/ discord
💎 Support me with a donation!
www.paypal.com/donate/?hosted...
→ Instagram: / cazzwastaken
→ X (Twitter): / cazzwastaken
→ GitHub: github.com/cazzwastaken
→ Email: cazzwastaken@gmail.com
⏰Chapters⏰
00:00 Introduction
02:17 Installing Visual Studio
04:18 Installing WDK (Windows Driver Kit)
05:44 Installing VMWare Player
07:00 Obtaining an OS Disk Image
08:38 Setting up the VM (Virtual Machine)
11:05 Configuring Windows & Installing VMWare Tools
12:01 Setting up VM for Kernel Debugging
13:30 Installing WinDbg
13:56 Configuring VM Windows for Debugging
15:03 Disabling Anti-Virus
16:24 Setting up the Host for Kernel Debugging
18:26 Setting up WinDbg
19:10 Testing kernel debugging
19:57 Acquiring kdmapper
22:47 Setting up the Solution (Master project)
23:37 Creating the UM project (User Mode)
27:32 Creating the KM project (Kernel Mode
30:20 Undocumented Windows Functions
31:22 IOCTL Codes
34:07 UM/KM Request Struct
35:17 Coding DriverEntry
39:02 Coding driver_main
42:22 Setting up Driver Major Functions
46:56 Coding driver::device_control
55:20 Coding a test User Mode program
57:48 Creating UM Driver Framework
01:02:17 Implementing Read/Write Process Memory
01:06:14 Attaching to "notepad" example
01:09:11 Debugging our Driver Test
01:15:20 Getting CS2 offsets
01:16:53 Coding the CS2 "cheat"
01:22:55 Testing the CS2 "cheat"
01:23:40 Outro
📝Resources 📝
→ Visual Studio: visualstudio.microsoft.com/do...
→ Windows Driver Kit: learn.microsoft.com/en-us/win...
→ VMWare Player: www.vmware.com/products/works...
→ Windows 11: www.microsoft.com/software-do...
→ Secure Boot: learn.microsoft.com/en-us/win...
→ Latest WinDbg: learn.microsoft.com/en-us/win...
→ kdmapper: github.com/TheCruZ/kdmapper
→ CS2 offsets: github.com/a2x/cs2-dumper
→ Reading KM Debug Messages: learn.microsoft.com/en-us/win...
👀 References 👀
github.com/beans42/kernel-rea...
⚡See More ⚡
→ Learn Game Hacking: • How to LEARN HACKING
→ Reverse Engineering: • Learn Reverse Engineer...
→ Chams: • REAL CSGO CHAMS - DRAW...
→ CreateMove: • Hook CreateMove From S...
→ Internal Menu: • IMGUI INTERNAL DIRECTX...
→ Aimbot: • MAKE AIMBOT IN 10 MINUTES
🌌 Disclaimer 🌌
This video was sponsored by Brilliant.
This video was created for educational purposes.
Shout out to @lucid_horizons for the thumbnail ⭐
@cazz 3 ай бұрын
To try everything Brilliant has to offer-free-for a full 30 days, visit brilliant.org/cazz/. The first 200 of you will get 20% off Brilliant’s annual premium subscription.
@popcornpizza8869 3 ай бұрын
W sponsorship
@Cameraman-lr4vb 2 ай бұрын
get_module_base is not working
@Giuseppe-ij5qz 3 ай бұрын
"Look I can even do it backwards." Absolute monster XD
@obiotwastaken 3 ай бұрын
yes.
@sudowtf 3 ай бұрын
I was going to propose to Cazz if he could make slightly longer videos and this man just drops over an hour of content😂 Dude’s already absolutely going off the rails in all the good ways. Definitely gonna watch this whole! ❤ my guy
@chavo6613 3 ай бұрын
Thank you so much Cazz for sharing all your knowledge with us man 🔥
@gastervb Ай бұрын
Why haven't I seen this channel earlier? There is a lot of stuff that I can learn about windows and game cheats. Now I need to watch every single video to know everything. Thanks for your work.
@justaspeedrunner 3 ай бұрын
I have no intention to make a kernel cheat, I don't even use windows, and yet here I am anyway
@cazz 3 ай бұрын
“I don’t even use windows” is based, glad you’re here bru
@execute214 3 ай бұрын
same, arch user here
@mona.supremacy 3 ай бұрын
@@cazz in fact, using windows for development always seemed to be MUCH more complicated and nuanced to me. So yeah, it's you are the one being based here to deal with all that MS nonsense while staying super productive still.
@juanm3058 3 ай бұрын
oml what are you using then
@nikos4677 3 ай бұрын
@@execute214 btw...
@biigsmokee 3 ай бұрын
Finding resources this good is extremely difficult, thanks for releasing this content for free legend
@user-ew5pb5nj2k 3 ай бұрын
it's not you people just can't read
@dkkogmaw1311 3 ай бұрын
its legit not your just a paster sadly
@buddy3852 3 ай бұрын
@@dkkogmaw1311on god. He thinks he’s learning something from the video. These people have lost their mind
@timnonik2736 3 ай бұрын
@@buddy3852 Are you serious? Its literally a step-by-step how to access any process memory from a self written kernel driver. But sure, thats not useful to anyone.
@buddy3852 3 ай бұрын
@@timnonik2736 Yes, I am very serious. This is the most common, easiest, most plastered source/PoC of 'bypassing' an anti-virus / anti-cheat in the world. If you don't actually understand how it works, you will achieve and learn nothing. And saying it's "self-written" is a fucking joke. Typing it out on your own doesn't make it self-written. That's like saying "Well I hook something else than he does, so it's unique!"
@phynae 3 ай бұрын
Thanks Cazz! I learned so much from you in the past few weeks. Humanity can be proud to have you. Keep going. You are my main source when it comes to c++ and game hacking in general!
@Martin_Val 3 ай бұрын
I was waiting for this!!! ❤❤
@Eloii_Xia 3 ай бұрын
Thank you for sharing these valuable resources! Much appreciated ❤
@goozjeesh46 3 ай бұрын
wow i have been waiting for this! thank you!
@REZOLVER 3 ай бұрын
Amazing video! Thanks for this detailed tutorial!
@trechosdesucessooficial 3 ай бұрын
Bro this is like a course omg thank you for this knowledge u are the best!
@turb0004 3 ай бұрын
It's incredible. Thanks for your work. Your videos are always interesting but this one is the best. I'm waiting for more 👏
@t.n.a.1703 Ай бұрын
This video is awesome and I learned a lot. Thank you very much cazz! It would be great if you could make more videos about drivers. e.g. minifilters, anti-delete for our cheat solutions or kernel mode bypasses.
@Compyler 3 ай бұрын
THE RETURN OF THE KING Welcome back Cazz 👑
@Ace-vq7jm 3 ай бұрын
Thank you for making videos man, and not only just making them but putting in so much effort. I just wish I had this level of motivation towards something lol
@nairbotisol9339 3 ай бұрын
Amaizing tutorial! Thanks.
@I.walk_with_a_stick 3 ай бұрын
DUDE NO WAY I WAS SEARCHING YESTERDAY FOR A TUT AND CAZZ SAVED THE DAY TODAY!!!!!!
@TBaxxx 3 ай бұрын
Thank you cazz ❤🔥🔥
@kianjs 3 ай бұрын
Cazz gives me a tingly feeling with these videos
@Joelmatic 3 ай бұрын
This is amazing, Thanks you for this video.
@mariobabic9326 3 ай бұрын
thank u so much brother this is exactly the video i needed
@roKoTHC 3 ай бұрын
I'd recommend using physical memory for communication. Create a r/w struct in your application and have the driver grab/fill data through physical memory reads and writes.
@murderspree 2 ай бұрын
Could you elaborate on why?
@thecircusb0y1 3 ай бұрын
LOVE YOUR CHANNEL , Please please please keep it up.
@GoblinProductions69 2 ай бұрын
Great Video as always. Where did you learn stuff like that anyway?
3 ай бұрын
I use Linux exclusively on literally all my devices but boy do I enjoy this kind of content, pop corn ready
@modifyingmemory 13 күн бұрын
thanks for the upload
@LukeTKC 3 ай бұрын
Damn lol, just discovered your channel start of this month when coding for my DMA cs2 cheat, you videos helped with some additional knowledge. pretty convenient how you start uploading now again😂 Welcome back
@Michtar 3 ай бұрын
hi tkcz
@PXINXYZ 3 ай бұрын
Wtf real tkcz?!?
@mariobabic9326 3 ай бұрын
which dma device are u using for cs2? also why do you use dma when u can simply use a kernel driver like shown in the video?
@airtrack9540 3 ай бұрын
@@mariobabic9326 Maybe Faceit?
@itzlaith 3 ай бұрын
@@mariobabic9326 dma for faceit cheating
@abuelo_gen 3 ай бұрын
You are awesome, keep going and i hope you success
@nolancao2878 3 ай бұрын
thanks a lot for this.
@krillinbaldhead9863 3 ай бұрын
p2c in shambles after this comes out, good job Cazz !!!
@Luzum 3 ай бұрын
I've been waiting for this for so long, very anticipated, can't wait to start. Thanks cazz!
@FloofyPlasma 3 ай бұрын
LOL perfect timing, was just considering making one a few days ago.
@senkuu2318 3 ай бұрын
first time in my entire life leaving a comment when a video posted recently
@zxuiji 3 ай бұрын
Thanks, I'm planning on writing a driver api wrapper in the future to minimise differences between linux and msw so this was helpful for that future plan. For now though I'll be focusing on a separate more important project for ending the need for compiling *.exe/*.elf/*.dll/*.so directly (in most cases, certain exceptions apply, underlying wrappers can still be used though)
@adamjung9547 3 ай бұрын
thank you just what I've been looking for i'm early:)
@ningu1036 3 ай бұрын
CAZZZZ FINALLY LETS GOOO!!!
@egely1337 3 ай бұрын
great content!
@w42s 3 ай бұрын
Hello coded it up yesterday works like a charm I love it. Thanks so much! but I gotta rather picky question just simply why the bool in_air reversed?
@gabirican4813 23 күн бұрын
Thanks!
@andrew_111 3 ай бұрын
It made my day
@dexx0 3 ай бұрын
yoooo bro DROPPEDDDD
@EL_ARTEM 3 ай бұрын
If you want to use this without KDMapper (I have AMD chip, so i use disable DSE instead): just write everything in DriverEntry function and delete IoCreateDriver implementation. To load just use (cmd -admin): sc create your_service_name type= kernel binPath= c:\yourDriver\yourDriver.sys then disable DSE sc start your_service_name
@Adrian00213 3 ай бұрын
great stuff!! 🥰 One anticheat i am trying to brake hopefully with this guid is using TLS callback as way to know if user is doing sketchy stuff. Would this method bypass the check? Is there another way i could bypass the TLS callbacks?
@alexandrohdez3982 3 ай бұрын
I do enjoy 👏👏👏👏👏👏
@llozyyyy8567 3 ай бұрын
LOVE U CAZZ
@icz 3 ай бұрын
I liked your vid before started watching
@malcoder Ай бұрын
MORE PLEASE!
@christianross2567 3 ай бұрын
"I really hope this doesn't ruin cs2" UD cheats are like 5 bucks a month already lol. Great video, as always. Really appreciate your hard work.
@oroelcobaya06 3 ай бұрын
if you want to sell a cs2 cheat, just paste aimstar's src and change its menu
@manhvo242 Ай бұрын
This is an absolute W
@Jujudo Ай бұрын
This is the sickest thing ever
@sepremz 3 ай бұрын
Thanks bud
@youngv3ru 3 ай бұрын
Thats a good tutorial actually. Its very helpful. Definetely Recommend this guy!
@julius3066 3 ай бұрын
i fully rebuild the code from the its amazing!!
@sh9351_dev 3 ай бұрын
you forgot the part where I try running it in my host and it bluescreens and bootloops But honestly, great content! Though I'm not into C++, still love your videos ❤
@sxmrrz 3 ай бұрын
Bro did u ever figure this out? Fucked my pc the first time, reset my entire pc and tried again and it’s fucked again so now I gotta reset it again😢 I just wanna learn dawg
@Cipsko 3 ай бұрын
This is for what are vms
@rlynotabot 3 ай бұрын
How did I miss this channel ?
@TVSh0rts 3 ай бұрын
Do you know any other articles/tutorials/resources that teach more advanced stuff about kernels?
@godzab 3 ай бұрын
More please 🙏
@akakamaz7382 3 ай бұрын
im too incompetent to make a cheat, nor do i want to make one, but youtube continues to recomend me this channel
@Bukharian-gw8mv 3 ай бұрын
whats the harm in trying, go for it.
@akakamaz7382 3 ай бұрын
@@Bukharian-gw8mv the harm is me getting baned 😂, or geting a virus by downloading the tools 🙄, or corruping my os onto oblivion given that the tutorial is a kernel cheat 😫
@Bukharian-gw8mv 3 ай бұрын
@@akakamaz7382 😂 lmao and for that reason alone in trying it on my spare laptop.
@G5XD 3 ай бұрын
@@akakamaz7382getting banned is so easily avoidable. You’re definitely not gonna get a virus, and the incredible part about a VM is you won’t fuck your pc.
@rikoboo 2 ай бұрын
legend is spoon feeding us, watch it whole dont skip u dont wanna miss anything important
@Dann.y 3 ай бұрын
This is epic
@patrick_pati5036 2 ай бұрын
Nice video would you do that same thing for a Normal Injector ?
@Lojdika 2 ай бұрын
A tutorial for user mode driver (UMDF V2) would be greatly appreciated. This video is invaluable, nevertheless.
@StrongerFX 3 ай бұрын
ty cazz S2
@NaniteWRLD 2 ай бұрын
Cazz, why does your Visual Studio looks so modern, I really want this design.
@DrWasabiii 2 ай бұрын
its the 'preview' version hes using 3:15 - Hope it helps :)
@NaniteWRLD 2 ай бұрын
@@DrWasabiii Hey, I was using the preview version while watching this video, but I see that he is also using community. It might be a extension or something.
@NaniteWRLD 26 күн бұрын
@@DrWasabiii it's a beta option
@henriquematias1986 3 ай бұрын
Amazing content!! As a side note, i was wondering: I got a firewire soundcard that has no drivers for the latest Windows.. Considering we know what is the FireWire chip you think we could code one ourselves? Is there such a thing as reverse engineering a driver already made and then updating it?
@tin13001 Ай бұрын
You should do a part 2 continue building on this driver. Swap out IOCTL for UM-KM shared memory, pointer/function hooking, callbacks. Maybe impersonate a PatchGuard thread? ;)
@bezik572 2 ай бұрын
Thank you for your video! It was pretty clear, however, could you please tell me, how did you find the IoCreateDriver and the other if it isn't documented? How can I find the other functions which are not documented? Thank you!
@popcornpizza8869 3 ай бұрын
Nice
@inqmusician2 Ай бұрын
MS devs back in the day didn't call the blue screen "blue screen of death". They call it simply blue screen or a BugCheck. BugCheck(or KeBugCheck) is a function down in the NT API that allows to raise the blue screen in the event that something down in the kernel. I'm here mostly for malware development, because the knowledge between cheat development and malware development is interchangeable. Like creating drivers and making malware that is invisible to the antiviurs or an IDS program. Or bypasssing anticheats, that are behaving like antiviruses themselves. The more you live, the more you learn.
@va6uel 2 ай бұрын
i never knew csgo cheating was this wholesome
@RayChism 3 ай бұрын
no wonder you’ve been quiet can only imagine how long this took
@smokinglife8980 3 ай бұрын
Like 1hr if you are bad at coding 😂
@cazz 3 ай бұрын
It definitely took some time to put together and a few revisions, thanks for the comment brother
@noahsndergaard9297 3 ай бұрын
Keep up the good work Cazz, you're always so down to earth. So it's always so chill to watch your vids🥇
@AbdullahYazbahar 3 ай бұрын
Me: wow, really cool NoOne: CS2 devs watching carefully
@atomiapx 3 ай бұрын
We need a cs2 internal video
@EazyGoatz 3 ай бұрын
Make a video on how you learned assembly
@Mustlight 3 ай бұрын
Your visual studio looks awesome how can i do it like this?
@mobslicer1529 3 ай бұрын
for real, i would love to know what extensions he's got
@Cipsko 3 ай бұрын
@@mobslicer1529bro he seriously told this in the video on vs installation
@imedox_dz 3 ай бұрын
wooow amazing, thanks for the video, the FIRST KERNEL DRIVER full tutorial in youtube 👀
@smokinglife8980 3 ай бұрын
No
@imedox_dz 3 ай бұрын
No! 🤨already have full tutorial for KERNEL DRIVER from scratch! on youtube befor that one?@@smokinglife8980
@Olafm 3 ай бұрын
Thanks! Ur uploads always have me "hooked" haha ...
@shialex2553 3 ай бұрын
u have to make big video about esp(internal) on cs2, it is gonna be interesting
@Andoxico 3 ай бұрын
Do you have any resources for studying how to bypass kernel level anti-cheats?
@RENNE44 Ай бұрын
Could you do a video on either MmMapIo Managing / Usage or creating a loader/mapper tool for the drivers like say using a DSE Bypass to load a driver over NtLoad and then using that driver to map the other driver into kernel space with a pre-defined object and then calling the OEP and starting a thread out of the mapping driver to bypass Ps Module Lists in the NTOSKRNL Structs? I've been studying this and a lot of other people do too so it would be cool.
@RENNE44 Ай бұрын
And maybe using other driver communication methods like encrypted post-server kSockets or HW Paging BP with register spoofing to interpret calls in the kernel using a custom dispatch in the PE of the usermode program? Maybe even try teaching people more about NTOSKRNL, EPROCESS, Ps, PEB/TEB, Etc?
@neroghost4721 27 күн бұрын
How did you learn this stuff? Maybe you should make a vid
@akaipureya3380 3 ай бұрын
!!!!!! IMPORTANT If you making driver for Tarkov, be carefully with "bcdedit /debug on" and dont forget write "bcdedit /debug off" after debugging on VM, because you can catch game freezes completely
@wavyyy5 3 ай бұрын
useful
@mokouu 2 ай бұрын
Gratitude be upon thee for bestowing thy wisdom without demand of coin
@Celestenshi Ай бұрын
demandeth**
@TheCrazyblader 3 ай бұрын
Thank you so much
@jarjava11 3 ай бұрын
It would be great to create a library in C# like memory.dll using kernel drivers with simple methods like readfloat readstring and so on but I see that people collaborate little sometimes
@javaboygames02 Ай бұрын
Y'know, I first saw your channel after thinking a lot about those hacking problems in games. I'm making a game, thats my life mission - literally. Me, you, probably everyone is annoyed by modern gaming for the way it is, a lazy mess. I'm trying to make something that would be a HUGE KO slap on the face of everyone that ruined games with a capacity to be good: Car manufactures, Mojang, EA, Gameloft, Ubisoft, Sweet Baby Inc, and the list goes on. The problem is, if my main life dream gets taken by the wrong hands, I'll be dead inside. Most of the people want just to play by the rules and have fun. Hackers can ruin everything once they get in the game. I know its fun to have some advantage and get new gameplay ideas by cheating, but what about the lay people that just want to have fun and forget the rest of the world? This is what is making so much good games a frustating experience (Blur died because of that, and now CarX is dying too). There are people with bad intetions, that only wanna mess with the players and make their game worse than hell (even in single player)! So, I'm very worried about that. I dont blame ALL the hackers for it, even because some of them can have great ideas for a gameplay inovation, or something like that, and it would help a lot. I dont know if its the best solution, But I'm planning to make a TAS version of my game just to cheaters have fun and their own mess. If you could answer this question of mine, it would be heavily appreciated.
@disenchantedcardgd9878 3 ай бұрын
Can you make a tutorial on kernel's for kernel anti-cheats?
@tomifilep1 Күн бұрын
Thanks this is very informative video but can you make a video for vanguard bypass for Leauge of Legends? or just how to disassemble the vanguard. sys and find how to bypass
@philogex 3 ай бұрын
bro's cooking again
@TreznTM 3 ай бұрын
about to make a fortnite p2c with this. Thanks boss 🙏🙏
@levinho108 3 ай бұрын
Bro please make a video that how to make Bypass for those games that need Emulator like PUBG. love you bro from Afghanistan!
@ihebmahmoud6753 2 ай бұрын
im working on one but pubg steam
@FaTalRust. 25 күн бұрын
new to this all, will this work on win11?
@Brutalslayer69 Ай бұрын
Bro please explain how to get around kernel anti-cheats next video ;)
@Ling.Bamening0 2 ай бұрын
Jo man, can you make maybe a Ida pro video, how to find entity list + localplayer, vars ect… In x64 bit game?
@sazzy94 Ай бұрын
Gained another subscriber🙃
@plugg4mb 3 ай бұрын
finally
@a_talking_potato8390 Ай бұрын
Im trying to make a valorant color triggerbot but i just cant figure it out. Ive tried for hours and nothing is working, could you maybe make a video about triggerbots or something? Love your videos