Enumerating Loaded Kernel Modules via PsLoadedModuleList: A Foundation for Detecting DKOM-Based Driver Hiding

Joseph Moronwi 0

 


In this post, we examined how the _EPROCESS structure maintains critical metadata concerning active processes resident in system memory and how these structures may be systematically enumerated via a live kernel debugger. Volatility plugins such as pslist and pstree rely on the _EPROCESS linked lists (and associated fields) to reconstruct the set of processes present in a memory image at the time of acquisition.


In this post, we explored the Process Environment Block (_PEB) and the multiple doubly-linked lists it maintains to track loaded user-mode modules (primarily DLLs). Plugins including dlllist and ldrmodules walk these _PEB-anchored lists to recover module information; it is important to note that discrepancies between the lists can indicate attempts at module unlinking or other forms of anti-forensic activity.


In the present post, we turn to kernel space. We will examine the data structures that the Windows kernel uses to record loaded kernel modules (drivers), the linked lists that maintain this information, and the methods by which an analyst can traverse those lists—whether through a live kernel debugger or via memory-forensics tooling—to recover the set of drivers that were mapped into kernel address space at the moment the memory image was captured. As with process and user-mode module enumeration, the completeness and integrity of the recovered driver list remain subject to the usual caveats of memory analysis: potential list manipulation, page-file or pool corruption, and the inherent volatility of in-memory state.


To enumerate the kernel modules loaded into the system at the time of memory acquisition, the analyst must first resolve the address of the PsLoadedModuleList symbol. On current versions of WinDbg, this is accomplished directly via public PDB symbols—nt! PsLoadedModuleList resolves without requiring a KDBG lookup. Historically, this symbol was reachable as a field within the Kernel Debugger Block (KDBG / _KDDEBUGGER_DATA64), and pure memory-forensics tooling that does not have access to a live debugging session (Volatility 2, for instance) may still rely on locating and parsing KDBG to derive this address. Analysts should note, however, that KDBG has become an increasingly unreliable anchor on modern Windows: from Windows 8.1 onward, PatchGuard integration and encoded KdCopyDataBlock structures have made direct KDBG parsing progressively more difficult, and some forensic frameworks (e.g., Volatility 3) now prefer PDB-based symbol resolution or scanning techniques as a result. Regardless of the resolution method used, PsLoadedModuleList serves as the list head of a circular doubly-linked list whose nodes are _KLDR_DATA_TABLE_ENTRY structures; each entry contains the metadata associated with a loaded kernel module (driver base address, size, name, entry point, etc.). Because the list is circular, the Flink of the final entry and the Blink of the first entry both point back to PsLoadedModuleList itself. Consequently, traversal begins at the list head and continues until the head is reached again.


As with any in-memory linked list used for forensic recovery, the integrity of this structure is not guaranteed: sophisticated rootkits may unlink entries, the KDBG itself can be difficult to locate reliably on newer Windows versions, and pool corruption or partial page availability may produce incomplete or inconsistent results. The diagram below illustrates the relationship described above.



The Volatility modules plugin, along with any tool that relies on the Windows kernel APIs (or that directly walks the same in-memory structures), enumerates loaded kernel modules by traversing the circular doubly-linked list headed by PsLoadedModuleList. Because the list is maintained in load order, the earliest entries normally correspond to the modules that were mapped first during system initialization. On most Windows versions, this means the first two nodes are ntoskrnl.exe and hal.dll (as illustrated in the above diagram).


Analysts should treat this ordering—and the completeness of the list itself—with appropriate caution. Rootkits or other anti-forensic techniques may unlink entries, alter load-order relationships, or manipulate the list head. In addition, on newer Windows builds, the Hardware Abstraction Layer is frequently incorporated into ntoskrnl.exe, so a distinct hal.dll entry may be absent. Consequently, results obtained via live API calls can differ from those recovered by pure memory-forensics parsers that operate solely on the acquired image.


We will now walk the circular doubly-linked list of loaded kernel modules under a kernel debugger. As noted above, on current versions of WinDbg, the address of nt!PsLoadedModuleList resolves directly from public PDB symbols—no KDBG lookup is required for this step. Once the list head is identified, successive _KLDR_DATA_TABLE_ENTRY structures can be followed via their Flink/Blink links until the head is reached again. Note that the reliability of this approach still depends on the availability of accurate symbols and the absence of list manipulation by rootkits or other anti-forensic techniques; tooling that lacks a live debugging session and must instead parse KDBG directly (e.g., Volatility 2) faces the additional reliability concerns discussed earlier.



Having obtained a pointer to the list head (PsLoadedModuleList), we now hold a reference to a _LIST_ENTRY structure that anchors the circular doubly-linked list of _KLDR_DATA_TABLE_ENTRY records. Each _LIST_ENTRY contains Flink and Blink fields that reference the next and previous nodes, respectively. By examining the Flink of the list head, we can identify the first _KLDR_DATA_TABLE_ENTRY that follows it, thereby beginning enumeration of the loaded kernel modules.



As always, the integrity of these links must be verified; a rootkit or other anti-forensic technique may have altered the list, and any observed pointer should be cross-checked against expected module characteristics before being accepted as authoritative.


The list head resides at address 0xffffe0091c66ea20. The structure located at this address is a _KLDR_DATA_TABLE_ENTRY. Enumerating its fields reveals that the first module in the load-order list is ntoskrnl.exe`, as expected on a typical Windows system.



Note that the structure also records the full on-disk path of the loaded module. Analysts should treat both the module name and the reported path with appropriate caution: the values are taken directly from the in-memory structure and may be incomplete, truncated, or deliberately altered by anti-forensic techniques.


We now advance to the subsequent entry in the load-order list, which on a typical system should be hal.dll. To reach the corresponding _KLDR_DATA_TABLE_ENTRY, follow the Flink pointer of the InLoadOrderLinks field within the first entry (the one belonging to ntoskrnl.exe). This yields the address of the next node in the circular doubly-linked list. As always, the observed order and the presence of a distinct hal.dll entry should be treated with caution: modern Windows builds frequently fold the Hardware Abstraction Layer into ntoskrnl.exe, and list manipulation by rootkits remains possible.



Finally, we enumerate the complete linked list to recover all kernel modules resident in memory at the time of acquisition. Traversal can be initiated from any valid reference pointer within the list; in this case, we will anchor our walk at the pointer to hal.dll and traverse the doubly-linked list from that node. Given the structure's ordering, ntoskrnl.exe should appear as the final entry in the recovered output. Let's confirm our expected traversal order.


kd> !list -x "dt nt!_KLDR_DATA_TABLE_ENTRY -y FullDllName" 0xffffe009`1c662010
   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\hal.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\kd.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\mcupdate_GenuineIntel.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\symcryptk.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\cng.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\CLFS.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\tm.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\winaccel.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\PSHED.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\BOOTVID.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\FLTMGR.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\msrpc.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ksecdd.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\clipsp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\cmimcext.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\werkernel.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ntosext.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\watchdog.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\WMILIB.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\dxgkrnl.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\win32k.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\CI.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\globmerger.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\Wdf01000.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\WppRecorder.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\WDFLDR.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\prm.inf_amd64_7c38475757a1f016\PRM.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\acpiex.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\msseccore.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ACPI.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\msisadrv.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\pci.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\tpm.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\amdwps.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\WindowsTrustedRT.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\intelpep.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\IntelPMT.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\pcw.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vdrvroot.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\pdc.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\CEA.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\partmgr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\spaceport.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\volmgr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\intelide.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\PCIIDEX.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\volmgrx.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vsock.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vmci.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\mountmgr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\atapi.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ataport.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\storahci.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\storport.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\stornvme.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\EhStorClass.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\fileinfo.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Wof.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\WdFilter.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Ntfs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Fs_Rec.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\ndis.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\NETIO.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\ksecpkg.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Kerb3961Kernel.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\tcpip.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\fwpkclnt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\wfplwfs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DRIVERS\fvevol.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\volume.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\volsnap.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\rdyboost.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\mup.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\iorate.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\disk.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\CLASSPNP.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\crashdmp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\cdrom.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\filecrypt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\tbs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\UCPD.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Null.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Beep.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vmrawdsk.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_a0afd1c1603bc477\BasicDisplay.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\basicrender.inf_amd64_5a35c75db01c44c7\BasicRender.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Npfs.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\Msfs.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\CimFS.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\tdx.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\TDI.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\ws2ifsl.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DRIVERS\netbt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\afunix.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\afd.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vwififlt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\pacer.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ndiscap.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\netbios.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\Vid.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\winhvr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\rdbss.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\csc.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\nsiproxy.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\npsvctrig.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\mssmbios.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\dfsc.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\bam.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\ahcache.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_8cf6fa9d3afdfa25\CompositeBus.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\kdnic.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\umbus.inf_amd64_914dd46b4b013b1b\umbus.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\i8042prt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\kbdclass.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vmmouse.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\mouclass.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vm3dmp_loader.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vm3dmp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\usbuhci.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\USBPORT.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\HDAudBus.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\portcls.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\drmk.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\ks.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\usbehci.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\e1i68x64.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\USBXHCI.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\ucx01000.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vmgencounter.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\CmBatt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\BATTC.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\intelppm.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\uefi.inf_amd64_980ddb5245bbf384\UEFI.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\NdisVirtualBus.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DriverStore\FileRepository\swenum.inf_amd64_7e69a3e94e38c7ba\swenum.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\rdpbus.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\usbhub.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\USBD.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\UsbHub3.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\HdAudio.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\ksthunk.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\usbccgp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\hidusb.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\HIDCLASS.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\HIDPARSE.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\mouhid.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\fastfat.SYS"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\vmusbmouse.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\udfs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\dump_dumpstorport.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\dump_stornvme.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\Drivers\dump_dumpfve.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\win32kbase.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\win32kfull.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\win32kbase_rs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\dxgmms1.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\monitor.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\dxgmms2.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\cdd.dll"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\appid.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\applockerfltr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\bfs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\luafv.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\wcifs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\cldflt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\UnionFS.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\storqosflt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\bindflt.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\lltdio.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\mslldp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\rspndr.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DRIVERS\wanarp.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\mmcss.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\wtd.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\HTTP.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\bowser.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\mrxsmb.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\mrxsmb20.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\mpsdrv.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vmmemctl.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DRIVERS\srvnet.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\Ndu.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\DRIVERS\srv2.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\drivers\peauth.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\tcpipreg.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\DRIVERS\vmhgfs.sys"

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\System32\drivers\condrv.sys"

   +0x048 FullDllName : _UNICODE_STRING "\??\C:\WINDOWS\system32\Drivers\DumpIt.sys"

   +0x048 FullDllName : _UNICODE_STRING ""

   +0x048 FullDllName : _UNICODE_STRING "\SystemRoot\system32\ntoskrnl.exe"


As demonstrated, the traversal originated at hal.dll and terminated at ntoskrnl.exe, successfully enumerating the complete set of loaded kernel modules by walking the doubly-linked list anchored by PsLoadedModuleList.






Tags

Joseph Moronwi

DFIR and Adversary Hunting, Malware Research, and OSINT.

Post a Comment

Post a Comment

Previous Post Next Post