·1967 words·10 mins
Implementing KDAMonitor’s fourth sensor: monitoring the creation, modification, and deletion of registry values.
·2618 words·13 mins
Third KDAMonitor sensor: capturing inbound and outbound IPv4 connections.
·1593 words·8 mins
Setting up KDAMonitor’s WFP session (provider, sublayer).
·1196 words·6 mins
Implementing KDAMonitor’s second sensor: monitoring image loads.
·1460 words·7 mins
Implementing KDAMonitor’s first sensor: monitoring process creation and termination.
·2796 words·14 mins
Writing logs to disk and the first kernel crash of the KDAMonitor driver.
·2601 words·13 mins
Building the event queue for the KDAMonitor driver.
·3101 words·15 mins
Building the KDAMonitor driver foundation: device object and the first IOCTL communication with a test client.
·932 words·5 mins
Introduction to the KDAMonitor project and its goals.
Windows kernel driver for malware analysis, logging process, image load, network, and registry activity in real time.