Time Table

Reverse engineering rootkits is increasingly challenged by advanced obfuscation and packing, hindering dynamic debugging of Windows drivers. While Unicorn-based frameworks like Speakeasy and Qiling exist, they are still insufficient in anti-simulation techniques.

This research proposes a Unicorn-based semi-simulation framework that executes drivers in a hybrid real-simulated environment via partial pass-through, extracting real environment components and supporting parallel execution and structure exception handling to bypass anti-simulation and anti-debugging protections. Running isolated in Ring 3, it can precisely monitor objects and registers, revealing rootkits’ logic and its self-protect mechanisms.

I will explore modern anti-debugging techniques, Unicorn applications, and a case study of a high-market-share anti-cheat engine’s kernel driver protections. After this session, attendees will gain a better understanding of internal driver protection and rootkit analysis.