How thecruz/kdmapper works
KDMapper is a Windows tool for manually mapping a driver image into kernel memory using a vulnerable Intel driver. The main workflow parses options and a driver path, optionally refreshes symbol offsets, loads the helper driver, reads the image, maps it, and unloads the helper. Documented branches include allocation modes, pre-entry parameter customization, kernel trace cleanup, and PDB-based offsets. Several implementation files were not sampled, so links for those documented capabilities are limited to their supported owning modules.
Main entry points: kdmapper/main.cpp Mapper CLI · kdmapper.cpp Mapping engine · KDSymbolsHandler.cpp Offset handler · SymbolsFromPDB/main.cpp PDB offset tool
Components 18
Mapper workflow
- Mapper CLI
kdmapper/main.cpp - File utilities
kdmapper/utils.cpp
Image mapping
- Mapping engine
kdmapper/kdmapper.cpp - PE support
kdmapper/portable_executable.cpp
Symbol offsets
- Offset handler
kdmapper/KDSymbolsHandler.cpp - Offsets file
- PDB offset tool
SymbolsFromPDB/main.cpp - Symbol lookup
SymbolsFromPDB/SimplestSymbolHandler.cpp
Kernel integration
- Intel driver control
kdmapper/intel_driver.cpp - Embedded driver image
kdmapper/include/intel_driver_resource.hpp - Driver service control
kdmapper/service.cpp - Kernel memory operations
kdmapper/intel_driver.cpp
Other components
- Operator
- Driver image
- Microsoft symbol server
- Windows binaries
- Kernel state
- Mapped driver
Connections 20
- Operator → Mapper CLI: runs with options
- Driver image → Mapper CLI: supplies path
- Mapper CLI → Offset handler: loads offsets
- Offset handler → Offsets file: reads or refreshes
- Offset handler → PDB offset tool: launches updater
- PDB offset tool → Symbol lookup: requests symbols
- Symbol lookup → Windows binaries: inspects
- Symbol lookup → Microsoft symbol server: retrieves PDBs
- PDB offset tool → Offsets file: writes offsets
- Mapper CLI → Intel driver control: loads and unloads
- Intel driver control → Embedded driver image: uses image
- Intel driver control → Driver service control: controls service
- Mapper CLI → File utilities: reads image
- File utilities → Driver image: loads bytes
- Mapper CLI → Mapping engine: requests mapping
- Mapping engine → PE support: uses PE operations
- Mapping engine → Kernel memory operations: performs kernel operations
- Kernel memory operations → Kernel state: reads and modifies
- Kernel memory operations → Mapped driver: places and invokes
- Mapping engine → Mapped driver: customizes entry parameters