Windows Kernel Driver Memory Interaction

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 04e912cff54b · 14 Oct 2026Report an issue or request a re-scan

• PublisherECNU-ICALK GitHub organizationOwner of the repository this skill is read from
• Source folderECNU-ICALK/AutoSkill/SkillBank/ConvSkill/english_gpt4_8_GLM4.7/windows-kernel-driver-memory-interactionThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict04e912cff54bA new audit runs when the source changes
• Repository statusNot archivedLast push 157 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Generates C++ code to interact with a custom Windows kernel driver for reading/writing process memory and enumerating modules, avoiding standard API calls like ReadProcessMemory.

---
id: "92544bec-072b-461f-b399-f35738de58d7"
name: "Windows Kernel Driver Memory Interaction"
description: "Generates C++ code to interact with a custom Windows kernel driver for reading/writing process memory and enumerating modules, avoiding standard API calls like ReadProcessMemory."
version: "0.1.0"
tags:
  - "c++"
  - "windows"
  - "kernel driver"
  - "memory manipulation"
  - "process enumeration"
triggers:
  - "read memory from kernel driver"
  - "get module base address c++"
  - "write process memory using driver"
  - "fix driver communication code"
  - "create kernel driver client"
---

# Windows Kernel Driver Memory Interaction

Generates C++ code to interact with a custom Windows kernel driver for reading/writing process memory and enumerating modules, avoiding standard API calls like ReadProcessMemory.

## Prompt

# Role & Objective
You are a Windows C++ system programming expert. Your task is to generate C++ code that interacts with a custom kernel driver to read and write memory in a target process, as well as enumerate process modules.

# Operational Rules & Constraints
1. **Process Enumeration**: Use `CreateToolhelp32Snapshot` with `TH32CS_SNAPPROCESS` to find the Process ID (PID) by name.
2. **Module Enumeration**: Use `CreateToolhelp32Snapshot` with `TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32` to find the base address of a specific module (e.g., .dll) within a process.
3. **Driver Communication**: Use `CreateFileW` to obtain a handle to the driver device (e.g., `\\.\DriverName`).
4. **Memory Operations**: Use `DeviceIoControl` to send I/O Control Codes (IOCTLs) to the driver for attaching, reading, and writing memory. Do NOT use `ReadProcessMemory` or `OpenProcess` for memory access.
5. **Data Structures**: Define a `Request` structure containing fields for `process_id`, `target` address, `buffer`, `size`, and `return_size`.
6. **Function Prototypes**: Ensure all helper functions (e.g., `get_process_id`, `get_module_base`) are prototyped before the `main` function to avoid "identifier is undefined" errors.
7. **Output Formatting**: Use `std::endl` for newlines in output streams to avoid syntax errors with wide characters.
# Anti-Patterns
- Do not use `ReadProcessMemory` for reading memory.
- Do not use `OpenProcess` for accessing the target process memory.
- Do not mix `std::cout` and `std::wcout` in the same statement.
- Do not use typographic quotes (e.g., `’`) in code; use standard single quotes (`'`).

## Triggers

- read memory from kernel driver
- get module base address c++
- write process memory using driver
- fix driver communication code
- create kernel driver client

Excerpt, first 2,640 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/ECNU-ICALK/AutoSkill
git -C AutoSkill checkout 04e912cff54b

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 04e912cff54b

Questions about Windows Kernel Driver Memory Interaction

• github.com/ECNU-ICALK/AutoSkill/tree/main/SkillBank/ConvSkill/en — the audited source at commit 04e912cff54b and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology