Singular Access

Updated fork of btbd/access with Zydis-based dynamic pattern finding for Windows 10/11 compatibility

A kernel-mode syscall wrapper that enables privileged process operations without requiring handles. Uses xKdEnumerateDebuggingDevices pointer hooking for kernel-usermode communication.

Features

• ✅ No hardcoded offsets - All kernel functions/offsets discovered at runtime via Zydis disassembler
• ✅ Version independent - Works across Windows 10 (1607+) and Windows 11 (up to 24H2)
• ✅ No SEH - Safe operations without structured exception handling
• ✅ Handle-free - Perform PROCESS_ALL_ACCESS operations without creating real handles
• ✅ Minimal footprint - Clean .data section hook, no inline patches
• ✅ Open source - Full source code available for educational purposes

What's New

This fork modernizes the original driver with:

1. Zydis Integration - Dynamic disassembly replaces brittle byte patterns
2. Multi-version Support - Single binary works on Windows 10 1607 through Windows 11 24H2
3. Clean Logging - Informative debug output with [singular-access] prefix
4. Better Reliability - Instruction-level pattern matching instead of raw bytes

How It Works

Dynamic Pattern Finding

The driver uses Zydis to disassemble kernel functions and extract:

Target	Method	Offset/Address
KTHREAD.PreviousMode	Disassemble ExGetPreviousMode	0x232 (all versions)
PsResumeThread	Disassemble PsRegisterPicoProvider	RIP-relative LEA at +0x40
PsSuspendThread	Disassemble PsRegisterPicoProvider	RIP-relative LEA at +0x50
xKdEnumerateDebuggingDevices	Pattern scan .text section	Version-specific patterns

Hook Mechanism

User Mode (DLL)
    ↓ syscall with SYSCALL_UNIQUE
Kernel Hook (xKdEnumerateDebuggingDevices pointer)
    ↓ validates & dispatches
Kernel Syscall Handler
    ↓ performs privileged operation
Return to User Mode

Quick Start

Prerequisites

• Visual Studio 2022 with C++ Desktop Development
• Windows Driver Kit (WDK) 10
• Test signing enabled or kernel debugging mode

Building

cd Driver
msbuild Driver.vcxproj /p:Configuration=Release /p:Platform=x64
link_driver.bat

Output: Driver\x64\Release\Driver.sys

Loading

Option 1: kdmapper (recommended for testing)

kdmapper.exe Driver.sys

Option 2: Service

sc create singular_access type= kernel binPath= C:\path\to\Driver.sys
sc start singular_access

Expected Output (DebugView)

[singular-access] Initializing driver...
[singular-access] Windows build: 26200
[singular-access] ntoskrnl.exe base: FFFFF80000000000
[singular-access] [*] Searching for PsResumeThread in PsRegisterPicoProvider...
[singular-access] [+] Found PsResumeThread at FFFFF803AAE331C0
[singular-access] [*] Searching for PsSuspendThread in PsRegisterPicoProvider...
[singular-access] [+] Found PsSuspendThread at FFFFF803AADFA1A0
[singular-access] [+] Found PreviousMode offset: 0x232
[singular-access] Searching for xKdEnumerateDebuggingDevices pointer...
[singular-access] xKdEnumerateDebuggingDevices pointer: FFFFF803AB200B68
[singular-access] Installing hook...
[singular-access] Driver initialized successfully

Supported Syscalls

The driver intercepts and handles:

Process Operations

• NtOpenProcess
• NtSuspendProcess / NtResumeProcess
• NtQueryInformationProcess / NtSetInformationProcess
• NtQuerySystemInformationEx
• NtFlushInstructionCache

Memory Operations

• NtAllocateVirtualMemory / NtFreeVirtualMemory
• NtReadVirtualMemory / NtWriteVirtualMemory
• NtProtectVirtualMemory
• NtQueryVirtualMemory
• NtLockVirtualMemory / NtUnlockVirtualMemory
• NtFlushVirtualMemory

Thread Operations

• NtOpenThread
• NtSuspendThread / NtResumeThread
• NtGetContextThread / NtSetContextThread
• NtQueryInformationThread / NtSetInformationThread

Synchronization

• NtWaitForSingleObject

Version Compatibility

Tested and confirmed working:

OS Version	Build	Status
Windows 10 1607	14393	✅
Windows 10 1709	16299	✅
Windows 10 1809	17763	✅
Windows 10 2004	19041	✅
Windows 11 21H2	22000	✅
Windows 11 22H2	22621	✅
Windows 11 24H2	26100-26200	✅

Technical Details

Zydis Pattern Examples

Finding PsResumeThread:

lea rcx, PsResumeThread    ; Load function address
mov [rdx+40h], rcx         ; Store in PICO provider table

Finding xKdEnumerateDebuggingDevices (Win11 24H2):

mov rax, cs:off_140E00B68  ; Pattern: 48 8B 05 ? ? ? ? 74 ? E8
                           ; Resolve RIP-relative pointer

Extracting PreviousMode offset:

mov rax, gs:188h           ; Get KTHREAD
movzx eax, byte ptr [rax+232h]  ; Extract PreviousMode
ret

Project Structure

Driver/
├── main.c              # Entry point, initialization, hook installation
├── core.c              # Syscall handlers
├── util.c              # Pattern scanning, memory utilities
├── zydis_util.c        # Zydis-based pattern finders
├── zydis_util.h        # Zydis function declarations
├── syscall.h           # Syscall definitions
├── stdafx.h            # Precompiled header
└── Zydis/              # Zydis disassembler library

Troubleshooting

Driver fails to load:

• Enable test signing: bcdedit /set testsigning on
• Check DebugView for error messages
• Verify WDK is installed correctly

Pattern not found:

• Check Windows build number in DebugView output
• May need to add new pattern for your specific build
• Open an issue with your build number and debug output

Linker errors:

• Ensure all Zydis files are included in project
• Verify ZYDIS_STATIC_BUILD and ZYCORE_STATIC_BUILD are defined
• Check that link_driver.bat is using correct WDK lib paths

Development

Adding New Syscalls

1. Add syscall enum to syscall.h
2. Add handler in core.c using HANDLE_SYSCALL macro
3. Rebuild driver

Adding New Windows Versions

1. Analyze new build in IDA/Ghidra
2. Find pattern for xKdEnumerateDebuggingDevices pointer
3. Add pattern to find_kd_enum_debug_devices_ptr() in main.c
4. Test and verify

Credits

• Original Author: btbd - Original access driver
• Zydis: zyantific - Fast and lightweight x86/x86-64 disassembler
• Updated by: Singular - Zydis integration and multi-version support

License

This project maintains the same license as the original btbd/access repository.

Disclaimer

This software is for educational and research purposes only. Use responsibly and only on systems you own or have explicit permission to test on.