kernel
-
Finding unexported kernel symbols without a symbol server
A pattern scanner maps a PE as a section image, scans for a unique byte sequence with a wildcard mask, and decodes the RIP-relative displacement to recover the symbol …
-
DSE bypass: why CiValidateImageHeader is the right target
Driver Signature Enforcement is enforced by CiValidateImageHeader in CI.dll, not by g_CiOptions alone. Patching the function directly with a physical write or PTE flip …
-
[Hypervisor Part 3] Making Your Kernel Hook Invisible with EPT Shadow Pages
EPT shadow page hooks split a physical page into two views: one seen by reads (original bytes), one executed (hooked bytes). Integrity scanners see clean code. The CPU …
-
[Hypervisor Part 2] Hijacking Hyper-V's VM-Exit Handler from Inside the Guest
How the hypervisor detours Hyper-V’s VM-exit handler, the CPUID-based hypercall ABI including the bitfield bug that burned me, and how we resolve arbitrary process …
-
[Hypervisor Part 1] What a Hypervisor Actually Does (And Why Your Ring-0 Code Should Care)
A ground-up explanation of what hypervisors do at the CPU level, how Windows runs under Hyper-V by default, what a VM-exit is and when it happens, and why this matters …
-
Kernel UDP socket server via WSK: covert comms with no IOCTL surface
WSK lets a kernel driver bind a UDP socket and communicate with user mode without a device object, symbolic link, or IOCTL dispatch table. EnumDeviceObjects and …
-
Finding EPROCESS from the GS register
Most kernel code that needs a process structure starts from PsInitialSystemProcess or PsActiveProcessHead – both exported symbols. If the export table is …
-
The four callbacks an EDR kernel driver uses
PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, and ObRegisterCallbacks: what each one gives you, what it misses, and how …
-
Mapping kernel code without pool traces
MmAllocateIndependentPagesEx allocates pages directly from the PFN database, bypassing pool accounting entirely. Combine that with the Intel NAL BYOVD primitive and a …
-
Thread start address inspection: how EDR kernel drivers catch shellcode
PsSetCreateThreadNotifyRoutine fires for every new thread. This post shows how an EDR kernel driver turns that callback into a start-address inspection pipeline, what the …
-
Handle stripping: how EDR kernel drivers protect their own process
ObRegisterCallbacks lets a kernel driver intercept every handle open before it completes. EDRs use this to strip dangerous access bits from any handle targeting their own …
-
Fingerprinting anti-cheat by its pool allocation pattern
BattleEye resolves ExAllocatePool at runtime via MmGetSystemRoutineAddress. Intercept that resolution and you can gate every pool allocation BE makes – returning …
-
Intercepting BattleEye's ObRegisterCallbacks at registration time
Removing BattleEye’s object callbacks is detectable. Intercepting the registration itself lets you subvert the callback’s effect while leaving it fully …
-
BattleEye's Handle Protection: Code Caves, IAT Tricks, and the Callback You Can't Just Yank
How BattleEye’s kernel driver uses ObRegisterCallbacks to strip process handles, how it intercepts registration via an IAT hook on MmGetSystemRoutineAddress, and a …
-
Code caves in signed kernel drivers
Unsigned executable memory in the kernel is an immediate red flag. Shellcode placed in the padding bytes of a legitimate signed Microsoft driver executes inside that …
-
MmCopyVirtualMemory: used everywhere, documented nowhere
MmCopyVirtualMemory is the undocumented kernel export behind nearly every kernel cheat and rootkit doing cross-process memory reads, but its actual behaviour – …
-
Walking a Driver's IOCTL Dispatch by Hand
Finding the IOCTL dispatch table in a stripped kernel driver, decoding CTL_CODEs from first principles, and the triage methodology for prioritising attack surface before …
-
NtLoadDriver vs SCM: what each leaves behind
Creating a service through SCM and calling NtLoadDriver directly leave different artifacts. Knowing exactly what each approach leaves – event log entries, registry …