Debugging the Windows 11 Boot Process
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Tag: kernel
Reverse Engineering a Malicious Kernel Driver: Callback Injection, APC, and Remote Thread Injection
Reverse engineering a malicious kernel driver, analyzing its dispatch routines and hooks to understand the rootkit's capabilities and intent, with the tools and offsets documented.
Tracing How the Disk Model and Serial Number Get Written into ClipSp.sys
Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.
Tracing a WMI Query to the Kernel: How Get-PhysicalDisk Reads Serial Number and UID
Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.
How Windows DTrace Works Under the Hood: bcdedit → winload.efi → ntoskrnl → dtrace.sys
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Decrypting CR3 via MMPFN: Reading the Real Directory Base on Windows 7, 10, and 11
Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.
Hooking Every Kernel Export to Analyze a Driver's Logic
Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.
Reading EPROCESS and CR3 from MmPfnDatabase
Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.
Reverse Engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks
Reverse engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks, explaining how kernel drivers subscribe to object events, with the commands and code included.
InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.
Compiling rwProcMem33 into the Android Kernel
Compiling rwProcMem33 into the Android kernel to get hardware-breakpoint-driven read and write of process memory, built into a Pixel AOSP image, and the mechanism explained clearly.
Custom bcc/eBPF: Dwarf-Based Userspace Stack Unwinding on Android
Custom bcc and eBPF for DWARF-based userspace stack unwinding on Android, combining kernel tracing with libunwindstack to profile native code, and the internals laid out in detail.
CVE-2019-8605: From UAF to TFP0
From use-after-free to kernel task port: a full exploit walkthrough of CVE-2019-8605, with the heap spraying and Mach ool-message tricks that turn a socket UAF into TFP0.
CVE-2020-27950: Kernel Memory Leak via an Uninitialized Mach Message Trailer
A root-cause analysis of CVE-2020-27950, an iOS kernel memory leak from an uninitialized Mach message trailer, including the full PoC send and receive flow.
Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock
A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.