Explore >> Select a destination
|
You are here 
|
scorpiosoftware.net | ||
| | | | |
ntamonsec.blogspot.com
|
|
| | | | | 0x00 Abstract Almost all the actions carried out by user mode applications and Windows executive subsystems (e.g. I/O Manager, Memory Manag... | |
| | | | |
theevilbit.github.io
|
|
| | | | | In the recent days I was reading technical analysis of win32k exploits from recent years, and it caught my eyes, that the HMValidateHandle technique is very heavily used almost everywhere. Then I had an idea how to protect against this family of exploits, which I think is very simple. This post will be about that. What is HMValidateHandle? Link to heading HMValidateHandle is an internal, unexported function of user32.dll. It takes a handle and a handle type as arguments, and by looking up the handle table, if the handle is matching with the type it will copy the object to user memory. If the object contains a pointer to itself, like tagWND it can be used to leak memory addresses from the kernel. This has been a known technique for very long time, I think the... | |
| | | | |
www.catch22.net
|
|
| | | | | Introduction to Device Drivers Seeing as I've been spending alot of time doing kernel-level programming recently I thought it was time I wrote a few articles on the subject. This first article (and the rest in this "kernel" series) will cover the steps needed to build, install and start a Windows NT device-driver. | |
| | | | |
thevivi.net
|
|
| | | Using code editor plugins for persistence. | ||
