News

Kernel Driver Gates and Handshakes

Kernel Driver Gates and Handshakes

Let's talk today about gates and handshakes, a common security mechanism implemented in many Windows kernel drivers that expose sensitive interfaces to user mode through device objects and I/O control...

Kernel Driver Gates and Handshakes

Let's talk today about gates and handshakes, a common security mechanism implemented in many Windows kernel drivers that expose sensitive interfaces to user mode through device objects and I/O control...

IDT Table Hijacking under VBS/HVCI/kCET in Windows 11

IDT Table Hijacking under VBS/HVCI/kCET in Wind...

So far we have demostrated how DOG tool (Data Only Gadgets) capabilities from our EP3 platform can be used to hijack Kernel tables like SSDT and Shadow SSDT. Our next...

IDT Table Hijacking under VBS/HVCI/kCET in Wind...

So far we have demostrated how DOG tool (Data Only Gadgets) capabilities from our EP3 platform can be used to hijack Kernel tables like SSDT and Shadow SSDT. Our next...

EuskalHack 2026 Conference - Subverting the Windows Kernel

EuskalHack 2026 Conference - Subverting the Win...

Modern Windows systems are protected by an increasingly sophisticated set of security mechanisms designed to make kernel exploitation significantly more difficult than it was just a few years ago.  At...

EuskalHack 2026 Conference - Subverting the Win...

Modern Windows systems are protected by an increasingly sophisticated set of security mechanisms designed to make kernel exploitation significantly more difficult than it was just a few years ago.  At...

WinNotify: Building Kernel Read/Write from CR3-Based IOCTLs

WinNotify: Building Kernel Read/Write from CR3-...

In this post I’m going to document some notes from reversing the WinNotify signed driver and turning its IOCTL interface into a stable kernel read/write primitive. The driver has been...

WinNotify: Building Kernel Read/Write from CR3-...

In this post I’m going to document some notes from reversing the WinNotify signed driver and turning its IOCTL interface into a stable kernel read/write primitive. The driver has been...

Shadow SSDT Hijacking: Achieving Kernel Code Execution via Read-Write Primitives

Shadow SSDT Hijacking: Achieving Kernel Code Ex...

On this blog, I'll walk you through Shadow SSDT hijacking to achieve kernel code execution under VBS/HVCI/kCET-enabled environments in Windows 11 (latest build). We'll first cover the fundamentals of userland...

Shadow SSDT Hijacking: Achieving Kernel Code Ex...

On this blog, I'll walk you through Shadow SSDT hijacking to achieve kernel code execution under VBS/HVCI/kCET-enabled environments in Windows 11 (latest build). We'll first cover the fundamentals of userland...

BlueHammer Analysis (Defender LPE)

BlueHammer Analysis (Defender LPE)

Interested in Windows Kernel? Check out our Technical Training Courses --- The BlueHammer exploit for Windows Defender, recently disclosed by Nightmare Eclipse, probably won’t be added to Exploit Pack unless there is...

BlueHammer Analysis (Defender LPE)

Interested in Windows Kernel? Check out our Technical Training Courses --- The BlueHammer exploit for Windows Defender, recently disclosed by Nightmare Eclipse, probably won’t be added to Exploit Pack unless there is...

Technical Training