win32k-callback-detouring

Disclaimer This repository is provided strictly for educational and defensive research purposes. It demonstrates Windows internal callback dispatch mechanics and KernelCallbackTable-related control-flow concepts in a proof-of-concept context. Not intended for unauthorized use Not designed for...

Win32k Callback Detouring: Abusing Legitimate Kernel-to-User Callback Dispatch for Code Execution

This injection technique abuses the kernel-to-user callback dispatch path used by the Windows graphical subsystem win32k.sys to obtain code execution inside a remote process. By locating the KernelCallbackTablethrough the target process's Process Environment Block PEB, an operator can enumerate...