4912 matches found
memory-forensic
memory-forensic A memory forensics toolkit that profiles Windows kernels itself โ and is cross-checked, process-for-process, against Volatility 3. mem4n6 reads every common dump format LiME, AVML, ELF core, Windows crash dumps, hibernation files, VMware save-states, kdump, rawโฆ and walks processe...
CVE-2024-43630-POC
CVE-2024-43630-POC This repository contains a POC that triggers a stack OOB write when executed, causing the system to crash. This vulnerability is an extremely interesting and rare relic that demonstrates the complexities and peculiarities of kernel programming, especially object management...
herpaderping
Process Herpaderping png.HerpaderpIcon Process Herpaderping es un mรฉtodo para ocultar las intenciones de un proceso modificando el contenido en disco despuรฉs de que la imagen haya sido mapeada. Esto resulta en un comportamiento curioso por parte de los productos de seguridad y del propio sistema...
CVE-2017-11882-Blocker
CVE-2017-11882-Blocker Un controlador de Windows que neutraliza CVE-2017-11882 : Cรณmo funciona Este proyecto se divide en un controlador de kernel y un componente de notificaciรณn en modo usuario que se comunican a travรฉs de un dispositivo personalizado utilizando el modelo de llamada invertida...
CVE-2024-30088
CVE-2024-30088 This repository contains a Proof of Concept PoC written in Python for the vulnerability CVE-2024-30088. This code is an attempt to replicate the vulnerability as a technical exercise, with purely educational and demonstrative purposes, showing how Python somehow "struggles" also in...
CVE-2025-62454
This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffff808b75973000 BUGCHECKP2: 2 BUGCHECKP3: fffff803df12ddda BUGCHECKP4: 0 READADDRESS: ffff808b75973000 Special pool MMINTERNALCODE: 0 IMAGENAME: cldflt.sys MODULENAME: cldflt FAULTINGMODULE: fffff803df110000 cldflt PROCESSNAME:...
Driver-HideKernelThread-IoCancelIrp
Driver-HideKernelThread-IoCancelIrp not my code. only for saving https://bbs.pediy.com/thread-272795.htm Principle Set the thread entry address to IoCancelIrp and the context to the irp you created. Then the thread will call IoCancelIrp. when called, will perform the operation of canlcelling the...
matrix-rs
Windows Kernel Blue Pill Type-2 Hypervisor in Rust Codename: Matrix Blog: https://memn0ps.github.io/hypervisors-for-memory-introspection-and-reverse-engineering/ A lightweight, memory-safe, and blazingly fast Rust-based type-2 research hypervisor with hooks for Intel VT-x, focused on studying the...
HyperDeceit
HyperDeceit This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel. Blog post: https://reversing.info/posts/hyperdeceit/ Disclaimer The code has not been through prop...
Jormungandr
Jormungandr Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. The only supported type of COFF is an x64 kernel COFF meaning, a COFF that uses functions from either NTOSKRNL or SSDT. This project is not supported to r...
clairvoyance
๐ฎ clairvoyance Clairvoyance /klษษrหvษษชษns /; from French clair meaning clear and voyance meaning vision from Wikipedia. Overview clairvoyance creates a colorful visualization of the page protection of an entire 64-bit process address space user and kernel running on a Windows 64-bit kernel. To...
CVE_2026_40369
CVE202640369 Exploit poc and exp for CVE202640369, related to my analyze, use cmake. Debug code, poc and exp files for reproducing CVE202640369, written with cmake. As before, you can compile it directly using the regular cmake commands. About the analysis article: WeChat Official Account:...
cve-2025-62215-exploit-poc
CVE-2025-62215 Proof-of-Concept โ ๏ธ WARNING - LEGAL AND ETHICAL NOTICE THIS CODE IS FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. DO NOT use this code on systems you do not own or have explicit written permission to test DO NOT use this code for malicious purposes Unauthorized access to...
dumpscan
El desarrollo pรบblico de esta herramienta se ha pausado, pero todavรญa se estรก trabajando en privado. Espere una actualizaciรณn masiva en el tercer/cuarto trimestre de 2024. Dumpscan es una herramienta de lรญnea de comandos diseรฑada para extraer y volcar secretos de kernels y formatos de Minidump de...
CVE-2024-55511
CVE-2024-55511 Este repositorio ha sido archivado y movido aquรญ Una vulnerabilidad de desreferencia de puntero nulo en Macrium Reflect anterior a 8.1.8017 permite a un atacante local provocar una caรญda del sistema o potencialmente elevar sus privilegios mediante la ejecuciรณn de un ejecutable...
CVE-2020-1034
CVE-2020-1034 Warning This repository contains a working exploit. Publication was made for educational purposes only. Owner of this repository is not responsible for any damage done by any part of source code published here. This repository was created as a homework for "Protected Information...
Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP
Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP Kernel Arbitrary Read Vulnerability + Superfetch EOP based on reacher from https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/ . Exploit must be run from low integrity...
criPPLe
criPPLe Windows kernel driver that removes Process Protection PP and Process Protection Light PPL. This was made with the help of Zero-Point Security's "Offensive Driver Development course" This kernel driver removes the process protection from a given pid, it gets a pointer to the process's...
Windows-Kernel-Exploitation
1. Non-Paged Pool Overflow Exploitation with Named Pipes Techniques based on named pipes for pool overflow exploitation demonstrated on CVE-2020-17087 and an off-by-one overflow 2. Segment Heap VS Allocator Metadata Abuse Techniques for turning a potentially limited write primitive eg a pool...
CVE-2020-15368-AsrDrv103-research
CVE-2020-15368 โ AsrDrv103.sys This repository contains my materials related to the reverse engineering of the ASRock AsrDrv103.sys Windows kernel driver associated with CVE-2020-15368. The project was created as a practical study of Windows kernel drivers, driver communication interfaces,...