Series
Windows Drivers Series Part 8 - Bypassing SMEP
Porting the HEVD buffer overflow exploit to 64-bit Windows 8.1 and using ROP to bypass Supervisor Mode Execution Prevention.
Writing.
13 posts, newest first.
Series
Windows Drivers Series Part 7 - Buffer Overflow on Windows 7
Developing a kernel stack buffer overflow exploit against HackSysExtremeVulnerableDriver on 32-bit Windows 7 with token-stealing shellcode.
Research
HowTo - Set up Windows Kernel Debugging in VMware
Guide to setting up both network and serial kernel debugging for Windows VMs in VMware Workstation Pro using WinDbg.
Series
Windows Drivers Series Part 6 - Debugging and Basic Rev
Setting up a kernel debugger, loading a driver into IDA, rebasing the text segment, and tracing IRPs through a live driver.
Series
Windows Drivers Series Part 5 - Basic Driver Functionality
Building a driver that handles DeviceIoControl requests and exploring buffered, direct, and neither I/O methods.
Series
Windows Drivers Series Part 4 - Interacting with the Driver
How IRPs, IO Stack Locations, and dispatch functions work together to let user-mode applications communicate with kernel drivers.
Series
Windows Drivers Series Part 3 - The Minimum Viable Driver
Setting up a driver development environment in Visual Studio and writing a minimal kernel driver that loads and unloads.
Series
Windows Drivers Series Part 2 - What's a Driver Anyways?
A history of Windows drivers and an explanation of what they are, the different types, and how they fit into the modern Windows kernel.
Series
Windows Drivers Series Part 1 - Overview
Introduction to the Windows driver exploitation series — who it's for, what tools you'll need, and why drivers are a great target.
Writeups
UMass CTF 2025 - Ghost in the Leg
Writeup for a Meltdown-style speculative execution exploit challenge on theLEG architecture, authored for UMass CTF 2025.
Research
HowTo - Decryption of Signal Messages on Windows
Step-by-step guide to decrypting the Signal desktop database on Windows, covering both the old plaintext key method and the new DPAPI-protected key.
Writeups
HackTheBox Binary Badlands 2024 - Signaling Victorious
Decrypting Signal messages and extracting credentials from a Windows memory dump to solve the HTB Binary Badlands 2024 forensics challenge.
Writeups
HackTheBox University CTF 2023 - ZombieNet
Investigating persistent access on a compromised OpenWRT router image from the HTB Uni CTF 2023.