/vx/Papers/Windows/Kernel Mode/

0 directories 37 files
Name Size Modified
Go up — —
2014-02-06 - Hide process with DKOM without hard coded offsets.txt 5.2 KiB
2015-04-06 - Hiding loaded driver with DKOM.txt 2.3 KiB
2020-01-31 - DKOM - Now with Symbolic Links.pdf 688 KiB
2020-05-18 - How to use Trend Micro's Rootkit Remover to Install a Rootkit.pdf 719 KiB
2020-08-02 - Removing Kernel Callbacks Using Signed Drivers.7z 422 KiB
2020-08-15 - SassyKitdi Kernel Mode TCP Sockets LSASS Dump.pdf 310 KiB
2021-01-09 - Heresys Gate Kernel ZwNTDLL Scraping and Work Out Ring 0 to Ring 3 via Worker Factories.pdf 442 KiB
2022-01-01 - HyperGuard Secure Kernel Patch Guard Part 1 SKPG Initialization.pdf 1.4 MiB
2022-01-11 - Signed Kernal Drivers - Unguarded Gateway to Windows Core.pdf 1.4 MiB
2022-01-15 - Demonstrating EAT hooking from Kernel space.7z 102 KiB
2022-02-04 - KCTHIJACK - KernelCallbackTable Hijack.zip 2.9 MiB
2022-02-17 - HyperGuard Secure Kernel Patch Guard Part 2 SKPG Extents.pdf 858 KiB
2022-03-24 - Manipulating LastWriteTime without leaving traces in the NTFS USN Journal.pdf 106 KiB
2022-04-19 - HyperGuard Part 3 More SKPG Extents.pdf 1.1 MiB
2022-07-14 - Lord Of The Ring0 - Part 1 Introduction.pdf 163 KiB
2022-08-04 - Lord Of The Ring0 - Part 2 A tale of routines IOCTLs and IRPs.pdf 368 KiB
2022-09-05 - DirectX and HyperV - An Offensive View.pdf 9.6 MiB
2022-10-18 - Fantastic Rootkits And Where to Find Them Part 1.pdf 937 KiB
2022-10-30 - Lord Of The Ring0 - Part 3 Sailing to the land of the user and debugging the ship.pdf 181 KiB
2022-12-29 - Bootkitting Windows Sandbox.pdf 306 KiB
2022-12-30 - Code Execution against Windows HVCI.pdf 680 KiB
2023-02-24 - Lord Of The Ring0 - Part 4 The call back home.pdf 413 KiB
2023-05-04 - Fantastic Rootkits and Where to Find Them Part 2.pdf 3.1 MiB
2023-06-05 - Terminator - Demonstrating how to kill EDR processes using a driver.zip 98 KiB
2023-07-01 - Demonstrating a Rust based Bootkit.zip 1.6 MiB
2023-07-29 - Lord Of The Ring0 - Part 5 Sarumans Manipulation.pdf 651 KiB
2023-09-15 - Hypervisor Detection with SystemHypervisorDetailInformation.pdf 443 KiB
2024-02-06 - Exploiting a vulnerable Minifilter driver to create a process killer.7z 112 KiB
2024-02-12 - Hypervisor enforced security policies for NTOS secure kernel and a child partition.pdf 666 KiB
2024-02-25 - Keylogging in the Windows kernel with undocumented data structures.pdf 1.1 MiB
2024-03-23 - Anti-Anti-Rootkit Techniques - Part I UnKovering mapped rootkits.pdf 1.1 MiB
2024-08-11 - Blocking EDR drivers with HVCIDisallowedimage.7z 424 KiB
2024-09-16 - Kernel ETW is the bestnbspETW.pdf 812 KiB
2024-09-20 - Anti-Anti-Rootkit Techniques - Part II Stomped Drivers and Hidden Threads.pdf 916 KiB
2025-07-15 - Weaponizing Windows Drivers A Hackers Guide for Beginners.pdf 6.6 MiB
2025-08-15 - Driver Reverse Engineering 101.pdf 707 KiB
2025-08-24 - Hyper-V utility LiveCloudKd evolution and architecture technical analysis.pdf 3.0 MiB