yardenshafir/KernelDataStructureFinder

Stars
63
Rank 484,938 (Top 10 %)
Language
C++
Created over 4 years ago
Updated over 4 years ago

yardenshafir/KernelDataStructureFinder

yardenshafir

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Driver and WinDBG scripts to dump information about all resources and lookaside lists

WinDbg_Scripts

Useful scripts for WinDbg using the debugger data model

IoRingReadWritePrimitive

Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2

PoolViewer

An application to view and filter pool allocations from a dmp file on Windows 10 RS5+.

CVE-2020-1034

PoC demonstrating the use of cve-2020-1034 for privilege escalation

SymlinkCallback

A driver that hooks C: volume using symbolic link callback to track all FS access to the volume

cet-research

A collection of tools, source code, and papers researching Windows' implementation of CET.

InformationClasses

Documenting system information classes and their uses

DpcWait

Driver demonstrating how to register a DPC to asynchronously wait on an object

MitigationFlagsCliTool

Command like tool to print mitigation flags for running processes in a memory dump

IoRing_Demos

A repository for I/O ring demos, use cases and performance testing on Windows

conference_talks

Slides from various conference talks

CallbackObjectAnalyzer

Dumps information about all the callback objects found in a dump file and the functions registered for them

s1dbg

windbg extension that does stuff