RING-0 KERNEL DRIVER & MEMORY EXPLOITATION
Windows kernel-mode driver serving memory read/write to a usermode client through a hooked dispatch routine, plus DLL-injection game hacks and glibc heap-exploitation challenges.
- Year
- 2023
- Driver
- Windows Kernel-Mode (Ring 0), Hooked Dispatch + Control Codes
Kernel memory research · Concept illustration
WINDOWS KERNEL DRIVER, PROCESS MEMORY ACCESS & HEAP EXPLOITATION
Behind the project.
Low-level Windows security research in three parts. KernelCheat: a kernel-mode driver that hooks a driver dispatch routine to serve custom control codes, reading and writing process memory from Ring 0 with MmCopyVirtualMemory, with a usermode client. AC-hack: an internal Assault Cube hack built as an injected DLL, alongside a collection of DLL and shellcode injection techniques. HeapLab: hands-on glibc heap exploitation course challenges - house of force, fastbin duplication and one-byte overflow.
Under the hood.
- Driver
- Windows Kernel-Mode (Ring 0), Hooked Dispatch + Control Codes
- Memory
- MmCopyVirtualMemory Process Read/Write
- Usermode
- Client + DLL Injection (AC-hack)
- Exploitation
- HeapLab (House of Force, Fastbin Dup, One-Byte)
What came out of it.
- Ring-0 memory access served to usermode.
- Injected-DLL game hack.
- Completed glibc heap-exploitation challenges.