windows – Page 4

Covert Kernel/User Communication Channels on Windows: Rootkits, Game Cheats, and Detection

A defender-side surface map of Windows kernel/user-mode covert channels — mailslots and ALPC, firmware-table providers and WNF, dispatch tables and writable .data…

oxfemale· Jun 10· 104 min ·83

Qualcomm QAIC Kernel Driver Page Use-After-Free: From Stale Mmap to Pipe-Buffer-Backed Kernel R/W (Walk-through of Lukas Maar’s Linux v6.18 Exploit)

kernel58

kernel Linux

Qualcomm QAIC Kernel Driver Page Use-After-Free: From Stale Mmap to Pipe-Buffer-Backed Kernel R/W (Walk-through of Lukas Maar’s Linux v6.18 Exploit)

Walk-through of Lukas Maar’s page-level use-after-free in the Linux kernel’s QAIC (Qualcomm AI Accelerator) DRM driver: the missing VMA boundary check in…

oxfemale· Jun 4· 13 min ·58

Reverse-engineering Valorant’s Vanguard Guarded Regions: PML4 Cloning, CR3 Swaps, and the SwapContext Hook PoC (Walk-through of Xyrem’s Post)

Red Team Operations22

Red Team Operations windows

Reverse-engineering Valorant’s Vanguard Guarded Regions: PML4 Cloning, CR3 Swaps, and the SwapContext Hook PoC (Walk-through of Xyrem’s Post)

Walk-through of Xyrem's reversing.info analysis of Valorant’s Vanguard Guarded Regions: how Vanguard hides game state behind a private "shadow" PML4 entry that’s…

oxfemale· Jun 3· 16 min ·22

Red Team Tactics: Utilizing Syscalls in C# — Writing the Code (Walk-through of Jack Halon’s Direct-Syscall PoC)

Red Team Operations28

Red Team Operations windows

Red Team Tactics: Utilizing Syscalls in C# — Writing the Code (Walk-through of Jack Halon’s Direct-Syscall PoC)

Walk-through of Jack Halon's "Utilizing Syscalls in C# — Part 2" post: building a direct-syscall NtCreateFile PoC in C# .NET 3.5, extracting…

oxfemale· Jun 3· 11 min ·28

One Click, One Hash: Unpatched NTLM Coercion in Windows Search URI Handler

Kerberos24

Kerberos NTLM Relay

One Click, One Hash: Unpatched NTLM Coercion in Windows Search URI Handler

Huntress reveals an unpatched Windows search: URI handler flaw that can leak Net-NTLMv2 hashes with a single link click. The bug mirrors…

oxfemale· Jun 2· 8 min ·24

Bypassing Windows Defender and AMSI: A Practical Defense Evasion Guide for Red Team Operators

Red Team Operations675

Red Team Operations windows

Bypassing Windows Defender and AMSI: A Practical Defense Evasion Guide for Red Team Operators

A practical, layer-by-layer walkthrough of modern Windows defense evasion for red team operators: the architecture of Microsoft Defender, three generations of AMSI…

oxfemale· Jun 2· 15 min ·675

Two-Shot Kernel Shellcode: Bypassing CR4 Pinning With KProbes for Linux Kernel Control-Flow Hijack to Shellcode

kernel50

kernel Linux

Two-Shot Kernel Shellcode: Bypassing CR4 Pinning With KProbes for Linux Kernel Control-Flow Hijack to Shellcode

A walk-through of zolutal’s revival of the 2017 Project Zero “native_write_cr4” trick on a modern Linux kernel with CR Pinning enabled. The…

oxfemale· Jun 2· 12 min ·50

Kernel Karnage Part 1: Patching Windows Kernel Callbacks to Disable EDR from a Driver

Red Team Operations58

Red Team Operations windows

Kernel Karnage Part 1: Patching Windows Kernel Callbacks to Disable EDR from a Driver

A walk-through of NVISO Labs’ first Kernel Karnage post: writing a small Windows kernel driver, locating the undocumented PspCreateProcessNotifyRoutine callback array through…

oxfemale· Jun 2· 14 min ·58

Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack

Bypassing76

Bypassing Exploit Development

Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack

A walkthrough of the well-documented Windows UAC bypass that uses "eventvwr.exe"’s auto-elevate manifest plus a writable HKCU registry handler for the "mscfile"…

oxfemale· May 31· 14 min ·76

Visual Studio Extensions Revisited: Building, Publishing, and Hunting Malicious VSIXs

Red Team Operations53

Red Team Operations Vulnerability Analysis

Visual Studio Extensions Revisited: Building, Publishing, and Hunting Malicious VSIXs

MDSec returns to the Visual Studio extension ecosystem three years after their VS Code work. A modern "VisualStudio.Extensibility" extension that fetches and…

oxfemale· May 29· 14 min ·53

Reverse Engineering for Beginners: Defeating an XOR Crackme on Windows x64

Reverse Engineering58

Reverse Engineering windows

Reverse Engineering for Beginners: Defeating an XOR Crackme on Windows x64

A step-by-step walkthrough of reverse-engineering a Windows x64 crackme that XORs its input against a hard-coded 10-byte key before comparing it to…

oxfemale· May 29· 10 min ·58

CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation

Exploit Development49

Exploit Development kernel

CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation

CVE-2026-40369 is a Windows kernel bug in "nt!ExpGetProcessInformation" that lets any unprivileged process — including one inside Chrome’s renderer sandbox — increment…

oxfemale· May 28· 22 min ·49

// windows