kkent030315

x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration

A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.

x64 Windows kernel driver mapper, inject unsigned driver using anycall

x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code

Exploit MsIo vulnerable driver

Resolve DOS MZ executable symbols at runtime

x64 Windows implementation of virtual-address to physical-address translation

Two PoC of accessing process virtual memory via NT Kernel

x64 Windows privilege elevation using anycall