kkent030315

x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration

A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.

x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code

x64 Windows kernel driver mapper, inject unsigned driver using anycall

Exploit MsIo vulnerable driver

Resolve DOS MZ executable symbols at runtime

x64 Windows implementation of virtual-address to physical-address translation

Two PoC of accessing process virtual memory via NT Kernel

x64 Windows privilege elevation using anycall