Defeating Windows Anti-Exploit & Security Features with WHQL Kernel Drivers
summary
Covers design weaknesses in Microsoft WHQL-signed kernel drivers and Windows 10 exploit mitigations, demonstrating how to attack the kernel using WHQL drivers and bypass protections via AMD64 paging abuse, and concludes by proposing possible mitigations.
AI-written summary · about
chapters (12)
- 0:00Introduction and agenda
- 1:26Learning goals and overview
- 2:18Windows internals and drivers
- 3:28Driver architecture and WHQL
- 10:18Windows anti-exploit features
- 13:46Case study one: Corsair driver
- 21:41Advanced paging exploitation
- 23:37Case study one: execution and demo
- 30:01Case study two: Defender driver
- 32:19Exploiting IUM process memory
- 36:37Case study two: execution and demo
- 40:18Conclusions and takeaways
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
56mWindows Kernel Graphics Driver Attack Surface
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
46mD2T2 - Over The Edge: Pwning The Windows Kernel
25mData-Only Pwning Microsoft Windows Kernel
40mWindows Kernel Patch Protection - Achilles Heel: PatchGuard
39mProxying to Kernel:Streaming vulnerabilities from Windows Kernel
48mNext Level Cheating and Leveling Up Mitigations