Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag
Consuming from Microsoft-Windows-Threat-Intelligence without Antimalware-PPL or kernel patching/driver loading.
Connor McGarr’s Blog
Software Engineering and Security Research
Latest posts
Windows ARM64 Internals: Pardon The Interruption! Interrupts on Windows for ARM
Interrupt discovery and delivery on Windows on ARM
Windows ARM64 Internals: Exception & Privilege Model, Virtual Memory Management, and Windows under Virtualization Host Extensions (VHE)
Analysis of Windows under ARM64: exception/privilege model, virtual memory mechanics, and OS behavior under VHE
Exploit Development: Unveiling Windows ARM64 Pointer Authentication (PAC)
Examining the implementation and implication of PAC in user-mode and kernel-mode on ARM64 Windows
Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel
Examining the interface by which NT requests the services of SK through the SkBridge project
Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows
Using SourcePoint's JTAG debugger to investigate the implementation of Intel CET Shadow Stacks in kernel-mode on Windows
Windows Internals: Dissecting Secure Image Objects - Part 1
Analysis of NT, Secure Kernel, and SKCI working together to create the initial SECURE_IMAGE object
Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG
Dealing with Virtualization-Based Security (VBS), Hypervisor-Protected Code Integrity (HVCI), and Kernel Control Flow Guard (kCFG).
Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 3)
Porting part 2's ChakraCore exploit to Microsoft Edge while defeating ASLR, DEP, CFG, ACG, CIG, and other mitigations.
Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 2)
Leveraging ChakraCore to convert our denial-of-service from part 1 into a read/write primtive and functioning exploit.