yardenshafir

WinDbg_Scripts. Useful scripts for WinDbg using the debugger data model

IoRingReadWritePrimitive. Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2

PoolViewer. An application to view and filter pool allocations from a dmp file on Windows 10 RS5+.

CVE-2020-1034. PoC demonstrating the use of cve-2020-1034 for privilege escalation

SymlinkCallback. A driver that hooks C: volume using symbolic link callback to track all FS access to the volume

cet-research. A collection of tools, source code, and papers researching Windows' implementation of CET.

KernelDataStructureFinder. Driver and WinDBG scripts to dump information about all resources and lookaside lists

IoRing_Demos. A repository for I/O ring demos, use cases and performance testing on Windows

InformationClasses. Documenting system information classes and their uses

DpcWait. Driver demonstrating how to register a DPC to asynchronously wait on an object

MitigationFlagsCliTool. Command like tool to print mitigation flags for running processes in a memory dump

conference_talks. Slides from various conference talks

CallbackObjectAnalyzer. Dumps information about all the callback objects found in a dump file and the functions registered for them

rewolf-wow64ext. Helper library for x86 programs that runs under WOW64 layer on x64 versions of Microsoft Windows operating systems.

s1dbg. windbg extension that does stuff

LOLDrivers. Living Off The Land Drivers

WinObjEx64. Windows Object Explorer 64-bit

HackSysExtremeVulnerableDriver. HackSys Extreme Vulnerable Windows Driver

BlogHyperV. Tools made for my Hyper-V blog series @ https://foxhex0ne.blogspot.com/

ObjectListView. A mirror of the ObjectListView library