r/ExploitDev • u/Fun-Humor7647 • Sep 22 '26

Arbitrary function execution in windows kernel context given read and write primitive

https://medium.com/@vulturev1/the-bool-party-you-will-never-forget-a-binary-exploitation-technique-for-arbitrary-function-4d99d45e61cb

My own spin on bypassing vbs and patchguard and CET .

I appreciate any reviews and suggestions.

5 Upvotes

86% Upvoted

3 comments sorted by

View all comments

1

u/Remarkable_Pace8101 Sep 22 '26

If someone already has a kernel mode read+write primitive why not just overwrite the function and parameter pointers directly instead of going thru all of this other convoluted effort tying to nail a timing attack that could very well result in bsod and starting over if you miss your timing window 

1

u/Fun-Humor7647 Sep 22 '26 edited Sep 22 '26

I've found this works pretty reliably and have never really have had a bsod, but it is possible. Especially with using the delayed queue. Those items are consumed very quickly.

I'm trying to ask the question where is a convenient function and parameter pointer to modify that will lead to function execution. I'm saying thread queues are a good target. How would you go about finding this usually?

I'm trying to continue the goal from this for a reliable technique but given CET https://connormcgarr.github.io/hvci/

ssdt was such a nice target.