Windows Kernel Security

Guide for Windows kernel security research including driver development, system callbacks, security features, and kernel exploitation. Use this skill when working with Windows drivers, PatchGuard, DSE, or kernel-level security mechanisms.

majiayu000 Updated Sep 22, 2026 567 repo stars

Install

Press C to copy

$ npx skillmds@latest add majiayu000/windows-kernel-security-2

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/majiayu000/windows-kernel-security-2.svg)](https://skillmd.com/skills/majiayu000/windows-kernel-security-2)

Trust & safety

Audits pending

Not yet audited · commit 500fe2d

Permissions this skill uses

Documentation only
No scripts, network access, or credentials are involved.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Windows Kernel Security

Overview

This skill covers Windows kernel security topics from the awesome-game-security collection, including driver development, system callbacks, security feature bypasses, and kernel-mode exploitation.

Core Kernel Concepts

Important Structures

EPROCESS / ETHREAD
PEB / TEB
DRIVER_OBJECT
DEVICE_OBJECT
IRP (I/O Request Packet)

Key Tables

SSDT (System Service Descriptor Table)
IDT (Interrupt Descriptor Table)
GDT (Global Descriptor Table)
PspCidTable (Process/Thread handle table)

Security Features

PatchGuard (Kernel Patch Protection)

- Protects critical kernel structures
- Periodic verification checks
- BSOD on tampering detection
- Multiple trigger mechanisms

Driver Signature Enforcement (DSE)

- Requires signed drivers
- CI.dll verification
- Test signing mode
- WHQL certification

Hypervisor Code Integrity (HVCI)

- VBS-based protection
- Kernel code integrity
- Driver compatibility requirements
- Memory restrictions

Secure Boot

- UEFI-based boot verification
- Boot loader chain validation
- Kernel signature checks
- DBX (forbidden signatures)

Kernel Callbacks

Process Callbacks

PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
PsSetCreateProcessNotifyRoutineEx2

Thread Callbacks

PsSetCreateThreadNotifyRoutine
PsSetCreateThreadNotifyRoutineEx

Image Load Callbacks

PsSetLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutineEx

Object Callbacks

ObRegisterCallbacks
// OB_OPERATION_HANDLE_CREATE
// OB_OPERATION_HANDLE_DUPLICATE

Registry Callbacks

CmRegisterCallback
CmRegisterCallbackEx

Minifilter Callbacks

FltRegisterFilter
// IRP_MJ_CREATE, IRP_MJ_READ, etc.

Driver Development

Basic Structure

NTSTATUS DriverEntry(
    PDRIVER_OBJECT DriverObject,
    PUNICODE_STRING RegistryPath
) {
    DriverObject->DriverUnload = DriverUnload;
    DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
    // Create device, symbolic link...
    return STATUS_SUCCESS;
}

Communication Methods

IOCTL (DeviceIoControl)
Direct I/O
Buffered I/O
Shared memory

Vulnerable Driver Exploitation

Common Vulnerability Types

Arbitrary read/write primitives
IOCTL handler vulnerabilities
Pool overflow
Use-after-free

Notable Vulnerable Drivers

- gdrv.sys (Gigabyte)
- iqvw64e.sys (Intel)
- MsIo64.sys
- Mhyprot2.sys (Genshin Impact)
- dbutil_2_3.sys (Dell)
- RTCore64.sys (MSI)
- Capcom.sys

Exploitation Steps

Load vulnerable signed driver
Trigger vulnerability
Achieve kernel read/write
Disable DSE or load unsigned driver
Execute arbitrary kernel code

PatchGuard Bypass Techniques

Timing-Based

Predict PG timer
Modify between checks

Context Manipulation

Exception handling
DPC manipulation
Thread context tampering

Hypervisor-Based

EPT manipulation
Memory virtualization
Intercept PG checks

Kernel Hooking

ETW (Event Tracing for Windows)

- InfinityHook technique
- HalPrivateDispatchTable
- System call tracing

SSDT Hooking (Legacy)

- Modify service table entries
- Requires PG bypass
- High detection risk

IRP Hooking

- Hook driver dispatch routines
- Less monitored than SSDT
- Per-driver targeting

Memory Manipulation

Physical Memory Access

MmMapIoSpace
MmCopyMemory
\\Device\\PhysicalMemory

Virtual Memory

ZwReadVirtualMemory
ZwWriteVirtualMemory
KeStackAttachProcess
MmCopyVirtualMemory

MDL Operations

IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache

Research Tools

Analysis

WinDbg / WinDbg Preview
Process Hacker / System Informer
OpenArk
WinArk

Utilities

KDU (Kernel Driver Utility)
OSR Driver Loader
DriverView

Monitoring

Process Monitor
API Monitor
ETW consumers

EFI/UEFI Integration

Boot-Time Access

- EFI runtime services
- Boot driver loading
- Pre-OS execution

Memory Access

- GetVariable/SetVariable
- Runtime memory mapping
- Physical memory access

Hypervisor Development

Intel VT-x

VMCS configuration
EPT (Extended Page Tables)
VM exits handling

AMD-V

VMCB structure
NPT (Nested Page Tables)
SVM operations

Use Cases

Memory hiding
Syscall interception
Security monitoring
Anti-cheat evasion

Resource Organization

The README contains categorized links for:

PatchGuard research and bypasses
DSE bypass techniques
Vulnerable driver exploits
Kernel callback enumeration
ETW/PMI/NMI handlers
Intel PT integration

---name: windows-kernel-security-2description: Guide for Windows kernel security research including driver development, system callbacks, security features, and kernel exploitation. Use this skill when working with Windows drivers, PatchGuard, DSE, or kernel-level security mechanisms.---# Windows Kernel Security## OverviewThis skill covers Windows kernel security topics from the awesome-game-security collection, including driver development, system callbacks, security feature bypasses, and kernel-mode exploitation.## Core Kernel Concepts### Important Structures- EPROCESS / ETHREAD- PEB / TEB- DRIVER_OBJECT- DEVICE_OBJECT- IRP (I/O Request Packet)### Key Tables- SSDT (System Service Descriptor Table)- IDT (Interrupt Descriptor Table)- GDT (Global Descriptor Table)- PspCidTable (Process/Thread handle table)## Security Features### PatchGuard (Kernel Patch Protection)```- Protects critical kernel structures- Periodic verification checks- BSOD on tampering detection- Multiple trigger mechanisms```### Driver Signature Enforcement (DSE)```- Requires signed drivers- CI.dll verification- Test signing mode- WHQL certification```### Hypervisor Code Integrity (HVCI)```- VBS-based protection- Kernel code integrity- Driver compatibility requirements- Memory restrictions```### Secure Boot```- UEFI-based boot verification- Boot loader chain validation- Kernel signature checks- DBX (forbidden signatures)```## Kernel Callbacks### Process Callbacks```cppPsSetCreateProcessNotifyRoutinePsSetCreateProcessNotifyRoutineExPsSetCreateProcessNotifyRoutineEx2```### Thread Callbacks```cppPsSetCreateThreadNotifyRoutinePsSetCreateThreadNotifyRoutineEx```### Image Load Callbacks```cppPsSetLoadImageNotifyRoutinePsSetLoadImageNotifyRoutineEx```### Object Callbacks```cppObRegisterCallbacks// OB_OPERATION_HANDLE_CREATE// OB_OPERATION_HANDLE_DUPLICATE```### Registry Callbacks```cppCmRegisterCallbackCmRegisterCallbackEx```### Minifilter Callbacks```cppFltRegisterFilter// IRP_MJ_CREATE, IRP_MJ_READ, etc.```## Driver Development### Basic Structure```cppNTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { DriverObject->DriverUnload = DriverUnload; DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl; // Create device, symbolic link... return STATUS_SUCCESS;}```### Communication Methods- IOCTL (DeviceIoControl)- Direct I/O- Buffered I/O- Shared memory## Vulnerable Driver Exploitation### Common Vulnerability Types- Arbitrary read/write primitives- IOCTL handler vulnerabilities- Pool overflow- Use-after-free### Notable Vulnerable Drivers```- gdrv.sys (Gigabyte)- iqvw64e.sys (Intel)- MsIo64.sys- Mhyprot2.sys (Genshin Impact)- dbutil_2_3.sys (Dell)- RTCore64.sys (MSI)- Capcom.sys```### Exploitation Steps1. Load vulnerable signed driver2. Trigger vulnerability3. Achieve kernel read/write4. Disable DSE or load unsigned driver5. Execute arbitrary kernel code## PatchGuard Bypass Techniques### Timing-Based- Predict PG timer- Modify between checks### Context Manipulation- Exception handling- DPC manipulation- Thread context tampering### Hypervisor-Based- EPT manipulation- Memory virtualization- Intercept PG checks## Kernel Hooking### ETW (Event Tracing for Windows)```- InfinityHook technique- HalPrivateDispatchTable- System call tracing```### SSDT Hooking (Legacy)```- Modify service table entries- Requires PG bypass- High detection risk```### IRP Hooking```- Hook driver dispatch routines- Less monitored than SSDT- Per-driver targeting```## Memory Manipulation### Physical Memory Access```cppMmMapIoSpaceMmCopyMemory\\Device\\PhysicalMemory```### Virtual Memory```cppZwReadVirtualMemoryZwWriteVirtualMemoryKeStackAttachProcessMmCopyVirtualMemory```### MDL Operations```cppIoAllocateMdlMmProbeAndLockPagesMmMapLockedPagesSpecifyCache```## Research Tools### Analysis- WinDbg / WinDbg Preview- Process Hacker / System Informer- OpenArk- WinArk### Utilities- KDU (Kernel Driver Utility)- OSR Driver Loader- DriverView### Monitoring- Process Monitor- API Monitor- ETW consumers## EFI/UEFI Integration### Boot-Time Access```- EFI runtime services- Boot driver loading- Pre-OS execution```### Memory Access```- GetVariable/SetVariable- Runtime memory mapping- Physical memory access```## Hypervisor Development### Intel VT-x- VMCS configuration- EPT (Extended Page Tables)- VM exits handling### AMD-V- VMCB structure- NPT (Nested Page Tables)- SVM operations### Use Cases- Memory hiding- Syscall interception- Security monitoring- Anti-cheat evasion## Resource OrganizationThe README contains categorized links for:- PatchGuard research and bypasses- DSE bypass techniques- Vulnerable driver exploits- Kernel callback enumeration- ETW/PMI/NMI handlers- Intel PT integration

majiayu000/claude-skill-registry-data/tree/main/security/windows-kernel commit 500fe2d73b

Frequently asked questions

npx skillmds@latest add majiayu000/windows-kernel-security-2