Windows kernel security
Use this skill for authorized Windows kernel and defensive game-security work. Match implementation details to the target Windows version and verify undocumented structures rather than treating historical layouts as stable.
Topic routing
Read only the reference that matches the task:
- Kernel foundations for objects, symbols, PatchGuard, DSE, VBS, HVCI, and Secure Boot.
- Drivers and observation for callbacks, driver structure, hooking, APCs, and ETW.
- Memory and forensics for segment heap, pool artifacts, virtual or physical memory, and MDLs.
- Threats and virtualization for vulnerable drivers, boot threats, PatchGuard research, and hypervisor defenses.
- Resource map for tools and upstream references.
Use anti-cheat-systems for product-level detection architecture and dma-attack-techniques for PCIe/IOMMU threat modeling. Separate documented APIs from version-specific internals and label unsupported techniques accordingly.