igorkorkin Goto Github PK

allmempro

AllMemPro

allmemprotestbed

Legal access: The driver and console app to demonstrate the basic memory access in kernel mode

allmemprotestbedpatcher

Illegal access: the driver and console app to demo unauthorized read- and write- access to the kernel-mode memory

amp_test

awesome-virtualization

Collection of resources about Virtualization

github-slideshow

A robot powered training repository :robot:

hypervisorsdetection

This is the first software system, which can detect a stealthy hypervisor and calculate several nested ones even under countermeasures.

memallocator

This project demonstrates allocation and legal access to the allocated data in the kernel mode.

memattacker

This project demonstares an illegal read- and write- access to the kernel-mode data for both allocated by 3rd party drivers and EPROCESS structures

memoryguardconsole

This code demonstrates the memory guard idea, which prevents unauthority access from one driver to another and allows all legitimate accesses.

memoryranger

MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.

mimikatz

A little tool to play with Windows security

perceptron

A small demo project to learn ML & AI

ppl

The demo of RtlTestProtectedAccess() and RtlProtectedAccess involved in creation Protected Process.

publications

research

The section includes all the information about my research result: papers, slides, speeches, etc.

specucheck

SpecuCheck is a Windows utility for checking the state of the software mitigations against CVE-2017-5754 (Meltdown) and hardware mitigations against CVE-2017-5715 (Spectre)

testbed

This project demonstrates the privilege escalation for a user-mode process - cmd.exe using stack overflow in the kernel mode driver. The user-mode component 'testbed_console.exe' sends CTL_CODE with a payload to the vulnerable driver 'testbed_driver.sys', which call RtlCopyMemory without any checks. 'testbed_console.exe' includes 'testbed_driver.sys' has a resource.