41554 blogs · [ { "id": "01a07df2-61c8-707d-b489-8c5af939c41a", "title": "Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//securitytrace-etw-ppl/", "published_at": "2026-01-16T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5af93fc6af", "title": "Windows ARM64 Internals: Pardon The Interruption! Interrupts on Windows for ARM", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//windows-arm64-interrupts/", "published_at": "2026-01-02T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afa30ecd5", "title": "Windows ARM64 Internals: Exception & Privilege Model, Virtual Memory Management, and Windows under Virtualization Host Extensions (VHE)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//arm64-windows-internals-basics/", "published_at": "2025-10-27T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afa8e56b0", "title": "Exploit Development: Unveiling Windows ARM64 Pointer Authentication (PAC)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//windows-pac-arm64/", "published_at": "2025-10-15T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afb3da779", "title": "Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//secure-calls-and-skbridge/", "published_at": "2025-09-06T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afb9629e4", "title": "Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//km-shadow-stacks/", "published_at": "2025-02-03T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afbd28f19", "title": "Windows Internals: Dissecting Secure Image Objects - Part 1", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//secure-images/", "published_at": "2024-06-01T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afbe1a0ab", "title": "Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//hvci/", "published_at": "2022-05-23T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afc3e23ce", "title": "Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 3)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//type-confusion-part-3/", "published_at": "2022-04-07T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afcd7dc03", "title": "Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 2)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//type-confusion-part-2/", "published_at": "2022-03-16T00:00:00+00:00" } ] posts Claim your blog
Back to Connor McGarr
Blog · corpus.blog/blogs/connormcgarr.github.io/posts

Connor McGarr

connormcgarr.github.io

2026

2025

2024

2022