corpus.blog
41554 blogs · [ { "id": "01a07df2-61c8-707d-b489-8c5af939c41a", "title": "Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//securitytrace-etw-ppl/", "published_at": "2026-01-16T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5af93fc6af", "title": "Windows ARM64 Internals: Pardon The Interruption! Interrupts on Windows for ARM", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//windows-arm64-interrupts/", "published_at": "2026-01-02T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afa30ecd5", "title": "Windows ARM64 Internals: Exception & Privilege Model, Virtual Memory Management, and Windows under Virtualization Host Extensions (VHE)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//arm64-windows-internals-basics/", "published_at": "2025-10-27T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afa8e56b0", "title": "Exploit Development: Unveiling Windows ARM64 Pointer Authentication (PAC)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//windows-pac-arm64/", "published_at": "2025-10-15T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afb3da779", "title": "Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//secure-calls-and-skbridge/", "published_at": "2025-09-06T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afb9629e4", "title": "Exploit Development: Investigating Kernel Mode Shadow Stacks on Windows", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//km-shadow-stacks/", "published_at": "2025-02-03T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afbd28f19", "title": "Windows Internals: Dissecting Secure Image Objects - Part 1", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//secure-images/", "published_at": "2024-06-01T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afbe1a0ab", "title": "Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//hvci/", "published_at": "2022-05-23T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afc3e23ce", "title": "Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 3)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//type-confusion-part-3/", "published_at": "2022-04-07T00:00:00+00:00" }, { "id": "01a07df2-61c8-707d-b489-8c5afcd7dc03", "title": "Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 2)", "url": "https://connormcgarr.github.io/securitytrace-etw-ppl//type-confusion-part-2/", "published_at": "2022-03-16T00:00:00+00:00" } ] posts Claim your blog
Back to Connor McGarr
Blog · corpus.blog/blogs/connormcgarr.github.io/posts

Connor McGarr

connormcgarr.github.io

2026

Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flagoriginal ↗
16 Jan 2026
Windows ARM64 Internals: Pardon The Interruption! Interrupts on Windows for ARMoriginal ↗
2 Jan 2026

2025

Windows ARM64 Internals: Exception & Privilege Model, Virtual Memory Management, and Windows under Virtualization Host Extensions (VHE)original ↗
27 Oct 2025
Exploit Development: Unveiling Windows ARM64 Pointer Authentication (PAC)original ↗
15 Oct 2025
Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kerneloriginal ↗
6 Sept 2025
Exploit Development: Investigating Kernel Mode Shadow Stacks on Windowsoriginal ↗
3 Feb 2025

2024

Windows Internals: Dissecting Secure Image Objects - Part 1original ↗
1 Jun 2024

2022

Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFGoriginal ↗
23 May 2022
Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 3)original ↗
7 Apr 2022
Exploit Development: Browser Exploitation on Windows - CVE-2019-0567, A Microsoft Edge Type Confusion Vulnerability (Part 2)original ↗
16 Mar 2022