Record · corpus.blog/posts/01a08778-e061-7066-a991-c1022e766efd

Reverse engineering undocumented Windows Kernel features to work with the EDR

fluxsec.red · published 4 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 19
Words captured: 2,829

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/0xflux/Sanctum

github.com

Reading Event Tracing for Windows Threat Intelligence Read at the source ↗

fluxsec.red

https://github.com/0xflux/Sanctum/blob/main/sanctum_ppl_runner/src/tracing.rs

github.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_TEB

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_KPCR

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_EPROCESS

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_KPROCESS

vergiliusproject.com

https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory

learn.microsoft.com

https://binary.ninja/

binary.ninja

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtWriteVirtualMemory.html

undocumented.ntinternals.net

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_KTHREAD

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_KAPC_STATE

vergiliusproject.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obreferenceobjectbyhandlewithtag

learn.microsoft.com

Creating a Windows Driver in Rust Read at the source ↗

fluxsec.red

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FProcess%2FNtSetInformationProcess.html

undocumented.ntinternals.net

https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/ne-processthreadsapi-process_information_class

learn.microsoft.com

https://github.com/m417z/ntdoc/blob/main/descriptions/processinfoclass.md

github.com

https://learn.microsoft.com/en-us/previous-versions/mt826264(v=vs.85

learn.microsoft.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/previousmode

learn.microsoft.com