incodenito

Vulnerability research, teardowns and the occasional incident postmortem.

Callback-free process birth via self-re-execution
The kernel tells EDR drivers about every new process. Unless you zero out the notification list first, then spawn yourself as the child.
Loading unsigned drivers when g_CiOptions is read-only
Windows 11's hypervisor protects the classic DSE bypass target. But the kernel calls CI.dll through a function pointer table that the hypervisor doesn't touch.
From MSR write to ring zero in one syscall
What the full chain looks like when a signed driver hands you an unrestricted MSR write and the CPU itself becomes your only hook.
Not all kernel writes are equal
The write primitive your BYOVD driver gives you determines which kernel techniques you can use, and which ones will BSOD the box.
Why indirect syscalls still work
Direct syscalls used to dodge EDR hooks just fine. Then endpoint vendors started checking where the syscall instruction lives in memory. The fix is simpler than you'd think.