Experiments

Repository of various experiments / PoC.

debugging-secure-kernel: PoC gdb debugging the Windows 10 secure kernel, on top of QEMU KVM
dns: Experiments regarding DNS / Certificate transparency / Homoglyphs
Attack Surface Reduction: Demystifying Windows Attack Surface Reduction internals
VDM: Windows Defender's VDM Format (signatures database)
Primary Group ID: Analysis of security checks made on primaryGroupID AD attribute changes
Unpacking with Windows Defender: Re-using the unpackers built into Windows Defender
Firejail no-execve: Illustration of an issue when filtering the execve syscall for a target binary
ALPC Monitoring: Attempt to monitor ALPC calls, using WinDBG scripting and Dtrace