Close your eyes and ✨imagine: From a low-integrity process (from LPAC even), you can inject your data anywhere you want: privileged tasks, PPL/protected processes, the OS kernel itself, and VTL1 trustlets. Now open your eyes. It is not hypothetical. It is the reality. Read it on page 33.

Error you may randomly get anytime you delete stuff: błąd 0x80070050. Nevermind the shellful bin and Shellberus the dog (recycler shell32 dev). Error is due to rnd name generation for the bin: $R[A-Z0-9]{6}<.ext>. Deleting 2 files: 36⁻⁶ ≈ 2⁻³¹ fail chance. 🎈Birthday paradox: 50% 🎲 for 54933 files.

What is Volume Serial Number (aka VolId/VolumeId)? For ntfs it's 64 bits at offset +0x48 from the volume start (in the $Boot file). You see its lower dword with "dir C:". But how it's calculated? Is it good for #DFIR? 👉 It's just a weak hash over 429.5 seconds of system time.

Greetings, fellow timetravelers. Today is Monday. But if I could convince Pope Gregory XIII not to skip weekdays @1582-10-15, today could still be Friday! But there's a problem. To meet Pope, I gotta set clock on my Windows to the year 1582, yet it refuses: only allows 1601. How to set it to 1582?

Finally, a script to estimate IQ of your PC! Copypaste it into powershell console, get instant result! $9={[Runtime.InteropServices.Marshal]:: ReadInt64(1TB-64MB-+-$args[0]-shr9)};` (&$9 4KB)/(&$9 (900.9MB/9.9/7-shr5))/` 25/(&$9)*(2L-shl55) Is your PC smart? Can you deduce what is that metric?

Windows can seamlessly patch your code when it catches #GP. So called "alignment fixup". KiOpPatchCode modifies user code: movaps->movups, movdqa->movdqu. Needs x64 code, and opt-in: SetErrorMode(SEM_NOALIGNMENTFAULTEXCEPT), or ProcessEnableAlignmentFaultFixup, or ThreadEnableAlignmentFaultFixup.

Did you know Windows has built-in RAM disk? And not just your regular RAM disk. It's pmem/nvdimm, via built-in scmbus.sys facility! That means you can make 🦆🦆🦆 #dax volume, so data/image mappings (section views) will use "drive" directly! No data persistence, no w10; only ws2022/w11+. EZ 📀 create:

ntoskrnl #kASLR 🚫: r$t0=0;# and*77FFFF winload!MmArchInitialize L200;r$t0=@$exp;.while(by(@$t0)){r$t0=@$t0+1};ed@$t0-3 0; ed MmArchKsegAddressRange 0 FFFFF800; r$t0=SymCryptRngAesGenerate;ed@$t0 33CA8B48 E9D2;ed@$t0+6 memset-@$t0-A; ed OslGatherEntropy C3C033; ed BlArchGetPerformanceCounter C3C033

There are lots of misoptimisations in the OS kernel with /dynamicValueFixupSym. E.g. index check for SK PFN db — is it "cmp rcx, 0x07FF'FFFF'FFFF>>3"? Size is constant after all. Nope. Gotta load SKMM_PFN_DATABASE_END, SKMM_PFN_DATABASE, sub, shift, etc — dozens of extra instr, in a lot of places.

Heard of #ContextJail? It's a nasty new technique: puts target thread into ⓪ deadloop, for as long as you can afford. Requires THREAD_GET_CONTEXT right. The gist? Just spam NtGetContextThread(tgt).😸 Target will be jailed, running nt!PspGetSetContextSpecialApc 🔁. Src & binary in [ALT]. Usecases: ⤵️

Kernel VA region for system images has size 512_GB (256_TB LA57). And nt!MiAssignTopLevelRanges shuffles regions order before VA assignment. So why is ntoskrnl always in the first 31_GB from 0xFFFF_FF80_0000_0000?! That's just how winload.efi randomizes MmArchKsegBias. #KASLR #0xFFFFFF8000000000

WinDbg script to check kCFG target function validity, and also to dump actual cfguard bitmap (which can be quite different from what's specified in the image GFIDS, needs more research): pastebin.com/64kujJNb. !check_cfguard "nt!longjmp" !dump_cfguard_bitmap "nt", "C:/cfguard_bitmap_ntoskrnl.bin"

Is your EDR a dump? With crashdmp it literally is: cmd /v/c "set R=reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /f /v&!R! CrashDumpEnabled /d ୭ /t ൪&!R! DumpFileSize /d ൬৬६ /t ៤&for /f "delims=*" %i in ('sc qc WinDefend^|find "PATH_"')do (set t=%i&!R! DedicatedDumpFile /d !t:~๒੯,-១!)"

Stack /GS cookie - GuardStack "__security_cookie" - has protected NT for nearly 25 years. Do you know why higher word zeroed in 64-bit 🍪? Yep, it's against attacks like strcat/wcscat. But did you realize that's 𝗵𝗮𝗹𝗳-𝗯𝗿𝗼𝗸𝗲𝗻?! Yes, xoring "0000" with ⓪ RSP gives "FFFF" 😹. …and it's worse with LA57.

24H2 has reduced KiCyclesPerClockQuantum by a factor of 6 - from ~(15.625/3) ms to ~(15.625/18) ms. But QuantumReset compute changed too, so final revise is not so drastic. Was: 31.25 to 93.75 ms; now: 15.625 to 31.25 ms, yet min is 1.74 ms. But WTF: clock interrupts every 2 ms across *each* CPU!

Nel mezzo del cammin di nostra vita, mi ritrovai per una selva oscura, ché la diritta via era smarrita.