windows-kernel-security
Explore Windows kernel internals essential for security research, covering critical structures like EPROCESS and ETHREAD, callback systems, and enforcement mechanisms including PatchGuard, Driver Signature Enforcement, and Hypervisor-Enforced Code Integrity. Learn symbol resolution techniques, driver development patterns, and how anti-cheat systems detect kernel tampering.
windows-kernel-security teaches kernel internals, callback mechanisms, and security features like PatchGuard and HVCI for low-level research.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-28
windows-kernel-security teaches kernel internals, callback mechanisms, and security features like PatchGuard and HVCI for low-level research. Explore Windows kernel internals essential for security research, covering critical structures like EPROCESS and ETHREAD, callback systems, and enforcement mechanisms including PatchGuard, Driver Signature Enforcement, and Hypervisor-Enforced Code Integrity. Learn symbol resolution techniques, driver development patterns, and how anti-cheat systems detect kernel tampering.
Use it when
- windows-kernel-security examines PatchGuard bypass techniques as part of understanding kernel protection mechanisms.
- windows-kernel-security teaches driver development fundamentals including callback registration and kernel communication patterns.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
gmh5225/awesome-game-security/windows-kernel · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are Windows kernel internals security mechanisms?
windows-kernel-security covers the foundational security architecture of the Windows kernel, including critical structures like EPROCESS and ETHREAD that manage process and thread state. The skill explores enforcement mechanisms such as PatchGuard (which detects kernel modifications), Driver Signature Enforcement (DSE) for validating driver authenticity, and Hypervisor-Enforced Code Integrity (HVCI) for runtime protection. Understanding these mechanisms is essential for security researchers studying kernel-level threats and defenses.
How does PatchGuard bypass relate to kernel security research?
windows-kernel-security examines PatchGuard bypass techniques as part of understanding kernel protection mechanisms. PatchGuard is Microsoft's runtime kernel patch protection that detects unauthorized modifications to critical kernel structures. Studying bypass approaches helps security researchers understand both the limitations of kernel defenses and the sophistication required for advanced kernel-mode attacks. This knowledge is critical for assessing kernel security posture and developing more robust protections.
What driver development and callback concepts does this cover?
windows-kernel-security teaches driver development fundamentals including callback registration and kernel communication patterns. The skill covers kernel callbacks for process, thread, and image events that allow drivers to intercept and respond to system activities. Understanding these mechanisms is essential for building security tools, anti-cheat systems, and kernel-mode monitoring solutions that interact with the Windows kernel through documented interfaces.
What is vulnerable driver exploitation and BYOVD?
windows-kernel-security addresses vulnerable driver exploitation, including Bring Your Own Vulnerable Driver (BYOVD) techniques where attackers load legitimate but flawed drivers to gain kernel access. The skill covers how these drivers can be weaponized for privilege escalation and kernel mode read/write primitives. Understanding this attack vector is vital for researchers studying modern privilege escalation chains and kernel-level threats.
How do hypervisor-based defenses like EPT protect kernel memory?
windows-kernel-security explores hypervisor-based defense mechanisms including Extended Page Tables (EPT) and Virtualization-Based Security (VBS). These technologies enforce memory protection at the hypervisor level, making kernel tampering significantly harder. The skill covers how EPT-level hooks and hypervisor-enforced protections complement kernel-mode defenses, providing defense-in-depth against sophisticated kernel attacks and rootkits.
What symbol resolution and forensic techniques are included?
windows-kernel-security covers Windows kernel symbol walking using dbghelp and related tools for resolving kernel structures dynamically. The skill includes pool tag forensics for driver detection and kernel data protection techniques like secure pool allocation. These techniques are essential for security researchers developing detection tools, analyzing kernel memory forensically, and understanding how modern anti-cheat and security systems identify kernel tampering.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Windows Kernel Security
Overview
This skill covers Windows kernel internals that matter for game security research: object callbacks, process and image notifications, APC behavior, driver loading, trust enforcement, memory manager structures, and the bookkeeping anti-cheats inspect to detect hostile drivers or hidden executable code.
README Coverage
Cheat > PatchGuard-relatedCheat > Driver Signature enforcementCheat > Windows Kernel ExplorerCheat > EFI Driver(cross-reference with game-hacking skill)Cheat > Vulnerable DriverAnti Cheat > Detection:AttachAnti Cheat > Detection:HideAnti Cheat > Detection:Vulnerable DriverAnti Cheat > Detection:Spoof StackAnti Cheat > Windows Ring3 CallbackAnti Cheat > Windows Ring0 Callback- `Anti Cheat > Information System &
(truncated - see the full file via the links below)
File tree — 1 file
.claude/skills/windows-kernel/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn Windows kernel structures and security mechanisms for research”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Explore how modern anti-cheats combine kernel drivers, process monitoring, and behavioral analysis to detect cheating. This skill covers layered detection across memory integrity, handle protection, driver verification, and AI-assisted aimbot analysis, with deep dives into kernel pool scanning and Segment Heap exploitation detection.
This skill guides you through adding and organizing resources in the awesome-game-security collection, a comprehensive curated list spanning offensive and defensive game security topics. It covers anti-cheat systems, Windows internals, DMA attacks, reverse engineering, graphics APIs, and console emulation, with clear category structure and contribution standards to maintain consistency.
Master mobile game security research across Android and iOS platforms. This skill covers APK decompilation, native library analysis, IL2CPP dumping, dynamic instrumentation with Frida, memory manipulation, and modern root solutions like KernelSU and APatch. Learn jailbreak techniques, hooking frameworks, and methods to bypass detection systems.
This skill maps the escalation ladder of game cheat implementations, from user-mode memory reads and DLL injection through kernel drivers to hypervisor and DMA-based attacks. It covers memory manipulation, process injection, hooking, visual exploits (ESP), aim assistance, and AI-vision aimbots that bypass traditional detection. Use it to understand the offensive threat model that anti-cheat systems defend against.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Master graphics API interception across DirectX 9/11/12, OpenGL, and Vulkan to build overlays and analyze render pipelines. Learn VTable hooking techniques, ImGui integration, and shader manipulation for game security research and graphics debugging.
More skills edr-evasion (MIT) · windows-boundaries (MIT) · game-engine-resources (MIT)