windows-kernel-security

Explore Windows kernel internals essential for security research, covering critical structures like EPROCESS and ETHREAD, callback systems, and enforcement mechanisms including PatchGuard, Driver Signature Enforcement, and Hypervisor-Enforced Code Integrity. Learn symbol resolution techniques, driver development patterns, and how anti-cheat systems detect kernel tampering.

windows-kernel-security teaches kernel internals, callback mechanisms, and security features like PatchGuard and HVCI for low-level research.

AI-generated summary based on this skill's SKILL.md

★ 3,261 ⁮ 458 MIT updated 2026-07-28 by gmh5225

Install

gmh5225/awesome-game-security/windows-kernel · repository language: Python

Manual (git clone) CLI (skillfed)

git clone https://github.com/gmh5225/awesome-game-security
cp -r awesome-game-security/.claude/skills/windows-kernel ~/.claude/skills/windows-kernel

npx skillfed install gmh5225/awesome-game-security/windows-kernel

Frequently asked questions

AI-generated answers based on this skill's SKILL.md and metadata

What are Windows kernel internals security mechanisms?

windows-kernel-security covers the foundational security architecture of the Windows kernel, including critical structures like EPROCESS and ETHREAD that manage process and thread state. The skill explores enforcement mechanisms such as PatchGuard (which detects kernel modifications), Driver Signature Enforcement (DSE) for validating driver authenticity, and Hypervisor-Enforced Code Integrity (HVCI) for runtime protection. Understanding these mechanisms is essential for security researchers studying kernel-level threats and defenses.

How does PatchGuard bypass relate to kernel security research?

windows-kernel-security examines PatchGuard bypass techniques as part of understanding kernel protection mechanisms. PatchGuard is Microsoft's runtime kernel patch protection that detects unauthorized modifications to critical kernel structures. Studying bypass approaches helps security researchers understand both the limitations of kernel defenses and the sophistication required for advanced kernel-mode attacks. This knowledge is critical for assessing kernel security posture and developing more robust protections.

What driver development and callback concepts does this cover?

windows-kernel-security teaches driver development fundamentals including callback registration and kernel communication patterns. The skill covers kernel callbacks for process, thread, and image events that allow drivers to intercept and respond to system activities. Understanding these mechanisms is essential for building security tools, anti-cheat systems, and kernel-mode monitoring solutions that interact with the Windows kernel through documented interfaces.

What is vulnerable driver exploitation and BYOVD?

windows-kernel-security addresses vulnerable driver exploitation, including Bring Your Own Vulnerable Driver (BYOVD) techniques where attackers load legitimate but flawed drivers to gain kernel access. The skill covers how these drivers can be weaponized for privilege escalation and kernel mode read/write primitives. Understanding this attack vector is vital for researchers studying modern privilege escalation chains and kernel-level threats.

How do hypervisor-based defenses like EPT protect kernel memory?

windows-kernel-security explores hypervisor-based defense mechanisms including Extended Page Tables (EPT) and Virtualization-Based Security (VBS). These technologies enforce memory protection at the hypervisor level, making kernel tampering significantly harder. The skill covers how EPT-level hooks and hypervisor-enforced protections complement kernel-mode defenses, providing defense-in-depth against sophisticated kernel attacks and rootkits.

What symbol resolution and forensic techniques are included?

windows-kernel-security covers Windows kernel symbol walking using dbghelp and related tools for resolving kernel structures dynamically. The skill includes pool tag forensics for driver detection and kernel data protection techniques like secure pool allocation. These techniques are essential for security researchers developing detection tools, analyzing kernel memory forensically, and understanding how modern anti-cheat and security systems identify kernel tampering.

SKILL.md

rendered from the published skill — quoted content, verbatim