Abstract

This is a modern and edge-class, which is planned and organized to be a natural sequence from previous courses such as Windows Exploit Development 1 and 2, Secure Code and Professional Fuzzing for Vulnerability Research, and aims to provide attendees key concepts, architecture, details and practical techniques for vulnerability research on kernel drivers as well as providing attendees a solid explanation on the involved architecture. Finally, and mostly important, this course aims to provide students with practical techniques about kernel vulnerability research and exploit development.

No doubt, kernel vulnerability research and exploit development is one of most interesting and hard topics in the current days mainly due to associated complexity of concepts as well as the required skills to be applied over the process.

This training will presents a solid theoretical explanation and intensive practical explanation over many sections. At the start attendees will learn how to setup the necessary environment to attend the training, including details that are time-consuming for students due to amount of involved details and tools.

At the first part attendees will learn about Windows 11 Memory Management and as well as the instructor will offer explanation about topics such as Patch Diffing, Windows Internals basic concepts, kernel and minifilter drivers structure. The main part of the training consist of the practical development of exploits for n-day vulnerabilities, where all necessary Windows internals foundations and exploit techniques will presented to students.

This class is focused on Windows operating system.

Attention: this is an intensive course.

Who Should Attend

This class was carefully planned and organized for professionals interested in learning about how to research for vulnerabilities in Windows operating system as well as to learn involved concepts, foundations and required techniques over the process. Class attendees from different areas such as vulnerability research, reverse engineering, programming, exploit development, malware analysis, incident response, threat hunting, pentesting and cyber defense will enjoy and benefit from this training.

Key Learning Objectives

This class has the following goals:

  • Explain how to setup a Windows vulnerability lab.
  • Explain Patch Diffing in depth.
  • Explain Windows 10/11 memory management architecture.
  • Explain Windows 10/11 kernel drivers.
  • Explain Windows 10/11 mini-filter drivers.
  • Provide full practical procedure on how to write N-Day Exploits

Prerequisite Knowledge

Class attendees should be able to:

  • Handle and compile simple programs on Visual Studio and/or Visual Studio Code.
  • Write, read and interpret short pieces of code in C/C++.
  • Use disassemblers and decompilers like IDA Pro.
  • Debug programmings using WinDbg.
  • Programming skills can be very useful for this course.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running: Windows 11 x64 with 100 GB free filesystem and 4 GB RAM (minimum).
  • One virtual machine running Ubuntu 24.04+ with 100 GB free filesystem and 4 GB RAM (minimum).
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.
  • Visual Studio Code installed on all virtual machines.
  • IDA Pro or IDA Free.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Introduction.
  • Lab Setup.
  • Patch Diffing.
  • Windows Internals Concepts.
  • Windows 10/11 Memory Management.
  • Windows Kernel and Minifilter drivers.
  • Writing N-Day Exploits: Practical Exploit Development

Note: Topics can be added, merged or removed without prior notice!