windows ETW tracing part 2

windows WPP tracing

Windows 10 x64 - VMware Workstation 2022-05-23 09-30-53

利用CVE-2023-36802修改clfs container对象的地址来进行提权

Windows 10 x64 - VMware Workstation 2022-05-23 11-07-41

Video_2024-04-27_172830

Windows DSE bypass演示--MinifilterPort

cve-2022-37969 clfs漏洞利用

Record_2022_07_21_22_41_42_411

Video_2024-04-27_024029

windows XP内核调试

泄露进程句柄扫描

Windows DSE bypass演示--DeviceIOControl

Video_2024-04-27_165015

etw session keyword filter demo

Video_2024-04-28_005652

fs minifilter demo

UserModeHookHelper instant patch功能演示

三分钟重装系统

驱动和用户模式的应用程序使用Port进行通信