Windows Kernel

Windows Kernel

Kernel internals that matter for game protection and low-level research: object/process/image callbacks, APC/attach, driver load forensics (PiDDBCache, MmUnloadedDrivers, pool), DSE/PatchGuard/HVCI, and BYOVD paths.

Key sub-areas

• Structures: EPROCESS/ETHREAD, MMVAD, DRIVER_OBJECT, IRP; SSDT/IDT; pool tables
• Kernel Callbacks: process/thread/image notify, ObRegisterCallbacks, Cm/Flt
• Trust features: DSE, PatchGuard, VBS/HVCI, Secure Boot
• BYOVD: signed vulnerable drivers → kernel R/W → unsigned load / blind AC
• Pool / Segment Heap: HeapKey-aware scanning for hidden modules and shellcode
• Hypervisor defense: EPT-protected callback/ETW/AC pages; WHP research tracing; hacked-hypervisor stress tooling such as vt-debuuger
• EFI: pre-kernel mappers that skip normal driver-load telemetry

Version-specific PatchGuard research (e.g. PG1903 on Win10 1903 via context-page NX manipulation) illustrates how PG bypass studies map to the Demo NX / Cheat PatchGuard README lane.

Related concepts

Kernel Callbacks · BYOVD · HVCI · PatchGuard · PG1903 · vt-debuuger · DMA · Anti-Cheat

README map

Cheat PatchGuard/DSE/Windows Kernel Explorer/Vulnerable Driver; Anti Cheat Ring0 callbacks and detection:attach/hide/vulnerable driver; Windows Security Features; Some Tricks > Windows Ring0.

→ README § Windows Security Features