Code Execution Inside PID 0

Achieving kernel-level code execution in the System Idle Process by hooking power management routines in nt!PoIdle.

https://archie-osu.github.io/2025/04/13/powerhook.html

#KernelExploitation #WindowsInternals

Code execution inside PID 0

A few days ago, a seemingly random thought came up in the back of my mind. On every system, thereโ€™s a process whose Process ID is 0. This process is called the System Idle Process, and contains threads that execute when no other thread is ready to run on a given processor.

Archieโ€™s reversing diary

Exciting news! ๐Ÿš€ Our comprehensive Windows Kernel Exploitation Foundation and Advanced class will be conducted @_ringzer0! This intensive course combines the essentials of both Foundation and Advanced levels, guiding you through the process of kernel exploitation. From exploiting bugs in Windows kernel mode drivers to bypassing advanced exploit mitigations, gain hands-on experience in a wide range of critical topics. ๐Ÿ› ๏ธ๐Ÿ–ฅ๏ธ

๐Ÿ“… Week 1: Feb 10-17, 2024
๐Ÿ“ Virtual Training
๐Ÿ•’ 32 CPE Hours

Key Learning Objectives:

* Understand Windows kernel debugging and internals
* Master exploit development techniques in kernel mode
* Bypass advanced exploit mitigations like kASLR, SMEP, and KPTI/KVA Shadow
* Develop Arbitrary Read/Write primitives

Who should attend?

* InfoSec professionals
* Bug hunters & Red teamers
* Windows exploit & driver developers
* Ethical hackers looking to upgrade to kernel level

๐ŸŒŸ Course culminates in a CTF challenge where you can apply your newly acquired skills!

https://ringzer0.training/trainings/windows-kernel-exploitation.html

#WKE #WindowsKernel #Exploitation #Training #ring0 #InfoSec #CyberSecurity #KernelExploitation

Ringzer0 - Windows Kernel Exploitation - Foundation and Advanced

Participants will gain hands-on experience in a wide range of topics, including Windows and driver internals, various memory corruption types, exploit development techniques, mitigation bypass techniques, pool internals, and Feng-Shui. The course culminates in a CTF challenge, allowing participants to apply their newly acquired skills.

GitHub - kiks7/CVE-2022-2602-Kernel-Exploit

Contribute to kiks7/CVE-2022-2602-Kernel-Exploit development by creating an account on GitHub.

GitHub
Exploiting CVE-2022-42703 - Bringing back the stack attack

Seth Jenkins, Project Zero This blog post details an exploit for CVE-2022-42703 (P0 issue 2351 - Fixed 5 September 2022), a bug Jann Horn ...

Hooking System Calls in Windows 11 22H2 like Avast Antivirus. Research, analysis and bypass

0x00: Introduction

the-deniss.github.io