https://iamleandrooooo.github.io/tags/decompiler-artifact/ Recent content in Decompiler-Artifact on Leandro's Code Cave Hugo en-us Fri, 10 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-arbitrary-kernel-read-that-wasnt/ Fri, 10 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-arbitrary-kernel-read-that-wasnt/ 1. Why the console driver is an attack surface at all condrv.sys is the Console Driver. Since the Windows 7-era console rewrite (and especially post-Windows 10, when the console host moved out of csrss into conhost.exe), condrv is the kernel broker sitting between a console client (your cmd.exe, your powershell.exe - anything with a console) and a console server (conhost.exe). Every ReadConsole, WriteConsole, and the whole console-handle machinery is marshalled through it.