https://iamleandrooooo.github.io/tags/kernel/ Recent content in Kernel on Leandro's Code Cave Hugo en-us Wed, 29 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/five_ghosts_in_ring_zero/ Wed, 29 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/five_ghosts_in_ring_zero/ There is a version of vulnerability research that reads like archaeology with a kill chain at the end. You find the unchecked multiply. You recover the IOCTL. You draw the structure. You name the primitive. You write the report. Microsoft assigns the case, the case becomes a CVE, and the write-up begins with the satisfying sentence: I found a bug. This is not that write-up. This is about five times I found code that was absolutely wrong and a vulnerability that absolutely was not there. https://iamleandrooooo.github.io/posts/the-arbitrary-kernel-read-that-wasnt/ Fri, 10 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-arbitrary-kernel-read-that-wasnt/ 1. Why the console driver is an attack surface at all condrv.sys is the Console Driver. Since the Windows 7-era console rewrite (and especially post-Windows 10, when the console host moved out of csrss into conhost.exe), condrv is the kernel broker sitting between a console client (your cmd.exe, your powershell.exe - anything with a console) and a console server (conhost.exe). Every ReadConsole, WriteConsole, and the whole console-handle machinery is marshalled through it. https://iamleandrooooo.github.io/posts/the-broker-that-rechecks-access/ Wed, 08 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-broker-that-rechecks-access/ 1. What a file broker is, and why it is a sandbox-escape target An AppContainer (or otherwise sandboxed) process cannot touch the filesystem directly - its token carries a restricted capability set, and the object manager denies it any FILE object outside that set. To do legitimate file work it has to ask a broker: a more-privileged component that performs the operation on the sandbox’s behalf and hands back the result.