PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reversing Windows Container, episode II: Silo to Server Silo

blog.quarkslab.com | research | #windows | #reverse-engineering | #virtualization | #containers | #kernel | #hcs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Episode two of reversing Windows containers: how the Host Compute Service converts a Silo into a Server Silo, plus kernel-side mechanisms such as syscall limiting inside Silos.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · eshard.com
Fine-tuned Windows scenarios: debugger-assisted recording with WinDbg
Software Security ### Power your investigations with esReverse ✨ Keep your data safe with private LLM. PLATFORM esReverse AI-powered Reverse Engineering TOOLS Time Travel Debugging Epoch SERVICES...
research · eshard.com
Reversing DirtyC0W
We will demonstrate how esReverse can help reverse engineering a kernel bug such as Dirtyc0w.
tool · github.com
IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets
Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.
blog · projectzero.google
Windows Drivers are True’ly Tricky
A bug in the TrueCrypt Windows driver, despite prior security audits, lets a normal user or low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or kernel.
research · blog.quarkslab.com
The IGVM File Format
Quarkslab walks through the IGVM file format, which bundles a VM's BIOS/OVMF, kernel and initrd for secure launch across isolation stacks like AMD SEV-SNP and Intel TDX.
Back