PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Guided tour inside WinDefender’s network inspection driver

blog.quarkslab.com | research | #microsoft | #reverse-engineering | #kernel | #driver | #windows-defender | #wfp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A reverse engineering tour of Windows Defender's network inspection driver (WdNisDrv), covering its WFP-based design, the security descriptor protecting the device object, and the bugs it revealed.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · eshard.com
Fine-tuned Windows scenarios: debugger-assisted recording with WinDbg
Software Security ### Power your investigations with esReverse ✨ Keep your data safe with private LLM. PLATFORM esReverse AI-powered Reverse Engineering TOOLS Time Travel Debugging Epoch SERVICES...
research · eshard.com
Reversing DirtyC0W
We will demonstrate how esReverse can help reverse engineering a kernel bug such as Dirtyc0w.
High · vulnerability · github.com
ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch
Highlights an incomplete patch in Microsoft Defender's scanning engine, allowing local unprivileged users to weaponize antivirus file inspection routines for SYSTEM-level file access.
research · blog.quarkslab.com
BYOVD to the next level (part 2) — rootkit like it's 2025
Part two of Quarkslab's BYOVD series: using read/write primitives from a vulnerable driver to reflectively load an unsigned driver from memory and bypass Windows Driver Signature Enforcement.
research · blog.quarkslab.com
Windows Filtering Platform: Persistent state under the hood
How the Windows Filtering Platform persists its firewall state: decoding the GUID-named registry blobs of the BFE service and the interplay between user-mode and kernel-mode filter engines.
Back