Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Guided tour inside WinDefender’s network inspection driver

blog.quarkslab.com | research | #microsoft | #reverse-engineering | #kernel | #driver | #windows-defender | #wfp

Summary

A reverse engineering tour of Windows Defender's network inspection driver (WdNisDrv), covering its WFP-based design, the security descriptor protecting the device object, and the bugs it revealed.
Published
Collected

original ↗

Related coverage

  1. BYOVD to the next level (part 2) — rootkit like it's 2025 (blog.quarkslab.com)
  2. Windows Filtering Platform: Persistent state under the hood (blog.quarkslab.com)
  3. Introducing a new section on snapshot fuzzing for kernel-level testing in the Testing Handbook (blog.trailofbits.com)
  4. ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch (github.com)
  5. Reversing Windows Container, episode II: Silo to Server Silo (blog.quarkslab.com)
  6. Defeating eBPF Uprobe Monitoring (blog.quarkslab.com)

back