Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Deep Dive into the GetProcessHandleFromHwnd API

projectzero.google | research | #windows | #uac-bypass | #google-project-zero | #getprocesshandlefromhwnd | #api-analysis

Summary

A Google Project Zero deep dive into the Windows GetProcessHandleFromHwnd API and its security implications.
Published
Collected

original ↗

Related coverage

research · projectzero.google
Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
Part two of a Google Project Zero macOS series, exploiting the CVE-2024-54529 type confusion vulnerability in the coreaudiod daemon found via knowledge-driven fuzzing.
research · projectzero.google
[CVE-2014-3196] Did the “Man With No Name” Feel Insecure?
A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.
blog · projectzero.google
Testing race conditions with memory access tracing and stack-based delay injection
A Google Project Zero write-up describing a technique for testing race conditions using memory access tracing and stack-based delay injection.
blog · projectzero.google
A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
A Google Project Zero post describing an attempt to build a zero-click exploit chain to root for the Pixel 10, following their earlier two-exploit Pixel 9 chain.
blog · projectzero.google
On the Effectiveness of Mutational Grammar Fuzzing
A Google Project Zero study examining how effective mutational grammar-based fuzzing is at finding software vulnerabilities.
blog · projectzero.google
Bypassing Administrator Protection by Abusing UI Access
A Google Project Zero post detailing a bypass of Windows' Administrator Protection feature through abuse of UI Access, one of nine bypasses found and fixed.
back