Windows Exploitation Tricks: Trapping Virtual Memory Access

projectzero.google | blog | #exploit | #vulnerability | #security-research

Summary

.post-body{.lst-kix_rewf8lfzymzq-6>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-6}ol.lst-kix_rewf8lfzymzq-4.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-4 0}.lst-kix_rewf8lfzymzq-0>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-0}.lst-kix_rewf8lfzymzq-7>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-7,lower-latin) ". "}.lst-kix_rewf8lfzymzq-8>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-8,lower-roman) ". "}.lst-kix_fmvhww8n3gvt-6>li:before{content:"\0025cf "}.lst-kix_fmvhww8n3gvt-5>li:before{content:"\0025a0 "}.lst-kix_fmvhww8n3gvt-7>li:before{content:"\0025cb "}ol.lst-kix_rewf8lfzymzq-1.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-1 0}.lst-kix_fmvhww8n3gvt-4>li:before{content:"\0025cb "}.lst-kix_fmvhww8n3gvt-8>li:before{content:"\0025a0 "}ol.lst-kix_rewf8lfzymzq-8.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-8 0}.lst-kix_2duiues326zm-1>li:before{content:"\0025cb "}.lst-kix_2duiues326zm-0>li:before{content:"\0025cf "}ol.lst-kix_rewf8lfzymzq-4{list-style-type:none}ol.lst-kix_rewf8lfzymzq-0.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-0 0}ol.lst-kix_rewf8lfzymzq-5{list-style-type:none}ol.lst-kix_rewf8lfzymzq-2{list-style-type:none}ol.lst-kix_rewf8lfzymzq-3{list-style-type:none}ol.lst-kix_rewf8lfzymzq-8{list-style-type:none}ol.lst-kix_rewf8lfzymzq-6{list-style-type:none}.lst-kix_rewf8lfzymzq-7>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-7}ol.lst-kix_rewf8lfzymzq-7{list-style-type:none}ol.lst-kix_rewf8lfzymzq-0{list-style-type:none}ol.lst-kix_rewf8lfzymzq-1{list-style-type:none}.lst-kix_rewf8lfzymzq-1>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-1}.lst-kix_rewf8lfzymzq-4>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-4}ul.lst-kix_fmvhww8n3gvt-8{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-7{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-6{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-5{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-4{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-3{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-2{list-style-type:none}ul.lst-kix_fmvhww8n3gvt-1{list-style-type:none}ol.lst-kix_rewf8lfzymzq-7.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-7 0}ul.lst-kix_fmvhww8n3gvt-0{list-style-type:none}.lst-kix_rewf8lfzymzq-3>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-3}ul.lst-kix_2duiues326zm-8{list-style-type:none}ul.lst-kix_2duiues326zm-7{list-style-type:none}ul.lst-kix_2duiues326zm-6{list-style-type:none}ul.lst-kix_2duiues326zm-5{list-style-type:none}ul.lst-kix_2duiues326zm-4{list-style-type:none}ul.lst-kix_2duiues326zm-3{list-style-type:none}ol.lst-kix_rewf8lfzymzq-6.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-6 0}ul.lst-kix_2duiues326zm-2{list-style-type:none}ul.lst-kix_2duiues326zm-1{list-style-type:none}ul.lst-kix_2duiues326zm-0{list-style-type:none}ol.lst-kix_rewf8lfzymzq-3.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-3 0}.lst-kix_2duiues326zm-2>li:before{content:"\0025a0 "}.lst-kix_2duiues326zm-3>li:before{content:"\0025cf "}.lst-kix_fmvhww8n3gvt-0>li:before{content:"\0025cf "}.lst-kix_2duiues326zm-4>li:before{content:"\0025cb "}.lst-kix_2duiues326zm-5>li:before{content:"\0025a0 "}.lst-kix_fmvhww8n3gvt-2>li:before{content:"\0025a0 "}.lst-kix_rewf8lfzymzq-2>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-2}.lst-kix_fmvhww8n3gvt-1>li:before{content:"\0025cb "}.lst-kix_fmvhww8n3gvt-3>li:before{content:"\0025cf "}.lst-kix_rewf8lfzymzq-1>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-1,lower-latin) ") "}ol.lst-kix_rewf8lfzymzq-5.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-5 0}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_2duiues326zm-6>li:before{content:"\0025cf "}.lst-kix_rewf8lfzymzq-0>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-0,decimal) ") "}.lst-kix_rewf8lfzymzq-5>li:before{content:"(" counter(lst-ctn-kix_rewf8lfzymzq-5,lower-roman) ") "}.lst-kix_2duiues326zm-7>li:before{content:"\0025cb "}.lst-kix_rewf8lfzymzq-8>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-8}.lst-kix_rewf8lfzymzq-5>li{counter-increment:lst-ctn-kix_rewf8lfzymzq-5}.lst-kix_2duiues326zm-8>li:before{content:"\0025a0 "}.lst-kix_rewf8lfzymzq-6>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-6,decimal) ". "}.lst-kix_rewf8lfzymzq-2>li:before{content:"" counter(lst-ctn-kix_rewf8lfzymzq-2,lower-roman) ") "}.lst-kix_rewf8lfzymzq-3>li:before{content:"(" counter(lst-ctn-kix_rewf8lfzymzq-3,decimal) ") "}ol.lst-kix_rewf8lfzymzq-2.start{counter-reset:lst-ctn-kix_rewf8lfzymzq-2 0}.lst-kix_rewf8lfzymzq-4>li:before{content:"(" counter(lst-ctn-kix_rewf8lfzymzq-4,lower-latin) ") "}ol{margin:0;padding:0}table td,table th{padding:0}.c23{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:210pt;border-top-color:#000000;border-bottom-style:solid}.c34{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:123.8pt;border-top-color:#000000;border-bottom-style:solid}.c10{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c2{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:135.8pt;border-top-color:#000000;border-bottom-style:solid}.c37{-webkit-text-decoration-skip:none;color:#000000;font-weight:400;text-decoration:line-through;vertical-align:baseline;text-decoration-skip-ink:none;font-size:11pt;font-family:"Arial";font-style:normal}.c44{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c4{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c47{padding-top:16pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c31{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c3{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:10pt;font-family:"Courier New";font-style:normal}.c36{color:#434343;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:14pt;font-family:"Arial";font-style:normal}.c26{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c39{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-family:"Arial";font-style:normal}.c6{padding-top:0pt;padding-bottom:0pt;line-height:1.500000000000001;orphans:2;widows:2;text-align:left}.c11{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c5{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c16{font-size:10pt;font-family:"Courier New";color:#000080;font-weight:400}.c8{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c14{font-size:10pt;font-family:"Courier New";color:#0000ff;font-weight:400}.c15{border-spacing:0;border-collapse:collapse;margin-right:auto}.c27{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c45{text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c12{font-size:10pt;font-family:"Courier New";color:#800080;font-weight:400}.c9{font-family:"Courier New";color:#3c78d8;font-weight:400}.c32{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c38{-webkit-text-decoration-skip:none;text-decoration:underline;text-decoration-skip-ink:none}.c29{border:1px solid black;margin:5px}.c17{font-weight:400;font-family:"Courier New"}.c18{font-size:10pt;color:#a82d00}.c22{font-size:10pt;color:#696969}.c21{font-weight:700;font-family:"Courier New"}.c20{color:inherit;text-decoration:inherit}.c19{padding:0;margin:0}.c33{margin-left:36pt;padding-left:0pt}.c41{color:#a31515}.c28{background-color:#e69138}.c24{background-color:#f6b26b}.c35{color:#8b0000}.c1{font-style:italic}.c7{height:11pt}.c43{color:#8a2be2}.c46{color:#3c78d8}.c13{height:0pt}.c42{background-color:#d9d9d9}.c40{background-color:#6aa84f}.c30{color:#6aa84f}.c25{font-size:10pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}Posted by James Forshaw, Project Zero

Published: 2021-01-21 00:00
Collected: 2026-09-22 23:23

original ↗

Related coverage

back