---
id: 8676
title: "Windows Exploitation Tricks: Abusing the User-Mode Debugger"
source_domain: projectzero.google
source_url: "https://projectzero.google/2019/04/windows-exploitation-tricks-abusing.html"
published_at: "2019-04-16T00:00:00Z"
tags: ["windows", "debugger", "project-zero", "ntobjectmanager"]
phying_url: "https://phying.com/item/8676"
lang: en
---

# Windows Exploitation Tricks: Abusing the User-Mode Debugger

## Summary

I've recently been adding native user-mode debugger support to NtObjectManager. Whenever I add new functionality I have to do some research and reverse engineering to better understand how it works. In this case I wondered what access you need to debug an existing running process and through that noticed an interesting security mismatch between what the user-mode APIs expose and what the kernel actually does which I thought would be interesting to document. What I’ll describe is not a security vulnerability, but it is useful for exploiting certain classes of bugs, which is why it fits in my series on exploitation tricks.

## Intelligence Metadata

- **Sources:** projectzero.google
- **Published:** 2019-04-16T00:00:00Z
- **Original:** https://projectzero.google/2019/04/windows-exploitation-tricks-abusing.html
- **Phying News:** https://phying.com/item/8676