PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets

github.com | tool | #windows | #red-team | #reverse-engineering | #kernel
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The IUM Debugger is a Windows host-side utility designed to bypass Virtualization-Based Security (VBS) debugging restrictions. By leveraging LiveCloudKd's signed hvmm.sys driver to access guest physical memory from the Hyper-V host, it dynamically patches the debug-permission check in the running guest's live securekernel.exe image, enabling WinDbg to attach to and debug isolated VTL 1 trustlets such as LsaIso.exe and NgcIso.exe.

Why it matters

Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
tool · github.com
ipatool (DrWhax Fork): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration
Significantly streamlines iOS security auditing and reverse engineering by providing an all-in-one CLI and MCP workflow to retrieve App Store packages and decrypt FairPlay binaries for static analysis.
tool · github.com
SuperGhidra: High-Performance Python Suite for Accelerated Ghidra Reverse Engineering
Drastically accelerates automated binary analysis and provides reliable mathematical verification for neural decompilers, bridging traditional reverse engineering with AI-driven workflows.
tool · github.com
KillerLand: Weaponized BYOVD Process Killer Collection Bypassing PPL & EDR Protections
Demonstrates how untrusted kernel IOCTL interfaces in signed OEM and vendor drivers continue to undermine Windows PPL security boundaries, enabling red teams to blind modern endpoint detection.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back