Tag
HackSys Extreme Vulnerable Driver (HEVD) is an intentionally vulnerable Windows kernel driver for learning kernel exploitation techniques, including use-after-free, stack overflows, and pool overflows. The tweet notes that a UAF exploit has been completed.
The article describes nanokrnl, a 64-bit Windows kernel written in Rust, and nanox, a 65KB WebAssembly emulator that boots it directly in long mode in a browser, achieving a running OS in about four megabytes.
This article from Microsoft's Old New Thing blog explains the rationale behind best practices for Windows kernel callback functions, particularly why blocking or waiting on work items defeats their purpose, using a cautionary tale about drivers causing system hangs.