Igor Korkin's repositories
MemoryRanger
MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.
HypervisorsDetection
This is the first software system, which can detect a stealthy hypervisor and calculate several nested ones even under countermeasures.
MemAttacker
This project demonstares an illegal read- and write- access to the kernel-mode data for both allocated by 3rd party drivers and EPROCESS structures
AllMemProTestBed
Legal access: The driver and console app to demonstrate the basic memory access in kernel mode
MemAllocator
This project demonstrates allocation and legal access to the allocated data in the kernel mode.
AllMemProTestBedPatcher
Illegal access: the driver and console app to demo unauthorized read- and write- access to the kernel-mode memory
testbed
This project demonstrates the privilege escalation for a user-mode process - cmd.exe using stack overflow in the kernel mode driver. The user-mode component 'testbed_console.exe' sends CTL_CODE with a payload to the vulnerable driver 'testbed_driver.sys', which call RtlCopyMemory without any checks. 'testbed_console.exe' includes 'testbed_driver.sys' has a resource.
MemoryGuardConsole
This code demonstrates the memory guard idea, which prevents unauthority access from one driver to another and allows all legitimate accesses.
awesome-virtualization
Collection of resources about Virtualization
github-slideshow
A robot powered training repository :robot:
Perceptron
A small demo project to learn ML & AI
SpecuCheck
SpecuCheck is a Windows utility for checking the state of the software mitigations against CVE-2017-5754 (Meltdown) and hardware mitigations against CVE-2017-5715 (Spectre)