The complete C++ source code and exploit scripts are available in the project repository: HEVD-Exploits. This series is built on top of the HackSys Extreme Vulnerable Driver (HEVD) running on modern x64 Windows 11 (26200.8328).

Welcome to a four-part deep dive into Windows kernel exploitation. In this series, I’ll explore the evolution of Ring 0 exploitation techniques, tracing the shift from legacy execution hijacking primitives to modern Data-Only Attacks.

This series documents the step-by-step development of kernel primitives, taking you from simple stack corruption to advanced heap grooming on modern Windows 11:

• Part 1: Stack Buffer Overflow: Explore the fundamentals of kernel stack corruption. I’ll be bypassing Supervisor Mode Execution Prevention (SMEP) with a CR4-flipping ROP chain, steal the SYSTEM token via Direct Kernel Object Manipulation (DKOM), and calculate precise stack deltas to restore execution context and prevent kernel panics.
• Part 2: Arbitrary Write: Move from buffer overflows to a Write-What-Where primitive. Facing register volatility across kernel call stacks, I’ll orchestrate a stack pivot into a 32-bit mapped fake stack and dynamically reconstruct the legitimate kernel stack using _KTHREAD’s InitialStack anchor.
• Part 3: Kernel Pool Grooming: Abandon execution hijacking entirely in favor of pure Data-Only attacks. Facing modern Windows 11 mitigations that strip kernel pointer leaks, I’ll exploit an out-of-bounds pool read, pivot to NonPagedPoolNx using Named Pipes.
• Part 4: Weaponizing npfs.sys: Mathematically resolve absolute kernel addresses using double-pipe grooming. By forging unbuffered IRP structures, avoiding IoCompleteRequest crashes via PeekNamedPipe, and parsing ntoskrnl.exe PE exports to perform an _EPROCESS token swap, I’ll be able to achieve a stable Local Privilege Escalation.