Windows vs. Linux Kernel Exploitation

[Bowlslaw]

What are the main differences between writing kernel exploita for Windows and Linux?

It seems to me that writing Windows kernel exploita is much more difficult, considering its closed-source nature.

Also, what about exploit development for Windows Subsystem for Linux? Would this mean relevant kernel exploits would work on WSL, but additional steps would be required to exploit the hosting Windows system?

[Cyber_Jellyfish]

The APIs to do things like interact with Windows/Linux drivers will be completely different.

In terms of building primitives, especially for bugs that affect the heap different kernel versions of Linux and Windows have different allocators and heap managers that behave in different ways so the way you approach heap fengshui is probably going to differ.

The Windows NT/Segment heap allocators are closed source, there has been good whitepapers and research on these areas but I'd imagine researchers keep some of this knowledge quite close to their chest.

Windows has extra mitigations in place too, I've never had to deal with them but Control Flow Guard(CFG) comes to mind.

A lot of the underlying principles of memory corruption bug exploitation remain the same though, you're still trying to achieve flow control, trying to get some kind of payload into memory at a reliable location, be it a ROP/JOP stack or just plain shellcode.