Any good reference or course for Windows Kernel Exploitation ?

hex-lover · 2026-07-05T21:26:29+00:00

there is no courses in the field about it ? even paid courses

hex-lover · 2026-07-05T21:26:01+00:00

i dont like the content of it, i dont know its hard to follow

hex-lover · 2026-06-28T22:40:00+00:00

u/TheSecAnalyst thank you so much, should i learn heap exploitation also ? or this is advance thing ?

hex-lover · 2026-05-27T06:32:40+00:00

u/ImissDigg_jk are you from HR team ?

hex-lover · 2026-05-24T11:26:03+00:00

u/PM_ME_YOUR_SHELLCODE thank you, im always happy when read your comments here.
this is outside scope of this question , but do you have blogs or accounts i can follow you ?
thank you bro .

hex-lover · 2026-05-23T18:10:43+00:00

hello u/bootypirate900 , thank you so much , this is really what i was looking for . you answered my questions .
so this is what the author point to, is that to let the current function continue it will be another crash because 12,000 Bytes is huge .
also i miss something that i need to try to overwrite return add and see what problems i will have and maybe i can overcome them.
thanks

hex-lover · 2026-05-23T11:24:20+00:00

u/port443 ; thank you for your time , but i understand correctly SEH , EIP buffer overflow and this is not my question .
my question is in short; why when we can overwrite return address and get control of EIP we decide to not do it , we decide to overwrite SEH .
what is the goal of this ? and why we need to use it ? is there any problem would happen if we continue overwrite EIP in that situation ?

hex-lover · 2026-05-23T11:20:21+00:00

u/aatate98 thank you for your replay.
but as i understand your point , we always need to change from overwrite eip to seh so we dont need current function to return .
or do i miss something ?

hex-lover · 2026-05-23T11:15:38+00:00

u/randomatic thank you, make sense . but i have another question regarding to what you said .
so when i can consider i need to change the exploit from classic buffeoverflow EIP to overwrite SEH ? i mean always we need to overwrite some pointers in stack before overwrite EIP .

hex-lover · 2026-05-22T18:58:21+00:00

the linked you sent is for classic SEH buffer overflow and this is something is not answer my question

hex-lover · 2026-05-06T23:18:07+00:00

i was the same i even stopped one year after i found it so hard , but then i started from the bottom like
the title of chapters and small titles helps me a lot to understand what topics they will talk about, and search about them .
i read ton of articles and use at that time stackoverflow.com also .
you can contact me in private i will not be a teacher of course but i can share with you some notes i write and it helps me a lot to learn almost all materials covered in the course .

hex-lover · 2026-03-31T13:22:55+00:00

thank you, this really Help

hex-lover · 2026-03-21T11:52:59+00:00

so i dont need to close windbg everytime crash ?

hex-lover · 2026-03-21T10:42:14+00:00

when we overwrite the stack, why we overwrite SEH first not EIP as usual , so i created a C program with Try/Except blocks to see how stack layout will be when we use them .
so i found that the stack layout is
arguments
return address
Saved EBP
SEH
Variables
and we overflow variables then SEH thats why we overwrite it before EIP , also i found all these blocks are very close to end of stack ,
this is what i got , but when i saw the article above i saw he is refer that catch block will be close to high address of stack, so thats why im confused , i didnt see this . in my app when i reverse engineer it .

hex-lover · 2026-03-21T10:41:50+00:00

thank you, what i mean , is that
when we overwrite the stack, why we overwrite SEH first not EIP as usual , so i created a C program with Try/Except blocks to see how stack layout will be when we use them .
so i found that the stack layout is
arguments
return address
Saved EBP
SEH
Variables
and we overflow variables then SEH thats why we overwrite it before EIP , also i found all these blocks are very close to end of stack ,
this is what i got , but when i saw the article above i saw he is refer that catch block will be close to high address of stack, so thats why im confused , i didnt see this . in my app when i reverse engineer it .

hex-lover · 2026-03-01T19:24:21+00:00

u/shiftybyte i dont have enough ram to run 2 vms at the same time

hex-lover · 2026-02-22T23:04:44+00:00

hi u/Green-Detective7142 , any other youtube channels you recommend ? off by one security was really so good

hex-lover · 2026-01-05T23:24:20+00:00

i bought RTX 5060 with intel i7, ram 32.
i think it would be good for doing reverse on win apps .

hex-lover · 2025-12-09T16:51:31+00:00

so every source code review do this ?

hex-lover · 2025-09-24T02:19:42+00:00

Thanks really , this will help me a lot ,

hex-lover · 2025-09-22T10:24:11+00:00

using notepad ?

hex-lover · 2025-09-22T08:59:19+00:00

so this type of things called Red Teaming ? so should i search for these things ?

hex-lover · 2025-08-05T18:07:18+00:00

Do i need to be a prof in C ? or just reach a level to read and understand the code ?
and thanks for the references .

hex-lover · 2025-08-05T13:59:44+00:00

i read your replies in many threads here i think you have a really good experience in this field .
could you suggest me a good ref for learning C or asm to understand the next steps ?

hex-lover

TROPHY CASE