LPE vulnerabilities exploitation on Windows 10 Anniversary Update
Win10LPE
Win10LPE
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Allocati<strong>on</strong> of GDI and USER objects<br />
• USER objects (window, dde c<strong>on</strong>v, hook, menu…):<br />
1. Allocated by HMAllocObject.<br />
2. Can be allocated <strong>on</strong> Desktop heap, Shared heap, PagedSessi<strong>on</strong>Pool (33)<br />
or PagedSessi<strong>on</strong>Pool|POOL_QUOTA_FAIL_INSTEAD_OF_RAISE (41)<br />
depending <strong>on</strong> object type.<br />
3. We can read Desktop heap from usermode.<br />
• GDI objects (bitmap, brush, pen…):<br />
1. Allocated by HmgAlloc.<br />
2. Can be allocated from PagedSessi<strong>on</strong>Pool. Also, there are lookaside lists<br />
with previously allocated blocks.<br />
3. On the next slides we’ll reference PagedSessi<strong>on</strong>Pool as GDI pool.