LPE vulnerabilities exploitation on Windows 10 Anniversary Update
Win10LPE
Win10LPE
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Desktop heap<br />
• Desktop heap is created with Desktop object.<br />
• Desktop heap is mapped into GUI process address space.<br />
• Desktop heap c<strong>on</strong>tains some USER objects and structures.<br />
• We can get user mode mapping of kernel mode address (located <strong>on</strong><br />
desktop heap) by simple calculati<strong>on</strong><br />
UserModeAddress = KernelModeAddress – TEB.Win32ClientInfo.ulClientDelta<br />
• Some <strong>Windows</strong> API are using this feature to avoid entering to kernel when<br />
reading structures.