Currently I'm reading about the Windows API's like CreateProcess and others.

Also I took a look into the Source of the Powershell Script which used the MS16-032 vulnerability.

My Question is: Which ways can you take to find such vulnerabilities in the API's or general to find things like this?

I watched Videos about Windows Kernel vulnerabilities, but can't find any good Documentation where this is described.



understand how the Windows native API works, e.g. something like (and probably not accurate): ZwCreateProcess -> NTCreateProcess -> CreateProcess https://undocumented.ntinternals.net/ https://www.google.com/shopping/product/10794697035904501181?q=native+api+book&biw=1486&bih=811&sa=X&ved=0ahUKEwjFzNPlkLLWAhVkJcAKHdwGDRYQ8wIIgwMwAA

Windows Internals: https://www.amazon.com/Windows-2000-Native-API-Reference/dp/1578701996

You'll also want to know x86/x64 calling conventions (STDcall), e.g. how arguments are passed and return values.

Last, what the OS expects and how the return values are used.


Uninformed.org has a good writeup: http://uninformed.org/index.cgi?v=10&a=2

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.