IgorKorkin
An expert in digital security, full of passion and curiosity. My passion is cybersecurity researcher of advanced protection technologies and their limitations.
Pinned Repositories
AllMemPro
AllMemPro
AllMemProTestBed
Legal access: The driver and console app to demonstrate the basic memory access in kernel mode
AllMemProTestBedPatcher
Illegal access: the driver and console app to demo unauthorized read- and write- access to the kernel-mode memory
HypervisorsDetection
This is the first software system, which can detect a stealthy hypervisor and calculate several nested ones even under countermeasures.
MemAllocator
This project demonstrates allocation and legal access to the allocated data in the kernel mode.
MemAttacker
This project demonstares an illegal read- and write- access to the kernel-mode data for both allocated by 3rd party drivers and EPROCESS structures
MemoryRanger
MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.
PPL
The demo of RtlTestProtectedAccess() and RtlProtectedAccess involved in creation Protected Process.
research
The section includes all the information about my research result: papers, slides, speeches, etc.
testbed
This project demonstrates the privilege escalation for a user-mode process - cmd.exe using stack overflow in the kernel mode driver. The user-mode component 'testbed_console.exe' sends CTL_CODE with a payload to the vulnerable driver 'testbed_driver.sys', which call RtlCopyMemory without any checks. 'testbed_console.exe' includes 'testbed_driver.sys' has a resource.
IgorKorkin's Repositories
IgorKorkin/MemoryRanger
MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.
IgorKorkin/HypervisorsDetection
This is the first software system, which can detect a stealthy hypervisor and calculate several nested ones even under countermeasures.
IgorKorkin/AllMemPro
AllMemPro
IgorKorkin/MemAttacker
This project demonstares an illegal read- and write- access to the kernel-mode data for both allocated by 3rd party drivers and EPROCESS structures
IgorKorkin/AllMemProTestBed
Legal access: The driver and console app to demonstrate the basic memory access in kernel mode
IgorKorkin/MemAllocator
This project demonstrates allocation and legal access to the allocated data in the kernel mode.
IgorKorkin/AllMemProTestBedPatcher
Illegal access: the driver and console app to demo unauthorized read- and write- access to the kernel-mode memory
IgorKorkin/testbed
This project demonstrates the privilege escalation for a user-mode process - cmd.exe using stack overflow in the kernel mode driver. The user-mode component 'testbed_console.exe' sends CTL_CODE with a payload to the vulnerable driver 'testbed_driver.sys', which call RtlCopyMemory without any checks. 'testbed_console.exe' includes 'testbed_driver.sys' has a resource.
IgorKorkin/PPL
The demo of RtlTestProtectedAccess() and RtlProtectedAccess involved in creation Protected Process.
IgorKorkin/research
The section includes all the information about my research result: papers, slides, speeches, etc.
IgorKorkin/MemoryGuardConsole
This code demonstrates the memory guard idea, which prevents unauthority access from one driver to another and allows all legitimate accesses.
IgorKorkin/AMP_test
IgorKorkin/awesome-virtualization
Collection of resources about Virtualization
IgorKorkin/github-slideshow
A robot powered training repository :robot:
IgorKorkin/Perceptron
A small demo project to learn ML & AI
IgorKorkin/Publications
IgorKorkin/SpecuCheck
SpecuCheck is a Windows utility for checking the state of the software mitigations against CVE-2017-5754 (Meltdown) and hardware mitigations against CVE-2017-5715 (Spectre)
IgorKorkin/mimikatz
A little tool to play with Windows security