Research Notes
-
Protected Process Light (PPL)
WinDbg notes — find EPROCESS.Protection and zero it.
-
ETW Threat Intelligence
WinDbg notes — find and disable the ETW-TI provider.
-
Kernel Callbacks
WinDbg notes — all five kernel callback cases, every command explained.