Exploiting Reversing (ER) series

Article 0 7

Source provenance. Raw material catalogued for the wiki ingest pipeline. Lives offline at raw_sources/windows-exploit-research/exploit_reversing_07.md.

Status: catalogued

Excerpt

0: kd> dt nt!_EPROCESS Token +0x4b8 Token : _EX_FAST_REF DEFINE_GUID(ProviderId, 0x1b4f2a33, 0xb1b3, 0x40c0, 0xba, 0x5a, 0x06, 0x34, 0xec, 0x63, 0xde, 0x00); typedef enum _HSM_CONSTANTS { HSM_BITMAP_MAGIC = 0x70527442, HSM_FILE_MAGIC = 0x70526546, HSM_DATA_HAVE_CRC = 0x02, HSM_ELEMENT_TYPE_UINT64 = 0x06, HSM_ELEMENT_TYPE_BYTE = 0x07, HSM_ELEMENT_TYPE_UINT32 = 0x0A, HSM_ELEMENT_TYPE_MAX = 0x10, HSM…

Likely wiki targets

Pending — this source has not yet been distilled into wiki pages. Future ingest can populate links to the concept / technique / CVE pages this material would inform.