
CVE-2026-50416-writeup-and-poc
CVE-2026-50416: Windows 11 KASLR bypass

CVE-2026-50416: Windows 11 KASLR bypass

Simple Process Dumper using DMA over a PCIe FPGA device


Virtual Machine Introspection, Tracing & Debugging

Visualize the virtual address space of a Windows process on a Hilbert curve.

Memory API proxy via signed mozglue.dll

CVE-2017-13868: Information leak of uninitialized kernel heap data in XNU.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.


Exploit for CVE-2026-46215, a Linux kernel DRM GEM use-after-free local privilege escalation. Uses racing, slab spraying, and Dirty Pipe-style file…

This tool demonstrates CVE-2026-38194, a vulnerability in Teledyne Digital Imaging Sapera Memory Manager (v9.0.0.0 and below). The CORMEM.SYS kernel…

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…

Master's thesis research on CVE-2021-4034 (PwnKit) local privilege escalation. Multi-payload Python exploit with 7 modes including interactive shell,…

Finding secrets in kernel and user memory

Dump LSASS via physical memory read primitives in vulnerable kernel drivers

Lenovo Diagnostics Driver EoP - Arbitrary R/W

volatility explorer (volatility 2)

Cobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…