
Windows Exploitation Tricks: Abusing the User-Mode Debugger - archimag0
https://googleprojectzero.blogspot.com/2019/04/windows-exploitation-tricks-abusing.html
======
maxheadroom
> _Windows Exploitation Tricks: Abusing the User-Mode Debugger_

...and...

> _Nothing I’ve described here is a security vulnerability, but the behavior
> is interesting and it’s worth looking out for cases where it could be used._

Maybe I'm misunderstanding this newfangled internets but isn't exploitation
generally synonymous with security vulnerability?

JFYI, for anyone who's interested, the equivalent debugging API methods in
.NET could be found in ClrMd[0] but it's as unyielding a beast as the native
methods.

[0] - [https://github.com/microsoft/clrmd](https://github.com/microsoft/clrmd)

~~~
XMPPwocky
A vulnerability is "this function will write 8 bytes of arbitrary data out of
bounds in an edge case". Exploitation is the process of using that
vulnerability to, typically, cause the process to execute attacker-controlled
code.

Something can make exploitation easier without being a vulnerability. For
example, disabling exploit mitigations like ASLR does this.

------
peter_d_sherman
User mode debugging is an area that any present or future OS designer should
be concerned about getting right in terms of debugging features vs. security
implications...

------
tomglynch
Why is project zero hosted on blogspot?

~~~
Larrikin
Google owns it.

~~~
tomglynch
They don't host their 'cloud' blog on blogspot:
[https://cloud.google.com/blog/topics/inside-google-
cloud/an-...](https://cloud.google.com/blog/topics/inside-google-cloud/an-
update-on-sundays-service-disruption)

So why project zero?

~~~
babuskov
It was probably the easiest route. Instead of setting up a special website for
it, they just made a blog with a couple of clicks. Project zero goes back to
2014. Perhaps the infrastructure wasn't there, or it started as a small pilot
project.

