A Book on Windows Kernel Segment Heap

Vulnerability Research
, , ,

There is a lot to digest when it comes to windows kernel segment heap and the best way for me was to make my own diagrams and notes to understand it. I took the help from the following references. There are plenty of great resources on heap memory in Linux, but finding a single, comprehensive resource for Windows is much harder. A lot of the information is scattered across research papers, blog posts, conference talks and other sources, so I thought I’d put what I’ve learned together and share it with you all. It also gives me something I can come back to and use as a reference later on. These notes cover pool types, different allocators like LFH, VS, the backend segment allocator, large blocks and at last, some exploitation techniques for kernel pool overflows.

I’ve tried my best to make this book self-explanatory, enough to understand how the segment heap works and just enough to learn how to exploit it. If something still doesn’t make sense, you can take help from the links below.

Everything here targets Windows 10 20H2. If you find something incorrect or any useful information missing, please let me know :)

Read the book here

The full book is hosted right here on the site : Windows Kernel Segment Heap Notes

Chapters cover the Windows Kernel Pool, core structures, the LFH, Variable Size Allocation, the Pool Header, Dynamic Lookaside, Backend Segment Allocation, Large Block Allocation and exploitation techniques, ending with a full writeup of an off-by-one pool overflow exploit.

References