Windows Kernel Segment Heap Notes
There is a lot to digest when it comes to windows kernel segment heap and the best way for me was to make my own diagrams and notes to understand it. I took the help from the following references. There are plenty of great resources on heap memory in Linux, but finding a single, comprehensive resource for Windows is much harder. A lot of the information is scattered across research papers, blog posts, conference talks and other sources, so I thought I’d put what I’ve learned together and share it with you all. It also gives me something I can come back to and use as a reference later on. These notes cover pool types, different allocators like LFH, VS, the backend segment allocator, large blocks and at last, some exploitation techniques for kernel pool overflows using named pipes.
I’ve tried my best to make this book self-explanatory, enough to understand how the segment heap works and just enough to learn how to exploit it. If something still doesn’t make sense, you can take help from the links below.
Everything here targets Windows 10 20H2. If you find something incorrect or any useful information missing, please let me know :)
References
- Segment Heap in Windows Kernel (Part 1) (angelboy)
- Windows 10 Segment Heap Internals (Yason)
- Scoop the Windows 10 Pool (Bayet, Fariello)
- Windows Non-Paged Pool Overflow Exploitation (vp777)