reference

References

Challenge collections

• Kernel pwn challs collection by BrieflyX
• Non-userland pwn challs collection by hama
• KASLD: anti KASLR primitive theories and related challs

kernel structures reference

• Usefull Structures in kernel by Master of pwning

writeups including CTF / CVE

• Will's Root (EN)
• blog by kileak (EN)
• CTFするぞ (EN/JP)
• Google security-research (EN)
• blog by Alexander Popov (EN/RU)
• Syst3m Failure (EN)

kheap techniques

• Context Conservation: Zeng, Kyle, et al. "Playing for K (H) eaps: Understanding and Improving Linux Kernel Exploit Reliability."
  • loop and check TSC inside it before entering critical section to confirm that it is the beginning of its CFS timeslice

Memory reference

• Linux memory map

Trash

• my blog :)