PolyWolf on Security

The Windows Registry Adventure #8: Practical exploitation of hive memory corruption

Posted on 2025-09-19: https://googleprojectzero.blogspot.com/2025/05/the-windows-registry-adventure-8-exploitation.html

I finally caught up with this series lmao; been behind ever since 3, and it's taken a lot of infrequent subway rides since to get thru them all.

It's been a really good ride so far. These writeups are exceedingly detailed and a great way to learn about practical reversing techniques for Windows, especially (duh) the registry.

This piece in particular coves an actual exploit chain, bottom-to-top, culminating in an extremely impressive demo:

If we perform all these steps correctly, we should be able to read and write arbitrary kernel memory via Regedit. [Proceeds to demonstrate this]

You can read this article without reading any of the others, tho it is recommended if ur a sicko like me :3 Can't wait for #9!!