Skip to content

Courses Pricing

Loading...

Courses Pricing

© 2026 Krell Academy

Built by Jacob Krell

Courses/Windows Exploit Internals: From Usermode to Hypervisor

Intermediate-AdvancedKrell Academy

Windows Exploit Internals: From Usermode to Hypervisor

Bridge the gap between OSED and OSEE-level content across 9 modules. Master advanced Windows exploitation from heap attacks and kernel exploitation to browser type confusion, win32k privilege escalation, hypervisor escape, and modern mitigation bypasses, with hands-on downloadable lab environments.

9 modules

51 lessons

9 labs

Intermediate-Advanced

exploit-devwindowskernelheapropshellcodebrowserwin32khypervisor

Prerequisites

OSED certification or equivalent user-mode exploit dev experience
Strong understanding of x86/x64 assembly
Familiarity with WinDbg and IDA Pro/Ghidra
Basic ROP chain construction experience

Course Progress

... completed

0%

Modules

1ROP Refresher and Gadget Hunting at ScaleLesson 2Jump-Oriented Programming (JOP) ChainsLesson 3Sigreturn-Oriented Programming (SROP) on WindowsLesson 4Counterfeit Object-Oriented Programming (COOP)Lesson 5Lab: Build a JOP Chain to Bypass DEP+CFGLab

1NT Heap InternalsLesson 2Segment Heap ArchitectureLesson 3Use-After-Free Exploitation PatternsLesson 4Heap Spraying and Pool GroomingLesson 5Type Confusion PrimitivesLesson 6Lab: Exploit a UAF in a Custom Windows ServiceLab

1Windows Kernel Architecture for Exploit DevsLesson 2Token Stealing and Privilege EscalationLesson 3Kernel Pool Internals and Pool OverflowLesson 4Arbitrary Read/Write Primitives in Kernel ContextLesson 5SMEP/SMAP/kCFG Bypass TechniquesLesson 6Lab: Kernel Pool Overflow to SYSTEM on HEVDLab

1Windows Driver Model and Attack SurfaceLesson 2IOCTL Reversing and FuzzingLesson 3Stack and Pool Overflows in Kernel DriversLesson 4Race Conditions and Double-Fetch BugsLesson 5Lab: Exploit a Vulnerable KMDF DriverLab

1Position-Independent Shellcode DesignLesson 2Direct Syscall InvocationLesson 3Shellcode That Survives VBS/HVCILesson 4Payload Staging and Reflective TechniquesLesson 5Lab: Write a Direct-Syscall Shellcode PayloadLab

1Control Flow Guard (CFG) Internals and BypassesLesson 2CET and Shadow StacksLesson 3Arbitrary Code Guard (ACG) and Code IntegrityLesson 4VBS Attack SurfaceLesson 5Combining Primitives for Full Exploit ChainsLesson 6Version-Independent ExploitationLesson 7Lab: Full Exploit Chain Against a Hardened TargetLab

1JavaScript Engine InternalsLesson 2Type Confusion in JIT CompilersLesson 3Browser Heap ExploitationLesson 4Browser Sandbox ArchitectureLesson 5Full Exploit Chain PatternsLesson 6Lab: Browser Type Confusion ExploitLab

1Win32k Subsystem ArchitectureLesson 2User-Mode Callback VulnerabilitiesLesson 3GDI Object Abuse for Kernel PrimitivesLesson 4tagWND Exploitation TechniquesLesson 5Modern Win32k MitigationsLesson 6Lab: Win32k Privilege EscalationLab

1Hypervisor Architecture FundamentalsLesson 2Virtual Device Attack SurfaceLesson 3Guest-to-Host Exploitation PrimitivesLesson 4Hyper-V Security BoundariesLesson 5Lab: VM Escape SimulationLab