About windows-kernel-security
A guidance skill for Windows kernel security, intended for developers and security researchers. It emphasizes matching undocumented details to the exact Windows build and symbols, and separating documented contracts, observed state, and inference.
Key features
- 01Match details to Windows builds
- 02Cover drivers and kernel protections
- 03Guide memory analysis and forensics
- 04Route threat and virtualization topics
Use cases
- 01Analyzing driver surfaces and callbacks
- 02Investigating memory dumps and pool behavior
- 03Assessing boot threats or hypervisor defenses
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/windows-kernel-securityin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/drivers-and-observation.mdrepository-resources.mdrepository-map.mdfoundations-and-security.mdmemory-and-forensics.mdthreats-and-virtualization.mdDetails
From the project READMEWindows kernel security
Match undocumented structures, offsets, globals, and allocator behavior to the exact Windows build and symbols. Separate documented contracts, observed state, and inference.
Topic routing
- Foundations and security for driver surfaces, symbols, PatchGuard, DSE, VBS/HVCI, and Secure Boot.
- Drivers and observation for callbacks, IRQL, APCs, driver structure, hooking, and ETW.
- Memory and forensics for pool architecture, memory access, dumps, and tools.
- Threats and virtualization for vulnerable drivers, boot threats, PatchGuard research, and hypervisor defenses.
- Repository resources and repository map for source selection.
Use dma-attack-techniques for device-originated memory access and game-security-research-rigor for version-sensitive conclusions.
Comments
Markdown supported