MSRKIT

Summary from the TLDR InfoSec newsletter

MSRKit is a Windows kernel exploitation library and CLI that hijacks IA32_LSTAR via a ROP chain through AmdTools64.sys to call arbitrary kernel functions and map unsigned drivers without HVCI. The ROP chain temporarily clears SMEP/SMAP in CR4, dispatches the target, then restores both CR4 and LSTAR cleanly before returning to user mode via sysretq. The library supports all Windows 10/11 builds and KPTI, but requires HVCI to be disabled. Concurrent callers across processes will BSOD.