COPYCATS AT MACHINE SPEED: REPRODUCING FRONTIER WINDOWS KERNEL EXPLOITATION RESEARCH

Summary from the TLDR InfoSec newsletter

ITRES Labs researchers fed photos of Juan Sacco's BruCON slides, his since-deleted physmem.exe binary, and older public projects into ChatGPT to rebuild his Native SSDT and Shadow SSDT kernel redirection techniques, reaching SYSTEM on Windows 11 with VBS, HVCI, and kernel shadow stacks enabled. Four months of original research were reproduced in roughly 24 hours of activity, though 39 refusals and broken generated code forced the final Shadow SSDT SYSTEM integration to be finished by hand. Researchers releasing slides or compiled binaries should assume partial disclosures can now be turned into working exploits within days.