Reverse engineering undocumented Windows Kernel features to work with the EDR

Original text by 0xflux/

[Reverse engineering Windows internals: because sometimes the best way to fix a problem is to take the operating system apart.]

Intro

The information contained in this blog post is valid for the Windows 11 Kernel 24H2, and is not guaranteed to be accurate on other kernel versions.

The code for this…

https://core-jmp.org/2026/03/reverse-engineering-undocumented-windows-kernel-features-to-work-with-the-edr/