Exploiting Reversing (ER) series: article 06 | A Deep Dive Into Exploiting a Minifilter Driver (N-day)

I am excited to release the extended version of the sixth article in the Exploiting Reversing Series (ERS). Titled “A Deep Dive Into Exploiting a Minifilter Driver (N-day)” this 293-page deep dive offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/wp-content/uploads/2026/02/exploit_reversing_06_extended.pdf

Key updates in this extended edition:

[+] Dual Exploit Strategies: Two distinct exploit versions.
[+] Exploit ALPC Write Primitive Edition: elevation of privilege of a regular user to SYSTEM.
[+] Exploit Parent Process ID Spoofing Edition: elevation of privilege of an administrator to SYSTEM.
[+] Solid Reliability: A completely stable and working ALPC write primitive.
[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

For those who have read the original release, whose exploit was working, my strong recommendation is that you adopt this extended edition as definitive.

The article guides you through the entire lifecycle of an exploit: from initial reverse engineering and vulnerability analysis to multiple PoC developments and full exploitation.

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which has helped me write these articles over time.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day.

Alexandre Borges
(FEBRUARY/16/2026)

PS: The videos demonstrating the exploit are below:

Exploiting Reversing (ER) series: article 05 | Hyper-V (part 01)

The fifth article (57 pages) of the Exploiting Reversing Series (ERS), a step-by-step research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/03/exploit_reversing_05.pdf

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which have helped me write these articles over time.

The best thing in life is people.

I hope you enjoy reading it and have an excellent day.

Alexandre Borges.

(MARCH/12/2025)

Exploiting Reversing (ER) series: article 04 | macOS/iOS (part 01)

The fourth article (126 pages) of the Exploiting Reversing Series (ERS), a step-by-step research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/02/exploit_reversing_04.pdf

I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for their constant and uninterrupted support, which have helped me write these articles.

The best thing in life is people.

I hope you enjoy reading it and have an excellent day.

Alexandre Borges.

(FEBRUARY/04/2025)

Malware Analysis Series (MAS): article 10 | Linux

The tenth article (35 pages) of the Malware Analysis Series (MAS), a step-by-step malware analysis and reverse engineering series, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/01/mas_10.pdf

I hope this last article of MAS helps professionals from cybersecurity communities around the world. The series is now complete.

Have an excellent and keep reversing!

Alexandre Borges

(JANUARY/15/2025)

Malware Analysis Series (MAS): article 09 | Shellcode

The nineth article (38 pages) of the Malware Analysis Series (MAS), a step-by-step malware analysis and reverse engineering series, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2025/01/mas_09-1.pdf

I hope this article helps professionals from cybersecurity communities around the world.

Have an excellent and keep reversing!

Alexandre Borges

(JANUARY/08/2025)

PS: there is a typo on page 07 at the last bullet. Where you read “0x00000095” you must change it to “0x00000099“, as stated at the previous bullet.

Malware Analysis Series (MAS): article 08 | MacOS/iOS

The eighth article (62 pages) in the Malware Analysis Series (MAS), a step-by-step malware analysis and reverse engineering series, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2024/08/mas_08-1.pdf

I hope this article helps professionals from cybersecurity community around the world.

Have an excellent and keep reversing!

Alexandre Borges

(AUGUST/07/2024)

Exploiting Reversing (ER) series: article 01 | Windows kernel drivers – part 01

The first article (109 pages) in the Exploiting Reversing (ER) series, a step-by-step vulnerability research series on Windows, macOS, hypervisors and browsers, is available for reading on:

(PDF): https://exploitreversing.com/wp-content/uploads/2024/05/exploit_reversing_01-1.pdf

I hope readers like it.

Have an excellent day and keep reversing!

Alexandre Borges