inding a kernel vulnerability is great, but it’s only the first step on the way to a fully weaponized exploit. With every windows version that path becomes harder and less clear, with new mitigations from KASLR and SMEP to HVCI, KCFG and KCET making exploitation harder and breaking existing exploit primitives. Even vulnerability classes like pool corruption or arbitrary write, which used to be almost trivial to exploit for a full user->kernel EoP are now difficult to turn into a stable, working exploit on modern systems. Thankfully, Windows comes to the rescue. Windows 11 adds many new features and data structures that give the skilled exploit developer a new set of tools to use. This talk will demonstrate how one of those mechanism can be used to turn one arbitrary write into a full arbitrary kernel read/write primitive. This is done using documented APIs and data structures, while leaving minimal traces that can be used to detect the exploit. This novel technique is simple, clean and easy to understand and implement and has minimal visibility to security products or forensic tools.