# sam-b/windows_kernel_address_leaks architecture

> Architecture diagram of the GitHub repository sam-b/windows_kernel_address_leaks, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sam-b/windows_kernel_address_leaks
- Repository: https://github.com/sam-b/windows_kernel_address_leaks

## Overview

This repository is a collection of standalone Windows user-mode demonstrations for disclosing kernel-related addresses and pointers, rather than one integrated application. The principal workflow is to run a technique-specific executable, obtain information through a Windows interface or shared user-mode structures, and print the resulting addresses; the triage-dump example instead writes a dump file. README-listed techniques are retained as separate branches. Several implementations are represented from the README and tree because their source was not excerpted, so their internal calls are not inferred.

Main entry points: [`NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp`](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp) (Triage Dump), [`NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp`](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp) (Handle Info), [`NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp`](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp) (Lock Info), [`NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp`](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp) (Module Info)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ntinfo["System Information"]
  node_sys_handle["Handle Info"]
  node_sys_lock["Lock Info"]
  node_sys_module["Module Info"]
  node_sys_process["Process Info"]
  node_sys_pool["Big Pool Info"]
  node_sys_firmware["Firmware Table"]
  node_syscall_return["Syscall Returns<br/>[Syscalls.cpp]"]
end

subgraph group_win32k["Win32k Techniques"]
  node_shared_info["Shared Info Table"]
  node_hmvalidate["HMValidateHandle"]
  node_gdi_table["GDI Handle Table"]
  node_desktop_heap["Desktop Heap<br/>[DesktopHeap.cpp]"]
end

subgraph group_privileged["Privileged Debug"]
  node_triage_dump["Triage Dump"]
end

subgraph group_other["CPU Structures"]
  node_descriptor_tables["Descriptor Tables"]
end

node_operator(("User"))
node_nt_api["Windows NT APIs"]
node_dump_file["Dump File"]

node_operator -->|"runs demo"| node_sys_handle
node_operator -->|"runs demo"| node_sys_lock
node_operator -->|"runs demo"| node_sys_module
node_operator -->|"runs demo"| node_sys_process
node_operator -->|"runs demo"| node_sys_pool
node_operator -.->|"runs demo"| node_sys_firmware
node_operator -->|"runs demo"| node_syscall_return
node_operator -->|"runs demo"| node_shared_info
node_operator -->|"runs demo"| node_hmvalidate
node_operator -->|"runs demo"| node_gdi_table
node_operator -->|"runs demo"| node_desktop_heap
node_operator -->|"runs demo"| node_triage_dump
node_operator -->|"runs demo"| node_descriptor_tables
node_sys_handle -->|"queries handles"| node_nt_api
node_sys_lock -->|"queries locks"| node_nt_api
node_sys_module -->|"queries modules"| node_nt_api
node_sys_process -->|"queries processes"| node_nt_api
node_sys_pool -->|"queries pool"| node_nt_api
node_sys_firmware -->|"queries firmware"| node_nt_api
node_triage_dump -->|"requests triage dump"| node_nt_api
node_triage_dump -->|"writes dump"| node_dump_file

click node_sys_handle "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp"
click node_sys_lock "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp"
click node_sys_module "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp"
click node_sys_process "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation.cpp"
click node_sys_pool "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation.cpp"
click node_sys_firmware "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo.cpp"
click node_syscall_return "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/Syscalls/Syscalls/Syscalls.cpp"
click node_shared_info "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/SharedInfoHandleTable/SharedInfoHandleTable/SharedInfoHandleTable.cpp"
click node_hmvalidate "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/HMValidateHandle/HMValidateHandle/HMValidateHandle.cpp"
click node_gdi_table "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/GdiSharedHandleTable/GdiSharedHandleTable/GdiSharedHandleTable.cpp"
click node_desktop_heap "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/DesktopHeap/DesktopHeap/DesktopHeap.cpp"
click node_triage_dump "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp"
click node_descriptor_tables "https://github.com/sam-b/windows_kernel_address_leaks/blob/master/DescriptorTables/DescriptorTables/DescriptorTables.cpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sys_handle,node_sys_lock,node_sys_module,node_sys_process,node_sys_pool,node_sys_firmware,node_syscall_return,node_operator toneBlue
class node_shared_info,node_hmvalidate,node_gdi_table,node_desktop_heap toneAmber
class node_triage_dump,node_nt_api toneMint
class node_descriptor_tables toneRose
class node_dump_file toneIndigo
```

## Components

### System Information

- [Handle Info](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp): `NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp`
- [Lock Info](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp): `NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp`
- [Module Info](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp): `NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp`
- [Process Info](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation.cpp): `NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation.cpp`
- [Big Pool Info](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation.cpp): `NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation.cpp`
- [Firmware Table](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo.cpp): `NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo.cpp`
- [Syscall Returns](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/Syscalls/Syscalls/Syscalls.cpp): `Syscalls/Syscalls/Syscalls.cpp`

### Win32k Techniques

- [Shared Info Table](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/SharedInfoHandleTable/SharedInfoHandleTable/SharedInfoHandleTable.cpp): `SharedInfoHandleTable/SharedInfoHandleTable/SharedInfoHandleTable.cpp`
- [HMValidateHandle](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/HMValidateHandle/HMValidateHandle/HMValidateHandle.cpp): `HMValidateHandle/HMValidateHandle/HMValidateHandle.cpp`
- [GDI Handle Table](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/GdiSharedHandleTable/GdiSharedHandleTable/GdiSharedHandleTable.cpp): `GdiSharedHandleTable/GdiSharedHandleTable/GdiSharedHandleTable.cpp`
- [Desktop Heap](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/DesktopHeap/DesktopHeap/DesktopHeap.cpp): `DesktopHeap/DesktopHeap/DesktopHeap.cpp`

### Privileged Debug

- [Triage Dump](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp): `NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp`

### CPU Structures

- [Descriptor Tables](https://github.com/sam-b/windows_kernel_address_leaks/blob/master/DescriptorTables/DescriptorTables/DescriptorTables.cpp): `DescriptorTables/DescriptorTables/DescriptorTables.cpp`

### Other components

- **User**
- **Windows NT APIs**
- **Dump File**

## Connections

- User → Handle Info: runs demo (evidence: `README.md`)
- User → Lock Info: runs demo (evidence: `README.md`)
- User → Module Info: runs demo (evidence: `README.md`)
- User → Process Info: runs demo (evidence: `README.md`)
- User → Big Pool Info: runs demo (evidence: `README.md`)
- User → Firmware Table: runs demo
- User → Syscall Returns: runs demo (evidence: `README.md`)
- User → Shared Info Table: runs demo (evidence: `README.md`)
- User → HMValidateHandle: runs demo (evidence: `README.md`)
- User → GDI Handle Table: runs demo (evidence: `README.md`)
- User → Desktop Heap: runs demo (evidence: `README.md`)
- User → Triage Dump: runs demo (evidence: `README.md`)
- User → Descriptor Tables: runs demo (evidence: `README.md`)
- Handle Info → Windows NT APIs: queries handles (evidence: `NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation/NtQuerySysInfo_SystemHandleInformation.cpp`)
- Lock Info → Windows NT APIs: queries locks (evidence: `NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation/NtQuerySysInfo_SystemLockInformation.cpp`)
- Module Info → Windows NT APIs: queries modules (evidence: `NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation/NtQuerySysInfo_SystemModuleInformation.cpp`)
- Process Info → Windows NT APIs: queries processes (evidence: `NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation/NtQuerySysInfo_SystemProcessInformation.cpp`)
- Big Pool Info → Windows NT APIs: queries pool (evidence: `NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation/NtQuerySysInfo_SystemBigPoolInformation.cpp`)
- Firmware Table → Windows NT APIs: queries firmware (evidence: `NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo/NtQuerySysInfo_SystemFirmwareTableInfo.cpp`)
- Triage Dump → Windows NT APIs: requests triage dump (evidence: `NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp`)
- Triage Dump → Dump File: writes dump (evidence: `NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump/NtSystemDebugControl_SysDbgGetTriageDump.cpp`)