In case you're a little confused, as I was, by the step from "can tag arbitrary user memory as kernel executable" to "get the kernel to execute it", the techniq

In case you're a little confused, as I was, by the step from "can tag arbitrary user memory as kernel executable" to "get the kernel to execute it", the technique used by the PoC is (apparently) well-known enough not to mention: http://poppopret.blogspot.com/2011/07/windows-kernel-exploitation-basics-part.html http://poppopret.blogspot.com/2011/07/windows-kernel-exploit... Short version: You can overwrite a function pointer entry in the HAL dispatch table that will be called by NtQueryIntervalProfile().