ktapi.sys Exploitation PoC

A proof-of-concept exploit for the ktapi.sys kernel driver, which exposes arbitrary physical memory read/write to unprivileged user-mode processes. The exploit converts physical memory access into virtual memory access and achieves local privilege escalation to NT AUTHORITY\SYSTEM on Windows 10 22H2.

Educational purposes only. Do not run on systems you do not own.

Full writeup

The complete analysis is on my blog (gonna be published on 27.9.2026):

https://vojtechhron.dev/cs/article/ktapi-lpe

How it works

1. Open the device \\.\ktapi and map physical memory via IOCTL 0x82007000.
2. Locate the Low Stub in physical memory and read CR3.
3. Walk the page tables to translate virtual addresses to physical.
4. Resolve PsInitialSystemProcess from the ntoskrnl export table.
5. Walk the process list to find our own EPROCESS.
6. Copy the SYSTEM token into our EPROCESS.Token.
7. Spawn a shell as nt authority\system.

Repository contents

• ktapi_exploit.c - the exploit source
• ktapi.sys - the vulnerable driver binary (for testing only)
• LICENSE - MIT License

Requirements

• Windows 10 Pro 22H2 (build 19045), x64
• Visual Studio 2022 with the x64 Native Tools toolchain
• Administrator privileges to load the driver

Usage

Load the driver from an elevated command prompt:

sc.exe create ktapi binPath=C:\path\to\driver\ktapi.sys type=kernel
sc.exe start ktapi

Then run the exploit from any process:

ktapi_exploit.exe

When finished, stop and delete the service:

sc.exe stop ktapi
sc.exe delete ktapi

Building

Open x64 Native Tools Command Prompt for VS 2022 and run:

cl /O2 /Oi /GL /DNDEBUG /MD /GS /Gy /W4 /std:c17 ktapi_exploit.c /link /LTCG /OPT:REF /OPT:ICF

Compiling as x86 will not work. The exploit checks sizeof(void*) == 8 at runtime and aborts if the check fails.

Offsets

Build-specific constants for Windows 10 22H2 (build 19045):

Symbol	Offset
nt!HalpLMStub - nt	0x3F93E0
_EPROCESS.UniqueProcessId	0x440
_EPROCESS.ActiveProcessLinks	0x448
_EPROCESS.Token	0x4B8
_EPROCESS.ImageFileName	0x5A8

Other builds require updated offsets, see the blog post.

Demo

Screencast_20260920_232217.webm

Disclaimer

This project is published for educational and research purposes only. Do not use it on systems you do not own or have explicit permission to test.

License

MIT. See LICENSE for details.