Agent Skills › gmh5225/awesome-game-security › windows-kernel-security

windows-kernel-security

GitHub

分析Windows内核安全机制，包括驱动信任、回调、IRQL、内存管理及VBS/HVCI等。针对授权游戏安全研究，匹配特定构建的内核结构与偏移量，用于反作弊检测和威胁分析。

.claude/skills/windows-kernel/SKILL.md gmh5225/awesome-game-security

Trigger Scenarios

分析Windows驱动安全性检查内核内存和补丁保护状态研究反作弊检测技术排查内核级威胁或漏洞

Install

npx skills add gmh5225/awesome-game-security --skill windows-kernel-security -g -y

More Options

Non-standard path

npx skills add https://github.com/gmh5225/awesome-game-security/tree/main/.claude/skills/windows-kernel -g -y

Use without installing

npx skills use gmh5225/awesome-game-security@windows-kernel-security

指定 Agent (Claude Code)

npx skills add gmh5225/awesome-game-security --skill windows-kernel-security -a claude-code -g -y

安装 repo 全部 skill

npx skills add gmh5225/awesome-game-security --all -g -y

预览 repo 内 skill

npx skills add gmh5225/awesome-game-security --list

SKILL.md

Frontmatter

{
    "name": "windows-kernel-security",
    "description": "Analyze Windows driver trust, callbacks, IRQL, kernel memory, DSE, PatchGuard, VBS\/HVCI, ETW, crash evidence, and build-specific internals for authorized game-security research."
}

Windows kernel security

Match undocumented structures, offsets, globals, and allocator behavior to the exact Windows build and symbols. Separate documented contracts, observed state, and inference.

Topic routing

Foundations and security for driver surfaces, symbols, PatchGuard, DSE, VBS/HVCI, and Secure Boot.
Drivers and observation for callbacks, IRQL, APCs, driver structure, hooking, and ETW.
Memory and forensics for pool architecture, memory access, dumps, and tools.
Threats and virtualization for vulnerable drivers, boot threats, PatchGuard research, and hypervisor defenses.
Repository resources and repository map for source selection.

Use dma-attack-techniques for device-originated memory access and game-security-research-rigor for version-sensitive conclusions.

Version History

4a52192 Current 2026-09-22 04:11
优化技能结构以适配GPT-6 Astra，修正过时安全声明，强化证据引用并恢复直接数据源入口。
51e379d 2026-07-31 02:59
新增用户态内核符号遍历方法论（含dbghelp配置与字段查找策略）及Gadget扫描工作流；更新README覆盖范围以包含更多反作弊检测类别；修正关于VTL1隔离和KDP/Secure Pool的说明。
c7ff340 2026-07-19 14:07
优化Wiki文档结构与自动化流程
f65b5b3 2026-07-05 12:05