The Windows Registry Adventure #6: Kernel-mode objects
Summary: Google Project Zero's sixth Windows Registry installment details the kernel-mode structures behind an active registry hive, centered on the _CMHIVE descriptor, which spans 0x12F8 bytes and contains a _HHIVE structure of 0x600 bytes at offset 0. The post notes that in Windows 11 the six function pointers in _HHIVE, including GetCellRoutine, are de-virtualized so call sites reference HvpGetCellPaged or HvpGetCellFlat directly, eliminating their usefulness in exploitation.
Why it matters: The _HHIVE signature 0xBEE0BEE0 lets investigators locate these structures in raw memory dumps, and the shift away from function pointers in Windows 11 removes a corruption target that existed in Windows 10 and earlier.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026