IDT Table Hijacking Technique in Windows 11

The research demonstrates an interrupt descriptor table (IDT) substitution technique in Windows 11 that works even with VBS/HVCI protections enabled. The method follows a "data‑only" approach: the original physical IDT page is cloned into a free writable area (FWA), where the required descriptor is modified, and then the IDT page mapping is briefly switched to this clone. After the payload (token‑swap payload) completes, the mapping is restored to its original configuration.

The manipulation leverages the INT 2E vector as a bridge to an internal kernel service function, temporarily redirecting the NtSetQuotaInformationFile slot to the target handler. This enables calls to PsGetCurrentProcess, PsReferencePrimaryToken, memcpy, ObDereferenceObject. This achieves kernel-level code execution without altering the original IDT or compromising memory integrity, confirming that the IDT structure can serve as a data redirection surface.

Article: https://www.exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11