~/wired/

A Complete Noobs Exploration of JDWP and JDI

Mon, 18 Aug 2025 13:15:16 -0400

Intro

Recently on a penetration test my team and I discovered several JDWP ports open. The Java Debug Wire Protocol (JDWP) is "[…] used for communication between a debugger and the Java virtual machine (VM) which it debugs."

So tl;dr: You can connect to a remote or local JVM over various protocols, break/suspend threads, and run code in the context of the suspended thread(s).

Public tooling for JDWP exploitation:

IOActive’s jdwp-shellifier
Metasploit’s java_jdwp_debugger.rb

Problem

Our exploitation of JDWP was severely limited due to traffic restrictions preventing us from uploading and executing our C2 tooling, with our only options being a DNS C2 channel or executing commands directly via JDWP.

What's in a VAD? User VA to Physical Address!

Sun, 01 Aug 2021 13:15:16 -0400

Intro

Rabbit holes, am I right?

The purpose of my small project was to understand the inner workings of the kernel that are responsible for translating a UMVA into the PA. After finishing up my OSR class recently, I wanted to know more about how VADs actually worked under the hood, and how the kernel leverages them to describe the PTEs associated with a section. I wanted to understand how, and by what mechanisms, does the kernel “resolve” a virtual address (UMVA) into it’s physical address (PA). Of course, you can’t really go far when talking about memory management in the kernel without talking about PTEs, PML4, PDPTEs, etc, but there are other, better resources that go in-depth into addressing. Much incredible work has been done already to describe this process, and without the following posts (in no particular order), I would not have been able to accomplish my task:

A Foray For Fun into Windows Fibers

Fri, 01 Jan 2021 13:15:16 -0400

The Windows fiber API has been described as one of the “most elegant” APIs available to the Windows programmer for manual execution scheduling. I’m by no means an expert in how fibers work, nor how to deploy them into a large-scale application. There is not a lot of documentation about how fibers work internally, so I thought it might be at least interesting or helpful to write about some of what I found.