Exploiting Windows KTM Race Condition (Part 35)

This part of a multi-part blog details exploiting CVE-2018-8611 in Windows KTM: how to win the use-after-free race without a debugger by suspending the recovery thread (using SuspendThread + NtQueryInformationThread), how to identify which KENLISTMENT to free (notification counting), non-paged pool feng shui using named pipes to replace freed KENLISTMENTs with controlled DATA_ENTRY chunks, and how to build "trap" and primitive userland-backed enlistments for detection, debugging and turning the UAF into higher-level read/write primitives.