The training that turns security practitioners into Windows kernel researchers. Build a hypervisor lab, study modern mitigations, construct exploit primitives, and understand ring 0 internals where most people stop reading the documentation.
This isn't a slideshow with diagrams. After completing this training, these are real, demonstrable research skills you'll own.
Set up a hypervisor-based kernel debugging lab with WinDbg, snapshot automation, and driver instrumentation
Navigate ntoskrnl.exe, understand EPROCESS/ETHREAD structures, and trace system calls through SSDT to kernel handlers
Study and reproduce bypass techniques for KASLR, SMEP, SMAP, kCFG, HVCI in isolated lab environments
Construct read/write primitives from real vulnerability classes - pool overflows, type confusion, race conditions in controlled research labs
Fuzz kernel drivers with kAFL, Syzkaller, and custom harnesses, then triage crashes into exploitability assessments
Analyze kernel callback mechanisms (ETW, ObRegisterCallbacks, Registry) to understand defender architecture and EDR design
Build full privilege escalation chains in lab: from initial driver vulnerability to SYSTEM and understand every step between
Understand VBS, PPL, and Credential Guard architecture: boundaries, trust levels, and what is realistically attackable vs. what isn't
Built by kernel researchers, not course factories. Every lab was debugged on a real target.
Your lab runs on a proper hypervisor with snapshot management, kernel debugging over serial, and automated reset. No "install a VM and figure it out."
You'll use Driver Verifier, kernel sanitizers, ETW tracing, and custom monitoring to observe exactly what happens at ring 0 before, during, and after each exercise.
HEVD, custom-built vulnerable drivers, and real-world driver patterns. You research actual IOCTLs and attack surfaces, not contrived CTF challenges.
You don't just "run an exploit." You build read/write primitives from scratch, chain them, handle edge cases, and understand kernel state restoration.
The Certified Windows Research & Exploitation (CWRE) is an advanced certification for security researchers who operate at the kernel level.
You build a lab, learn the internals, study the mitigations, write the primitives. Then you prove it in an exam against a hardened target.
Recorded screen-share lectures with WinDbg, IDA Pro, and live kernel debugging. No slides-only modules.
Each lab comes with a pre-configured VM snapshot, step-by-step instructions, and expected output. You bring the hypervisor, we provide the images.
Every lecture has a companion written guide with annotated code, struct offsets, and WinDbg commands you can copy-paste.
Private research community. Ask questions, share findings, get unstuck. Best-effort instructor support typically within 24h.
48-hour exam. Hands-on, no multiple choice. No prerequisites beyond course completion.
New Windows builds, new mitigations, new techniques all added to the course. One payment, no recurring fees.
6 modules. Lab to research-grade primitives. Each one builds on the last.
One payment. Lifetime access. All future updates included.
You should be comfortable writing C code, reading x86-64 disassembly, and using a debugger. Basic understanding of OS concepts (processes, memory, syscalls) is assumed. This is not a beginner course.
A host machine running Windows 10/11 or Linux with a Type-2 hypervisor (VMware Workstation or Hyper-V). Minimum 16GB RAM recommended, 32GB ideal. You'll run nested VMs for kernel debugging. We provide the lab VM images.
At a steady pace (10–15 hours/week), expect 3–4 months to complete all modules and labs. You have lifetime access, so you can go at your own speed. The exam can be taken anytime after course completion.
The CWRE exam is a 48-hour, hands-on assessment. No multiple choice. You receive a hardened target and must demonstrate real exploitation research skills
You get access to a private Discord server with other students and instructors. Support is best-effort, typically within 24 hours. Early Access students also get direct access to the course author for technical questions.
No. Security developers, driver developers, and anyone who needs to understand Windows kernel internals will benefit. The research methodology applies whether you're building defenses or analyzing attack techniques.
We're building this for a small group of serious researchers, not for volume. Early enrollees get direct access to instructors, priority lab support, and influence over curriculum updates.
Lifetime access. No subscription.
Join the Academy