Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Windows Exploit Mitigations: Map Depth, Plan Bypass

    1

    **What your agent does** - **Audits the mitigation flags:** dumpbin /headers /loadconfig, Process Explorer and Get-ProcessMitigation, per binary and per process.

    $14.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Windows Exploit Mitigations: Map Depth, Plan Bypass

    Windows Exploit Mitigations: Map Depth, Plan Bypass

    Example session with this skill installed

    My exploit on Windows 11 dies with 0xC0000409 subcode 10 when I overwrite a function pointer. What mitigation is that, and what are my options?

    • Read your context and instructions
    • Compiled the windows exploit mitigations

    Windows mitigation hit: function-pointer overwrite blocked

    What fired (example run): 0xC0000409 with subcode 10 is a Control Flow Guard violation. Your overwritten pointer pointed at an address CFG does not recognize as a valid call target, so the check aborted the process.

    Where you stand

    MitigationStateEffect
    DEP / NXOn (mandatory on x64)No executable stack or heap.
    ASLR + high entropyOnAddresses randomized per boot.
    CFGOnIndirect calls validated against a bitmap.
    CET shadow stackOnReturn addresses checked, ROP returns fault 0xC0000407.

    Options against CFG

    1. Call an address that is already a valid CFG target, such as a suppressed or exported function you can misuse.
    2. Use a data-only attack that never makes an indirect call.
    3. Find a CFG-suppressed code path, common in older third-party DLLs loaded in-process.

    Note: CET is also on, so a plain ROP chain faults on the first return. Factor that in before you commit to option 1.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Your Windows exploit dies with a hex exception code and no explanation, and you cannot tell DEP from CFG from CET at the moment it matters. Every mitigation fails a different primitive in a different way. This skill reads the audit and the exception code and tells you exactly which guard fired and what it kills.

    What your agent does

    • Audits the mitigation flags: dumpbin /headers /loadconfig, Process Explorer and Get-ProcessMitigation, per binary and per process.
    • Compiles controlled targets: graduated MSVC flags (/NXCOMPAT, /DYNAMICBASE, /HIGHENTROPYVA, /GS, /guard:cf, /CETCOMPAT) to isolate one protection at a time.
    • Reads the exception code: 0xC0000005 for a DEP execute fault, 0xC0000409 subcode 2 for /GS, subcode 10 for CFG, 0xC0000407 for CET.
    • Shows what each guard kills: stack shellcode, fixed-address ROP and function-pointer overwrites, mapped to the mitigation that blocks them.
    • Builds the hardening picture: system-wide and per-binary posture, so the bypass design starts from facts, not guesses.

    Built-in guard rails

    • Audits, does not modify: it reads your dumpbin and Get-ProcessMitigation output. You run the tools and any lab changes.
    • No secrets needed: it works from binary headers, process flags and WinDbg exception codes.
    • Authorized targets only: bypass planning assumes a Windows target you are permitted to test.

    What's inside

    One SKILL.md of about 62,700 words across 12 sections and a six-day structure, with hundreds of WinDbg and MSVC worked examples, plus a LICENSE.txt.

    Works with Claude Code, Codex, Cursor, and any agent that loads SKILL.md.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    It audits and explains; it does not modify your system or build bypasses for you. Reproducing the exception codes needs a Windows lab VM and WinDbg. Apply it only to targets you are authorized to test.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 day ago

    Windows only

    Software
    Claude Code
    orCodex
    orCursor
    Optional
    WinDbgdumpbinProcess ExplorerGet-ProcessMitigationWindows lab VM

    Permissions

    Terminal / Shell
    Network Access
    Read Files
    Write Files
    Environment Variables

    Allowed Hosts

    attacker
    Listed1 day ago

    What's inside

    Frequently Asked Questions

    No. It reads your dumpbin and Get-ProcessMitigation output and explains it. You run the tools and any lab changes yourself.

    No. It works from binary headers, process flags and WinDbg exception codes.

    An agent that loads SKILL.md, plus a Windows lab VM and WinDbg if you want to reproduce the exception codes.

    No. It goes through CFG, CET shadow stack, SEHOP, ACG and Heap Guard, with the exception code each one raises.

    New in Security