Skip to content

Conversation

@ck0i
Copy link
Contributor

@ck0i ck0i commented Feb 1, 2026

Summary

  • Replaces blocking WaitForSingleObject(INFINITE) with busy-wait polling in SendReadRequest and SendWriteRequest
  • Reads spin on a sentinel value (0xC0FEBABEC0FEBABE) written to the destination buffer, detecting completion as soon as MmCopyVirtualMemory overwrites it before the kernel even signals KmEvent
  • Writes spin-poll the event with zero timeout to avoid thread scheduler wake-up latency
  • No kernel ROP chain changes, usermode-only (had a crash when performing kernel ROP chain changes)

Closes #38

Test plan

  • Verified read + write round-trip against live notepad.exe target

Replaces blocking WaitForSingleObject calls with busy-wait
polling in SendReadRequest and SendWriteRequest.

Reads use a sentinel value on the destination buffer to detect
completion as soon as MmCopyVirtualMemory overwrites it, before
the kernel even signals KmEvent. Writes spin-poll the event
with zero timeout to avoid thread scheduler wake-up latency.
@krispybyte
Copy link
Owner

Currently, I am still debating whether or not I want #38 implemented or not, since it obviously spikes CPU core usage due to the busy-waiting. I am not sure whether this trade off is worth it for roprw. perhaps we could consider some toggle setting for usage/when compiling the project?
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Usermode busy waiting for performance gains

2 participants