kernel exploitation
The Kernel Attack Surface: How Windows Internals Enable Exploitation
A subsystem-by-subsystem map of the Windows kernel attack surface — how the syscall interface, I/O manager, memory manager, object manager, and kernel pool each create exploitable primitives, which techniques still work, and which ones died.