[EP_X0FF]

Some of the key Windows 10 binaries for people who don't want to download new gigabytes of the same Vista trash.

x64 6.4.9841 aka win 10 TP

files:

ci.dll
ntoskrnl.exe
gdi32.dll
user32.dll
ntdll.dll

[TETYYSs]

is ntoskrnl
MD5: 3cb96a9cfd473bec45e9a09a2ee7c1a0
SHA-1: 34aed5d850ae712a771de799ed192f4cf32800a4
?

[redp]

you anyway need symbols (bcs microsoft don`t released it in public symbol server)

[rkhunter]

For above files symbols in attach.

[rkhunter]

Btw, look to list of loaded drivers. Now we have 3 win32k drivers: win32k.sys, win32kbase.sys and win32kfull.sys.
Also very interesting exports in ntoskrnl (MmLoadSystemImage, PsLoadedModuleList) & win32k (related to GUI SSDT on read access).
New fields in kprocess & kthread related to security +0x1B8 kprocess.SecureProcess, +0x31C kthread.SecureThreadCookie.
+ new type of synchronization objects "Auto Expand Push Lock".

I've uploaded list of new exports here http://artemonsecurity.com/win10tp_nt_exports.txt

[EP_X0FF]

Also very interesting exports in ntoskrnl (MmLoadSystemImage, PsLoadedModuleList) & win32k (related to GUI SSDT on read access).

Seems trend continues, old known things become half-public/working. AFAIR in win8.1 NtSystemDebugControl is back in meaning it again can be used to read kernel memory.

[rkhunter]

I've attached win32k.sys, win32kbase.sys, win32kfull.sys and symbols.

[EP_X0FF]

Dumped ntoskrnl pdb from Windows 10 Technical Preview - January 2015.