KTM_POCS
Reports and proof-of-concept code for two vulnerabilities in the Windows Kernel Transaction Manager driver, tm.sys.
CVE-2024-43570
CVE-2024-43535
Profile · Bearer
Researching what lives beneath the intended interface.
Jael Koh is a security researcher based in Singapore. His public work spans Windows internals, reverse engineering, and exploit development.
In 2025, Jael presented Windows Kernel Transaction Manager research with Cedric Halbronn at POC (opens in a new tab) and OffensiveCon (opens in a new tab).
Research · Records
Fieldwork under inspection
Published repositories and technical work, presented as a ledger—not as fictional achievements.
OSEP_OSED_TOOLS
A Windows enumeration script for OSEP and a Python exploit template for OSED workflows.
OSEP_enum.ps1
OSED_exploit.py
Inspection notes · R / 01
Windows 11 Kernel Transaction Manager
Jael found and reported two use-after-free vulnerabilities in tm.sys. The public repository contains both reports and the demonstration code used at OffensiveCon25.
- Identifiers
- CVE-2024-43570
CVE-2024-43535 - Component
- Windows Kernel Transaction Manager
- Disclosure
- Reported June and July 2024
Fixed October 2024 - Published form
- Reports, proofs of concept, presentation demos
Inspection notes · R / 02
Exploit-development utilities
OSEP_enum.ps1 automates common Windows host-enumeration checks. OSED_exploit.py helps assemble and disassemble shellcode, construct ROP chains, and identify bad characters.
- Languages
- PowerShell and Python
- Published
- February–March 2024
- Included files
- OSEP_enum.ps1
OSED_exploit.py - Related writing
- My First Year In InfoSec: Zero to OSCE3
The repository does not declare a reuse license. Review the source terms before adapting the code.
Talks · Signals
Recorded talks
Two presentations tracing the same Windows Kernel Transaction Manager research with Cedric Halbronn.
Revisiting Windows 11 KTM
Lessons learnt from new vulnerabilities, presented by Cedric Halbronn and Jael Koh.
Hunting for Overlooked Cookies
Windows 11 KTM vulnerabilities and the challenge of baking working exploits for them.
Signal notes · T / 01
Revisiting Windows 11 KTM: Lessons Learnt from New Vulnerabilities
A POC 2025 presentation in which Cedric Halbronn and Jael Koh revisit their Windows 11 Kernel Transaction Manager research and the lessons it produced.
- Event
- Power of Community 2025
- Place
- Four Seasons Seoul, Korea
- Date
- 13–14 November 2025
- Speakers
- Cedric Halbronn and Jael Koh
Signal notes · T / 02
Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them
The joint presentation follows the discovery of two use-after-free vulnerabilities in Windows KTM and the challenges of exploiting them on Windows 11.
- Event
- OffensiveCon 2025
- Place
- Berlin, Germany
- Date
- 16 May 2025
- Speakers
- Cedric Halbronn and Jael Koh
Writing · Archive
Writing archive
Long-form notes on security learning, exploit development, training, and a web CTF challenge.
W / 01 · 2025 archive
My Second Year In InfoSec: OSEE, the Odyssey
A retrospective on preparing for and earning OSEE, attending live training and conferences, beginning independent Windows research, and reflecting on the journey.
Read the essay (opens in a new tab)
W / 02 · 2024 archive
My First Year In InfoSec: Zero to OSCE3
A detailed first-year retrospective covering the learning path, exam experiences, tools, and lessons involved.
Read the essay (opens in a new tab)
W / 03 · Web CTF
SEETF 2023: 福
A technical write-up on recursively signing Flask session cookies to satisfy an SMT-backed math constraint.
Read the write-up (opens in a new tab)W / 04 · Schedule archive
Upcoming EXP-401 Live Trainings
An archived tracker updated 15 January 2025. Its listed sessions are from 2025; consult the source links for current availability.
Open the archive (opens in a new tab)Contact · Dispatch
Find Jael elsewhere
Read longer notes on the blog, view public code on GitHub, or follow Jael’s professional profile and updates.
No hidden form or invented inbox—each route below goes directly to a public profile.