Skip to content
Ctrl K

Free Writable Area (FWA)

A Free Writable Area is a physical page in the gaps outside the ranges the OS manages as RAM, reachable through a physical memory primitive and stable enough to hold attacker data. The term comes from the Exploit Pack DOG series, where FWA pages are the shared workspace behind every kernel table hijack: the original page is never written, only a clone living in a gap.

That is the general trick, and why this page exists in primitives/ rather than inside a single technique: any page the OS or a defense watches can be cloned into memory nothing watches. Code integrity does not scan unmanaged gaps. Pool integrity does not cover them. A periodic integrity check on the real page passes, because the real page was never modified.
Requires A physical memory read/write primitive.
Provides Hidden, persistent workspace pages usable as clones.
Visibility Outside OS memory maps; invisible to pool and code integrity.
Introduced to the corpus Exploit Pack DOG series, 2026.

Finding and validating one

The physical address space is larger than the RAM the OS enumerates. Gaps between firmware-reserved, MMIO, and OS-managed ranges contain pages that are real and writable but unmanaged. The DOG workflow:

  1. Enumerate the managed ranges, from the physical memory primitive's own view of the map.
  2. Pick a candidate page in a gap.
  3. Validate: write a pattern, read it back, restore. A page that holds the pattern and gives it back unchanged is usable; one that does not is firmware-mapped or dead.
  4. Treat it as scratch: clone the target page's contents in, modify the clone, repoint whatever page-table entry controls the original, trigger, restore.

The validation loop is also the detection story: pattern writes into physical memory outside managed ranges have essentially no legitimate explanation.

What it composes with

  • Kernel table hijacking (SSDT, Shadow SSDT, IDT, GDT): the FWA clone is the modified table the processor is transiently shown. See the Juan Sacco / DOG profile.
  • Any data-only attack needing scratch that survives while the real target stays pristine for integrity checks.
  • Physical R/W sources: the BYOVD physical-memory mappers in the corpus, Capcom.sys and its relatives, are the typical entry.

Limits

An FWA page is only reachable while the physical primitive holds, and only matters while something points at it. On HLAT-enabled hardware, repointing a guest PTE at an FWA clone should not change translation, which would close the table-hijack family entire; that inference is basis: inferred, recorded on the DOG profile.

Detection

The pattern-validation loop (write pattern, read back, restore) into unmanaged physical ranges; enumeration of the physical memory map from an unprivileged context; and any transient PTE pointing at a physical address outside managed RAM.