diff --git a/MS16-098/README.md b/MS16-098/README.md
index f52055a..0b1278b 100644
--- a/MS16-098/README.md
+++ b/MS16-098/README.md
@@ -11,7 +11,8 @@ Vulnerability reference:
 
 ## References
 
-[The previously discussed MS16-098 writeup](https://sensepost.com/blog/2017/exploiting-ms16-098-rgnobj-integer-overflow-on-windows-8.1-x64-bit-by-abusing-gdi-objects/)
+* [The previously discussed MS16-098 writeup](https://sensepost.com/blog/2017/exploiting-ms16-098-rgnobj-integer-overflow-on-windows-8.1-x64-bit-by-abusing-gdi-objects/)
+* [DC25 5A1F - Demystifying Windows Kernel Exploitation by Abusing GDI Objects](https://github.com/sensepost/gdi-palettes-exp)
 
 
 
diff --git a/MS16-098/gdi-palettes-exp.zip b/MS16-098/gdi-palettes-exp.zip
new file mode 100755
index 0000000..bc90f20
Binary files /dev/null and b/MS16-098/gdi-palettes-exp.zip differ