Archie

Hobby security researcher, 20.

[Archie @Archie_1997]

Looks like this post attracted the attention of MSRC - so just to confirm: this is not a vuln!

This is a teaser of my upcoming Secure Kernel research series, and while I did get unsigned drivers to load, it can only be done by breaking the root of trust. Not VTL 0.

[Archie @Archie_1997]

That's right - an unsigned driver loaded and running with #HVCI enabled.
And the best part? The system still appears as locked down.

Article coming soon.

[winterknife 🌻 @_winterknife_]

Wintel is coming for your SMEP bypasses!
No more flipping the U/S bit in a PTE to mark a user-mode page as supervisor-mode on Intel Arrow Lake CPUs :)
(note: this is meant for protection against speculative attacks, with the side effect of becoming SMEP 2.0)

[winterknife 🌻 @_winterknife_]

TIL: If you disable DSE by modifying nt!g_CiOptions to load an unsigned kernel driver, it will be logged :)

[Archie @Archie_1997]

@33y0re Glad you like it!

[sixtyvividtails @sixtyvividtails]

Microsoft put C:\inetpub junk there for a reason 🫠
CVE-2025-21204 #greatfix

[Archie @Archie_1997]

@sixtyvividtails The threads actually aren't valid objects either! The !object command fails when given the address of an idle thread. Windows Internals also confirms this should be the case.

[Archie @Archie_1997]

Getting code execution in a process that cannot be located using traditional kernel APIs and is untouchable from usermode? All while staying PatchGuard-friendly?

Sign me up: https://t.co/cbwQzuzrv9

[Archie @Archie_1997]

@panchoszczcur @RiotVanguard Oh, great catch. I'll edit the article to properly list the authors. While the thread you posted is a great resource, I couldn't find any post discussing the actual hooked methods. I'm not part of any cheating circles, therefore if the info is shared on Discord, I wouldn't know.

[Archie @Archie_1997]

Dug into @RiotVanguard's kernel driver's dispatch table hooks.

The article took an unexpected turn half way through, as I found some not yet documented stuff, such as the complete list of system calls hooked by the driver.

Article link:
https://t.co/LNDTAyZXz4

[Archie @Archie_1997]

@panchoszczcur You make great points. Hooking ETW is certainly not a new technique, and there is multiple ways of hijacking CF via it. You sadly didn't save the rewrite in time, as I started looking Vanguard's hook right after publishing this article.
I'm sorry you didn't learn anything new.

[Archie @Archie_1997]

ETW is an incredibly powerful tool in the wrong hands.
Just finished writing about how it allows drivers to hook context switches on Windows 11 24H2 while remaining PatchGuard and HVCI compatible: https://t.co/Qqq6ZLgM7t

[Archie @Archie_1997]

@sixtyvividtails @Denis_Skvortcov That's incredibly helpful! Thank you for pointing it out, it's really a godsend ����

[Archie @Archie_1997]

Hooking context switches on 24H2 like InfinityHook did in the old days...

My first writeup's coming soon 😊

[Archie @Archie_1997]

@tulachsam RWEverything delivering as always - got a clue as to why the mapping fails on Windows 11?

[Archie @Archie_1997]

@worldoftanks No Chief, yet again...

[Virtually Fun @virtuallyfun]

Is it me or does it look like the crowdstrike driver is loading arbitrary binary files into kernel space and executing them?? Is csagent bypassing all security of the kernel?? The faulty file is all 00s!!

[Archie @Archie_1997]

Turns out if you bp nt!MiCopyFromUntrustedMemory, you prevent WinDbg from working at all

[Archie @Archie_1997]

yooo why vgk.sys tryna query KVM clocks, I ain't even running the riot client 😭😭😭
#valorant #vanguard

[Archie @Archie_1997]

@wisdomicz @gf_256 System Informer can't do that because of Microsoft threatening to no longer sign their drivers. Look around and find the last build of Process Hacker (v3.0.4953), it doesn't yet have these restrictions.