Ditmar Wendt

mostly use this website as an RSS feed. 🗝

[Specter @SpecterDev]

I've published a write-up on reversing and analyzing Samsung's H-Arx hypervisor architecture for Exynos devices, which has had a lot of changes in recent years and pretty interesting design. Hope you all enjoy :)

https://t.co/KTJ5IKfSfP

[Ditmar Wendt @DitmarWendt]

@LowLevelTweets not really the case for competitive CTFs in 2014 https://t.co/tfg9I4JMD7

[Satoshi Tanda @standa_t]

My slide deck at #TheSAS2024 is available on GitHub!
https://t.co/nX2vFOVLvX

Thank you all crew for the opportunity to present it

[Ryan M @Grimdoomer]

Here’s a blog post covering all the technical details behind a strcpy bug I found in the Tony Hawk video game series that can be used to hack several gaming consoles and even get RCE on the over the network https://t.co/8vZgnTQhUk

[Can Bölük @_can1357]

Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles.
It has worked against every version of Patchguard for the last 7 years, without needing any updates!
https://t.co/H5dDddpuMP

[Ditmar Wendt @DitmarWendt]

@landaire the outrage is disingenuous for clicks because he can't simply say 'it's just kind of dangerous to keep recordings of everything you do'

[Ditmar Wendt @DitmarWendt]

@mkolsek probably just a mistranslation from engineering, but xxxTooltipWndProc has been useful before and it's win32k so of course it's possible there were some bugs attributable to other tooltip code

[Ryan M @Grimdoomer]

The Halo 2 HD blog post is out! This covers everything I did to get the game rendering in HD resolutions from patching the rendering engine and memory allocators, to hot patching the Xbox OS, and overclocking the GPU and getting perf measurements https://t.co/A1CptPuHOu

[Ditmar Wendt @DitmarWendt]

@ootiosum Set-Processmitigationpolicy to disable ProcessSignaturePolicy for vmwp may fix?

[Ditmar Wendt @DitmarWendt]

@ootiosum nvm, I see you found the former in vmchipset :)

[Ditmar Wendt @DitmarWendt]

@ootiosum you must be using an older SKU, to find grab ripgrep and rg -i -a -l "AMIBIOS"

since it's gen2, you'll probably want the hyperv-enlightened EFI as well as the amibios image, which ought to be in vmfirmware.dll.

can also just hook the bios dvice inrfaces: https://t.co/EvacsSdbIi

[Geebz @Gbps111]

I just published the long-awaited Part 2 to my PCIe blog post series - "All About Memory: MMIO, DMA, TLPs, and more!"

This post also includes a companion experiment where I dive into what pcileech looks like over a PCIe protocol analyzer. Please enjoy!

https://t.co/wAD7HYG6IW

[Ditmar Wendt @DitmarWendt]

@Kharosx0 @sixtyvividtails maybe BP HalHandleNMI just to log and g;? could be happening during your breaky cmd

[clearbluejar @clearbluejar]

Patch Tuesday Diffing 🔥👀

Starting new blog series: https://t.co/PFgyFMU66N

[Ditmar Wendt @DitmarWendt]

@vinuscule @RKRigney both require an undetected first stage that could already access all user data, yes.

[Ditmar Wendt @DitmarWendt]

@vinuscule @RKRigney the risk posed to a home user is the same. km access is desired to disable security event monitoring, talking to these 3p driver's interfaces is already noisy, and most are unelevated local admin. implies some undetected first-stage execution already.

[Ditmar Wendt @DitmarWendt]

@vinuscule @RKRigney the always-running property of a specific one is not mandatory for all code that runs in the kernel; starting and stopping them occurs for the majority.

[Ditmar Wendt @DitmarWendt]

@vinuscule @RKRigney is your belief that there is some significant security boundary between the windows kernel and a game running as a user (which is more often than not a split-token administrator account)?

[Ditmar Wendt @DitmarWendt]

@vinuscule @RKRigney every line of code written can introduce a new attack vector; interested in what's special to you about doing so in the kernel.