winterknife 🌻

low-level developer with a focus on 𝙸𝚗𝚝𝚎𝚕 𝚡𝟾𝟼 ISA devices running 𝚆𝚒𝚗𝚍𝚘𝚠𝚜 | R&D @BHinfoSecurity |

[winterknife 🌻 @_winterknife_]

Releasing SILVERPICK, a Windows shellcode development framework using C/C++.

https://t.co/Jk94d3OvMX

[Michael Weber @BouncyHat]

We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC

#wasm #malware #sliver

[Yarden Shafir @yarden_shafir]

This gets even dumber. Microsoft built a VBS enclave into msedge! It protects data even from kernel drivers! That would've been the perfect place to store passwords! And they are using it to store... a bit of static configuration data.

[Connor McGarr @33y0re]

It seems like in the latest preview build(s) ETW functionality has been encapsulated in it's own DLL (ETW.dll) -e.g., ControlTrace/etc. are now exported by this DLL instead of sechost/ADVAPI32/etc. Seems to just be code re-org (for now) - but maybe the future will reveal more!

[Zero Day Engineering @zerodayalpha]

New Zero Day Engineering research: Chrome Exploit Mitigations, by @alisaesage https://t.co/vMRAk24Zhi

[Exodus Intelligence @XI_Research]

We’re opening the Exodus research vault.

Over the coming weeks, we’ll publish technical writeups highlighting vulnerability research, exploit development, and deep reverse engineering from our team.

First up: Michele Campa’s Adobe Acrobat Reader Escript.api use-after-free RCE.

https://t.co/iycMuZQLix

#VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #OffensiveSecurity #CyberSecurity

[winterknife 🌻 @_winterknife_]

@3mdeb_com Well, I always wanted to build a hardware-based password manager.
Not that I really need the UL SoC variant, it's more of a defense-in-depth-type scenario (encrypted RAM, CAAM black keys, cryptographic acceleration via PKHA, HW support for AES-256, better TRNG).

[Or Yair @oryair1999]

Fresh @safebreach Labs research! 🔥
CVE-2025-59199 breaks down a highly creative low-integrity Windows LPE path.
Learn how Notifications, COM objects, URIs, DevTools, and Windows Apps chain together in a single exploit. Great work team! 👇
https://t.co/1PgKB1WIxe

[Michael Weber @BouncyHat]

I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.

Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.

https://t.co/yFF65A8MQO

[dennisbabkin @dennisbabkin]

Reverse Engineering - Resolving Confusion Over PsGetCurrentProcess, PsGetCurrentProcessId and PsGetProcessId - Using WinDbg to understand dependency between KPCR, KPRCB, K/ETHREAD, K/EPROCESS and KAPC_STATE structures. https://t.co/VJH5P1pYn5

[Calif @calif_io]

RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation

Just showing some appreciation for @ChaoticEclipse0's excellent work. Hopefully this won't get us banned!

https://t.co/Z4zbaa2Jcd

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[winterknife 🌻 @_winterknife_]

@G3tSyst3m @NytroRST But you see, it is not Memory Integrity / HVCI's mandate to restrict a WHQL-signed driver from loading.
It could be prevented by the WDAC blocklist tho which you showcase quite well at the end of your blog post, might I add.
Anyway, didn't mean to bring you down, cool stuff!

[scriptjunkie (Matt) @scriptjunkie1]

Gargoyle a decade later
https://t.co/QJSTvwxsyY

[winterknife 🌻 @_winterknife_]

@4D4J_ Right now, none of the three techniques that I showcase can "bypass" HVCI.
PFN swapping is one of the few techniques that work against HVCI and KDP.
https://t.co/GrbInqP4QQ

[winterknife 🌻 @_winterknife_]

Updated my project to bypass write protection via PTE manipulation.
HVCI / KDP will prevent this technique by marking the code / data page as read-only in the SLAT entry.
Do note that the Dirty bit is clear in the PxE despite the page being written to.
https://t.co/IMPevg6mws

[winterknife 🌻 @_winterknife_]

Made a small project to bypass write protection and write to read-only pages in kernel space.
Nothing novel here, but the code is well commented for your reading pleasure.
I hope you will find it useful in your no doubt questionable endeavors :)
https://t.co/nfywedsWnM

[secret club @the_secret_club]

Striga: Lifting x86 to LLVM IR with Python by @mrexodia

https://t.co/7iYajj8gIZ

[Paolo Stagno (VoidSec) @Void_Sec]

I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX.
https://t.co/agxyuR2AjE

[quarkslab @quarkslab]

Did you know that Windows processes fundamental to Operating System security run in Isolated User Mode and can not be debugged ?
Well that's true except when it isn't.
Here @fdfalcon provides a step by step guide to do it
https://t.co/Gya2QELd8O

#Windows #ReverseEngineering

[winterknife 🌻 @_winterknife_]

@tacbliw Yeah, that's what I do too.
Thought I'd try debugging it using nested virt on an old Linux host for a change.
I mean I know it'll be slow af and unsuitable for fuzzing but I can't even get it to boot lol

[winterknife 🌻 @_winterknife_]

Has anybody ever tried debugging Hyper-V running on VMware hypervisor, over serial port emulation via named pipe?
After the initial break in WinDbg on the debugger VM, the debuggee VM just hangs and never finishes booting.