Evilcry_

Partime Garbage Collector - Reverse Engineering hobbyist.

[cr3ghost @cr3ghost]

This is why the anti-cheat arms race is getting so interesting.

Riot is pushing Vanguard further into hardware-backed trust, attestation, VBS/HVCI, IOMMU and deeper platform security.

At the same time, AI-assisted reverse engineering is making it much faster to tear apart the software sitting on top of those protections.

@k0mkc is showing heavily devirtualized VGK internals and says he can now devirtualize the entire thing.

On the EAC side, @in19h has published tooling that recovers large parts of a heavily virtualized Easy Anti-Cheat Linux sample into readable code and IDA artifacts:

https://t.co/gp1E7W4Uon

There is an important parallel here with EDR.

An EDR is only as effective as the detection engineering, threat hunting and R&D behind it. Anti-cheat works the same way.

You need researchers constantly following new techniques, detection engineers turning that research into useful telemetry and detections, and people actively hunting for behaviour that existing rules may miss.

That means continuously keeping up with:

- new cheat architectures
- kernel abuse
- BYOVD
- hypervisors
- DMA
- firmware tricks
- input manipulation
- virtualization + obfuscation
- new bypass techniques

The game was already there. AI is speeding it up and lowering the barrier to reversing, classification, devirtualization and research.

That forces both sides to iterate faster.

A lot of respect to the Vanguard team as well. They have clearly been keeping up with some of the most cutting-edge work in Windows security, hardware-backed trust, kernel security and anti-cheat research, and their recent Vanguard On-Demand changes show how quickly the defensive side is evolving too.

This is becoming a much faster research cycle on both sides.

Where does the arms race go next?

Huge credit to @k0mkc and @in19h for the research.

#AntiCheat #ReverseEngineering #WindowsInternals

[Farenain @Farenain]

As promised, here is a thread about the research I've done in VMProtect!

First, the decompiled version with Binja (@vector35) from the original binary, the vm_entry of VMProtect and finally a lifted version after the analysis! A total of 256 handlers analyzed

Follow here!🧵

[PELock @PELock]

Invoking Assembly Functions from MSVC-compiled x64 C Program

https://t.co/M8I3i9Vrlp

#programming #assembler

[cr3ghost @cr3ghost]

They did it again. This time it's Tencent's kernel anticheat VM.

815 of 865 virtualized functions across four kernel drivers statically devirtualized back to native code. 94.2 percent coverage, 99.3 on ACE-GAME.sys.

Same approach. Guided symbolic execution, constant promotion, constant folding. The entire math obfuscation layer comes down to sixteen identity rules that fit on one screen.

If you're unpacking malware protected by Themida or VMProtect, this is the same problem. Same VM architecture, same obfuscation patterns, same deobfuscation techniques. Doesn't matter that it's anticheat, you're learning the same skills.

Denuvo anti-tamper is next.

https://t.co/FKRijJIBXk

Author: @BackEngineerLab @_xeroxz

#ReverseEngineering #MalwareAnalysis #Infosec

[PELock @PELock]

Intercepting HTTPS traffic from a VM for debugging

https://t.co/q9VaOkG8hF

#Networking #hacking

[Aftermath Labs @aftermath_labs]

Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now.
https://t.co/0Aog04fEvv

[TrendAI Zero Day Initiative @thezdi]

Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://t.co/H9PUy1KsTO

[quarkslab @quarkslab]

Obscure Element: Reverse engineering Xiaomi's MJA1 secure chip.

Mengsi Wu's journey starts here:
https://t.co/T7oyNwU29H

[quarkslab @quarkslab]

Tired of reversing the same libc for the 100th time? 👀

Meet SightHouse, our open-source tool that automatically detects third-party library functions in binaries.
High-confidence function mapping. Works with any disassembler. By @Mad5quirrel & Sami.

🔗 https://t.co/PVxOyyISG9

[Rodrigo Branco @bsdaemon]

Vulhunt is now open-source, this is a game changer: https://t.co/kTLFiaktkV @binarly_io @vulhuntdev

[Florian Roth ⚡️ @cyb3rops]

Now everyone in the third world can get access to rich people’s Claude Code subscriptions
https://t.co/I01RcHiktG

[R136a1 @TheEnergyStory]

This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses:

• Sideloading via MFC satellite DLLs
• Control flow redirection trick (+ POC)
• Patchless ETW and AMSI bypasses (+ POC)
• Extensive COM usage for registry, file and folder operations (+ partial POC)
• Strings encryption (+ IDAPython decryption script)
• Including IOCs and Yara rules

https://t.co/FK8uAq9iyK

[hasherezade @hasherezade]

Long overdue, but here’s my writeup for #FlareOn12 Task 9: https://t.co/PclZkggtrf

[Giuseppe `N3mes1s` @N3mes1s]

I think that the definition of "Vulnerability" is really a subjective matter.

I found an issue and reported to Google on FlatBuffers library, closed as wont fix because intended behaviour BUT it is a heap corruption leading to an RCE (non exposed by default api)

Full report:
https://t.co/m31tNuTtmt

Opened a issue on github to understand the reasons:

https://t.co/hgkGCMFmvq

I have another one for a very famous open source UI used for the LLM Chats and Agents, pre-loading tools even for non-authorized user

"Loading is not the same as executing" ...

Still, it is an auth bypass in my world.

In the meantime link to the definition?

https://t.co/sl7o3PpnYW

🥴

[Giuseppe `N3mes1s` @N3mes1s]

CVE-2025-12044 - Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

https://t.co/KjWL7H9kbe

For today's test with #pruva i tried to go with an unconventional reproduction, a DoS.

The agents went down to pprofing, performance analyzing various experiments, at the end they were able to reproduce it.

[Jai Minton @CyberRaiju]

We're seeing active exploitation for a recent 0-Day in WSUS which received an out of band update to it. 🔥

CC: @HuntressLabs

👇

[Giuseppe `N3mes1s` @N3mes1s]

CVE-2025-55315 - https://t.co/7NbdDJPIoV Kestrel HTTP Request and Response Smuggling

Another automated reproduction from #pruva - this time plus a bonus point: A Detection!

https://t.co/Iw9LQ4aldM

Link to the really good blogpost from @7urb01

https://t.co/LPgzdmgqta

[_leon_jacobs(💥) @leonjza]

I've been hacking on a new Windows Named Pipe tool called PipeTap which helps analyse named pipe communications. Born out of necessity while doing some vulnerability research on a target, its been super useful in reversing it's fairly complex protocol. :)

[Matan Bahar @Bl4ckShad3]

Windows Fonts Exploitation in 2025 - Bypassing UAC with Eudcedit
Check out my recent research about eudcedit and see how it can by used to bypass UAC.

https://t.co/mxepSjIwiC

#UserAccountControl #UAC #Bypass #Windows