ro62418911

IT student , webapp developer

[Dark Web Informer @DarkWebInformer]

deGDID: Deletes all instances of Microsoft's GDID and prevents minting of new ones

GitHub: https://t.co/IWwQXB9Owg

[ro62418911 @bromium_]

@AshCrypto I visit turkey couple years ago , it was 1 € = 2.5 lira
Now lira is died this is future of all traditional currencies

[ro62418911 @bromium_]

@AddictCryptoBoy @sovrae_io This is insane , how about stop advertising that shit service

[ro62418911 @bromium_]

@CR1337 @AgoraPrivacy Esim service are crazy 5 lgb coast you more than any plan prices regardless exipred in 5 days

[ro62418911 @bromium_]

@Zara_588 10 hols + @elonmusk asshole

[ro62418911 @bromium_]

@GrapheneOS Which motorola i wanna bought one

[Duty @duty_1g]

🚀 x64dbg-MCP Server — fully automated, dynamic, agentic reverse engineering for x64dbg.

🧠 71 MCP tools
🤖 Fully automated & dynamic agentic RE
🔴 22 debugger event callbacks
⚡ Native Zig plugin — zero dependencies
🛠️ Breakpoints, memory, registers, tracing, xrefs, PE analysis & more
🌐 Streamable HTTP + SSE
📦 x32 + x64
Let your AI agent control, analyze, debug, and dynamically reverse engineer binaries directly through x64dbg.
🔗 https://t.co/5gmqJw6SVm
#x64dbg #MCP #AgenticAI #ReverseEngineering #CyberSecurity #RedTeam #MalwareAnalysis #Zig

[Coffin @lostsec_]

Use https://t.co/bonasCLhpZ to find subdomains. You get every subdomain on file, along with the date each one was first seen. And it’s insanely fast, results come back within seconds. ⚡
https://t.co/JrA9LlJeec

https://t.co/nibgzFgTFL

[ro62418911 @bromium_]

@radioalgerie_ar ليعلم حاضر الغائب في الجزائر الهندي وتركي وسوري وكردي يتقصى اجر 3000-5000$ لشهر اما الجزائري فله 100$

[ro62418911 @bromium_]

@linuxuser1996 Google wants to control you. Switch to GrapheneOS but GrapheneOs wants you to buy Google pixel phone

[Clandestine @akaclandestine]

https://t.co/JNsDGlaxCe

[ATTACKD @StartATTACKD]

We built a C2 implant that walked past Microsoft Defender clean. No static hits or behavioral alerts.

Then Windows SmartScreen killed it. We never even reached EDR.

We tested the Mark of the Web bypasses everyone cites. Here's what we found:
https://t.co/3nUOZHev2b
#redteam

[ro62418911 @bromium_]

@qatnology بنك اسلامي و jp morgen هل انت بخير

[ro62418911 @bromium_]

@durov @WhatsApp behinde this once thier app is ugly

[Panos Gkatziroulis 🦄 @ipurple]

EkkoNtProtect - Arbitrary NtProtectVirtualMemory calls from Ekko-style timer-based sleep obfuscation using internal ntdll functions https://t.co/39lOUsWAsx

[BytecodeAssassin (Husam) @oneandonlyhusam]

Everyone considering a professional career in security research, RE, and Malware Analysis needs to know YARA Rules.

YARA Rules are used throughout the industry next to STIX 2.1 Standard to classify and identify malware.

It's in essence, pattern matching utilizing static signatures from strings, IOC's and other unique identifiers close to functionality as possible. You can't use the digest/hash on a family that mutates with new variants and forks every week so YARA fixes that problem.

I encourage you to get familiar and read the docs which I will link below. I write YARA rules for every analysis I conduct and I post on https://t.co/OzGP5VPli2

https://t.co/R8DtLrUeV8

#cybersecurity
#malware
#reverseengineering
#malwareanalysis

[cr3ghost @cr3ghost]

Want to understand UEFI bootkits at a low level? Whether you're doing malware analysis, reverse engineering, exploit development, or kernel research, these are the resources that actually matter.

First in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11. Exploits CVE-2022-21894 (BatonDrop), enrolls attacker MOK keys, deploys a kernel driver and HTTP downloader. Sold for $5,000 on forums.
https://t.co/fNwbMZf6VP by @welivesecurity

UEFI firmware rootkit targeting VMware VMs. Design inspired by CosmicStrand, MoonBounce, and ESPecter. Injects into a UEFI driver firmware volume, hooks ExitBootServices, catches WinLoad.EFI, hooks OslArchTransferToKernel, then injects a stager into ACPI.SYS to reach kernel execution without triggering PatchGuard. Originally by Austin Hudson (@ilove2pwn_) who deleted his account. Mirrored here.
https://t.co/exQwZAJNRC

Binarly's analysis of BlackLotus by Alex Matrosov. Reveals that BlackLotus's code is directly based on btbd's Umap project from 2020, same main function logic, same ImgArchStartBootApplication hook chain, identical trampoline code. Game hacking UEFI bootkit code combined with a publicly available Secure Boot bypass PoC became the first in-the-wild bootkit to defeat Secure Boot. Also covers the CVSS scoring problem, supply chain failures in UEFI revocation, and MokList NVRAM manipulation.
https://t.co/ln2C9R3FRO by @binarly_io

The book. Covers everything from legacy MBR bootkits to modern UEFI implants, firmware rootkits, and Secure Boot internals. If you only read one thing on this list, make it this.
https://t.co/zzuWAZzMkM by @matrosov

ESPecter. Real-world UEFI espionage bootkit found in the wild with roots back to 2012. Patches bootmgfw.efi on disk, hooks the boot chain, disables DSE by patching SepInitializeCodeIntegrity in the kernel. Deploys a keylogger and document stealer.
https://t.co/NICFgvZ1n8 by @welivesecurity

Reverse engineering of https://t.co/pUkqJffhP9's kernel driver by IDontCode. Shows how the entire cheat is public code resold for six figures. Documents the win32kbase.sys vtable pointer swap for kernel function invocation, manual driver mapping using btbd's modmap, and communication via Can's NtConvertBetweenAuxiliaryCounterAndPerformanceCounter .data pointer hook. Credits both Can and btbd directly.
https://t.co/54VOuaMB97 by @BackEngineerLab

One of the earliest public Windows UEFI bootkit PoCs. Patches winload.efi to disable DSE and load unsigned kernel drivers. Directly inspired EfiGuard.
https://t.co/b2wq94ssRs by legendary anti-cheat engineer @aidankhoury

Bootkitting Windows Sandbox. Patches bootmgfw.efi inside the sandbox VHDx to hook the boot chain, disable PatchGuard and DSE, and load unsigned drivers without a debugger attached. Built for kernel research and driver development.
https://t.co/nezWcEdoQG by @mrexodia and @sdoogm from @the_secret_club

UEFI DXE driver that passively disables PatchGuard and DSE at boot time. Does not modify bootmgfw.efi on disk. Instead hooks EFI System Table LoadImage to intercept the boot chain in memory, then patches SepInitializeCodeIntegrity and KeInitAmd64SpecificState in ntoskrnl. Supports every EFI-compatible Windows x64 from Vista SP1 to Windows 11.
https://t.co/Z6NHAmXzJ4 by @Mattiwatti1

DMA backdoor via PCIe FPGA. No software on the target machine at all. A Spartan-6 FPGA on a PCIe card reads and writes physical memory over DMA to inject code into the UEFI boot process before the OS loads. The hardware end of the escalation ladder.
https://t.co/cGc7gIcMU3 by @d_olex

Popular in the game hacking community. UEFI manual mapper that maps unsigned drivers into kernel memory from the boot environment, bypassing DSE entirely. Binarly confirmed BlackLotus reused this project's code directly.
https://t.co/pRKS1QExFO by BTBD

Another UEFI bootkit approach for manual mapping unsigned kernel drivers. Hooks ExitBootServices to patch the kernel in memory before execution.
https://t.co/Mhwn1X5pWh by @tulachsam

UEFI mapper in the same lineage.
https://t.co/P65yDHlD6p by @ekknod_

Many of these use the .data section function pointer hook technique pioneered by the legendary Can. Instead of patching code (which PatchGuard monitors), you overwrite function pointers stored in .data (which PatchGuard doesn't). Still widely used.
https://t.co/L8OOa3o2Cd
https://t.co/MCDJvFiDFX

Combining a Secure Boot bypass with the RedLotus UEFI Bootkit on Windows 11. Full demo.
https://t.co/wIxg4LEHU5

#ReverseEngineering #MalwareAnalysis #Infosec

[ro62418911 @bromium_]

@drhossamsamy65 Slaves can't taste what's freedom mean

[hackyboiz @hackyboiz2]

[Wipeload Project ⛰️ — Step 6] Chrome Full-Chain Exploitation

In this article, we take the UAF we landed in the previous step, shape it into a full Read/Write primitive, and ride it all the way to Medium integrity code execution — completing the Sandbox Escape!

Let's dive in!

https://t.co/rSTHjoWtNN

#Hackyboiz #Wipeload #ChromeFullChain #BrowserExploitation #SandboxEscape #WindowsLPE #CyberSecurity

[ro62418911 @bromium_]

@CalcetinLetal Stop laying , most of spanish people are racists wih zero doubt