Michael B.

Windows security researcher/reverse engineer. The more you know, the more you realize you don't.

[Michael B. @DownWithUpSec]

Here is an (another) IDA domain API MCP server that I worked on this weekend. It was an good experience using FastMCP. I might add more tools to the server as the need arises. For anyone interested: https://t.co/XatVgZJgML

[Michael B. @DownWithUpSec]

IDA and Codex preformed very well together. The prompt was surprisingly simple and I was generally impressed with the results.

[Michael B. @DownWithUpSec]

An example of "vibe" malware reverse engineering.
https://t.co/tIwt6KkfQq

[Michael B. @DownWithUpSec]

@winternl_t Very nice that this displays arguments as well as the return value. However, it didn't seem to work out of the box for me. Just ran and said "INFO: waiting for app to exit..." I'll have to investigate more.

[Michael B. @DownWithUpSec]

AWStrace: Another Windows Strace attempt by me. Using a named pipe and shellcode inside the remote process, send registers back and pretty print the output.

[Michael B. @DownWithUpSec]

https://t.co/S1hpd6Va56

[Michael B. @DownWithUpSec]

Because of the recent Notepad++ situation here is another good source about WB. As opposed to just simple decryption/re-encryption, this also shows how to use the heap execute capability.

https://t.co/8fozhDu5pv

[Michael B. @DownWithUpSec]

@aionescu @witherornot1337 @HackingLZ @vxunderground I remember watching Alex's talk in 2020, and it was always on the back of my mind. I finally sat down around 2023 and worked out a simple PoC to use the decrypting/re-encrypting capabilities of it. Crazy to see it actually being used in the wild.

[Michael B. @DownWithUpSec]

@diversenok_zero Awesome, this is great to know. I kept thinking maybe I had a permissions problem. 😅

[Michael B. @DownWithUpSec]

Exporting registry data in the "hive" format seems to ignore the "BIOS" key under HKLM\HARDWARE\DESCRIPTION\System. You can export it directly, but exporting any parent will not contain the "BIOS" key and its values

[Michael B. @DownWithUpSec]

"This thing I need is open source. Surely someone has audited this code?"
🙃

[Michael B. @DownWithUpSec]

@sixtyvividtails Sadly not. Looks like all if your CPU doesn't support MPX (which newer ones won't) the MPX instructions will be treated as NOPs.

[Michael B. @DownWithUpSec]

Something interesting I stumbled upon: In Windows, for Intel's MPX, a driver could use KeRegisterBoundCallback to handle/hook the BOUND #BR exception. This function will eventually get called from the IDT's KiBoundFault

[Michael B. @DownWithUpSec]

😮New post on Windows Warbird encryption and decryption: https://t.co/LCOapQeJ8b

[Michael B. @DownWithUpSec]

Here's an old project that I polished up a bit: https://t.co/B8ZKbbucaW Essentially the idea was to have some introspection into an OS at the hypervisor level. It was also a foray into the Windows Hypervisor Platform API.

[Michael B. @DownWithUpSec]

Just a quick little post on how to use the the undocumented API NtPssCaptureVaSpaceBulk to gather a process' virtual memory in a single call. Read more here: https://t.co/egpjdyJhF3

[Michael B. @DownWithUpSec]

@EranShimony @MSRC I didn't even know this site existed...

[Michael B. @DownWithUpSec]

So .msu files really are just .cab files? 😅

[Michael B. @DownWithUpSec]

@hyp3rlinx Looks interesting! 3rd party contributions welcome?

[rebecca hill @beccidee17]

What a shot taken from Melbourne Australia 🔭🪐