d4nny

Reverse Engineer

[MERICA MEMED @Mericamemed]

I got a gun = agaragã

[immortalp0ny @immortalp0ny]

Today we released write up about vulnerability that I found and which was patched recently in NTFS.sys CVE-2025-49689. Enjoy! https://t.co/eFTkDN2eSW

[BINARLY🔬 @binarly_io]

Recent updates in #efiXplorer:
- annotate SetVariable() attributes
- fix dependency builder algorithm
- compatibility with idasdk85
- support of idasdk91
- improved NVRAM variables analysis

👉 https://t.co/WHYGifmjGS

[Positive Technologies Global @PTsecurity_EN]

Positive Technologies helps resolve a zero-day #vulnerability in Windows (CVE-2024-43629), discovered by @immortalp0ny of PT ESC. The flaw allowed attackers to escalate privileges, now patched in recent updates for Windows 10, 11, and Server versions: https://t.co/vJqJC7X5Qw

[Mohit Mishra @chessMan786]

x86 Assembler Instruction Set Opcode Table

[immortalp0ny @immortalp0ny]

I decided to publish my exploit for CVE-2024-30051. Just because details about exploitation were released at last few days and it shouldnt add additional threat. I didnt have ITW sample when I developed it and mainly difference is the object type which I chose for vtbl hijacking

[PT ESC @TI_ESC]

During our research of the malicious #telegram bots, we discovered a huge layer of attacks on #Indonesia. In our new report, we explored #android #malware, which is able to collect SMS, notifications and send it to hackers's telegram bots.

https://t.co/KJzl2M4Cy7

[Rolf Rolles @RolfRolles]

Graph theory / optimization nerds, I'd appreciate any feedback you had on my StackExchange question: https://t.co/AvPnHNW9br

[Mark Ermolov @_markel___]

Found Intel p-unit MCA (Machine Check Architecture) codes (for Atoms, it's possible they are shared with Cores). PCU bank starts from MSR 0x418 (MC6)

[Alex Matrosov @matrosov]

A lot of improvements were delivered in #efiXplorer v6.0!

One big update on the readability of @HexRaysSA decompiled code comes from shifted pointers that allow us to apply automatic type propagation analysis for pre-EFI (PEI) services recovery.

Happy bug hunting below the OS!

[immortalp0ny @immortalp0ny]

I have updated my PoCs storage (https://t.co/mzFBPvNup9) with recreation of CVE-2023-21822. It reuses some code inside win32kfull for achieving read-write capabilities and performs Token Stealing

[Alex Matrosov @matrosov]

Vulnerable signed UEFI apps have the same security impact on Secure Boot as bootloaders. If the app is not blacklisted in DBX in many cases it can be reused by attackers even after the fix

A good example BRLY-2021-003/CVE-2021-39297 in HP server devices.

https://t.co/4ZoJhWRLHB

[PT ESC @TI_ESC]

Since 2022, the #APT group #SpacePirates have stepped up attacks on Russian companies, expanded its interests and the geography of its attacks. They have developed new tools and improved their old ones, which we have described in detail in our report (https://t.co/kFOLy7iBSE).

[immortalp0ny @immortalp0ny]

Just my first EoP exploit 😊 I've just written it for CVE-2023-29336. Awesome journey it was.

[immortalp0ny @immortalp0ny]

😊 👈 my face when I finally managed to create interactive visualisation of win32k DesktopHeap layout

[Alex Matrosov @matrosov]

UEFI ARM code contains a lot of blindspots with mitigation coverage. Not all functions are covered by canary checking (only functions with potentially unsafe calls to MemLib/PrintLib are protected).

But even partial coverage bumps FW security to the next level compared to x86.

[OFFZONE @offzone_moscow]

As a reminder, our call for papers is open and we are eager to receive your applications!

The topics of the presentations can vary from anything like the threats hidden in USB cables to the evolution of cybersecurity. Feel free to suggest your own ideas.

https://t.co/4c8RbPPiVx

[immortalp0ny @immortalp0ny]

A few weeks ago I successfully research my first Windows Kernel patch (cve-2023-23410)😅 Now I found enough time to publish it. Enjoy!

https://t.co/Ai9Qr378Qr

[Igor Kuznetsov @2igosha]

Another Ghidra bug: try to decompile the following code:
mov rcx, rdi
mov dword [dw1], 0
xor eax, eax
lp:
mov byte[dw1], al
mov byte[dw1+1], 0
lea rdi, [dw1]
call func
inc eax
loop lp
ret
dw1 dd 0