Elliot

Security engineer and researcher | Elliot on Security

[Elliot @ElliotKillick]

Calling all experts in Windows internals and low-level systems architecture! 'The Root of DllMain Problems' (or 'DllMain Rules Rewritten') is now in preparation for its final publication! Feedback and sign-offs from the community are greatly appreciated.

https://t.co/rnnfyVzbuw

[Elliot @ElliotKillick]

To all my infosec friends, if your blog doesn't yet have an email newsletter for your subscribers... well now you can have one set up in no time at virtually no cost - all open source. You're welcome.

https://t.co/oVhrgZM3uL

[Elliot @ElliotKillick]

Today, I'm releasing a new project that automates sending email newsletter notifications for new content on your blog: rss2newsletter! In just 300 lines of code, it easily replaces any overpriced and bloated proprietary solution that charges you per-contact. See link in bio 🔗

[Elliot @ElliotKillick]

Today, I'm releasing a new project that automates sending email newsletter notifications for new content on your blog: rss2newsletter! In 300 lines of code, it easily replaces any overpriced and bloated proprietary solution that charges you per-contact

https://t.co/oVhrgZM3uL

[Elliot @ElliotKillick]

I just released a new tool for searching Microsoft Developer Blogs in bulk and fully local. Really helpful for finding information on that one Windows internals component

https://t.co/rDMTei4LdT

[Elliot @ElliotKillick]

I think I have a problem with going down rabbit holes

[Elliot @ElliotKillick]

A comprehensive analysis of all the internal Windows 10 loader states? Done - Have a look at that and a high-level analysis of how a library load works under the parallel loader

https://t.co/1A6iDbMFok

[Elliot @ElliotKillick]

Reverse engineering the Windows 10 parallel loader is challenging but interesting work. I recently fully reversed the pivotal LdrpDrainWorkQueue function and I'm just now working on LdrpLoadDllInternal plus others

https://t.co/urs7UA7rfG

[Elliot @ElliotKillick]

DllMain Rules Rewritten are Microsoft's infamous DllMain Rules - rewritten. After countless spent hours researching and reverse engineering the new and old Windows loaders, they are now complete.

https://t.co/rnnfyVzbuw

[Elliot @ElliotKillick]

I just spent the last few months of my life reverse engineering the Windows 10 parallel loader and figuring out how it does concurrency. Updates have now been published!

https://t.co/iQtWoJbwep

[Elliot @ElliotKillick]

@sixtyvividtails Sure. You have to break on data access of the SRW lock because the loader modifies it directly without calling RtlAcquireSRWLockExclusive sometimes

[Elliot @ElliotKillick]

What is Loader Lock? 🤔 Going BEYOND undocumented, we delve into the heart of the modern Windows loader investigating some internals for the first time and demystifying Loader Lock. 🔒 Check out the research article

https://t.co/q98cfTJYIM

[Elliot @ElliotKillick]

@sixtyvividtails Thanks for contributing, I'll update the repo shortly

[Elliot @ElliotKillick]

Thrilled to unveil the "Windows vs Linux Loader Architecture" project! The FIRST side-by-side comparison ever done unraveling the similarities and differences of this core component between operating systems. Check out the new repo!
https://t.co/iQtWoJc43X

[Elliot @ElliotKillick]

@sixtyvividtails Yes, so the list heads are part of the circular list. Look for yourself in WinDbg. I didn't make the pic but I'll check that. Any more perceived errors could only be due to your misunderstanding for which I would be happy to clarify.

[Elliot @ElliotKillick]

@sixtyvividtails Nope, you don't know what you're on about. ntdll!PebLdr is part of the module linked list. I verified this in multiple ways. My research is entirely accurate. Twitter commenters like you are unfortunately common.

[Elliot @ElliotKillick]

The full and open source code used in "Perfect DLL Hijacking" has now been released on GitHub: LdrLockLiberator

https://t.co/JJnoDyDd3j

[Elliot @ElliotKillick]

@dazzyddos @NetSPI https://t.co/CWZXy1gyNc

[Elliot @ElliotKillick]

Perfect DLL Hijacking: It's now possible with the latest in security research. Building on previous insights from @NetSPI, we reverse engineer the Windows library loader to disable the infamous Loader Lock and achieve ShellExecute straight from DllMain. 🔍 Link in bio 🔗

[Elliot @ElliotKillick]

@_xpn_ @HenriNurmi @NetSPI The algorithm doesn't like links 😂