freddy

i like butter croissants and security controls, uncontrollably eating both. threat research @

[Jonas L @jonasLyk]

https://t.co/AeIdwj23cp

[Wietze @Wietze]

https://t.co/r67jck8ZGo just got a visual refresh 🌟

Explore 600+ documented DLL Hijacking cases, including:
• JSON/CSV/YAML feeds
• Sigma detection content for every DLL
• A single Sigma rule covering all DLLs

Check it out: https://t.co/2PJCgKEZwO

[kernullist @kernullist]

Released PseudoForge 0.1.0.

An IDA Pro / Hex-Rays plugin built for Windows kernel driver analysis.
It cleans up raw decompiler output with rule-based passes, WDK-backed API profiles, user-defined rules, and optional LLM rename assist that is kept behind deterministic validation.

Current focus:
- DriverEntry reconstruction hints
- IRP / IOCTL dispatcher cleanup
- CTL_CODE and NTSTATUS decoding
- WDK API argument semantics
- pool tag recovery
- LIST_ENTRY traversal
- CONTAINING_RECORD patterns
- callback registration flows
- common kernel cleanup paths

This is still a very early release, so expect rough edges. 😆
repo: https://t.co/BZJfKNfcGX

[nop @thenopcode]

After more than 3 years, I finally found the time to update my blog and write something new.

So here is a short post about a simple WinDbg extension I wrote to find code caves (definitely an improvement from the messy Python code I wrote back then):
https://t.co/8f9C6YGN1i

[clearbluejar @clearbluejar]

Patch diffing + RCA for clfs.sys can awhile.

I gave the diff + binary to a local LLM.

It mapped the UAF path, race condition, all IOCTLs in <20 min

LLMs don't replace the work, they are momentum.

New blog post following the UAF trail of CVE-2025-29824: https://t.co/4wtd0rOKDB

[Justas Masiulis @JustasMasiulis]

TIL FILE_READ_ACCESS is not mandatory to map a SEC_IMAGE into memory.

[vx-underground @vxunderground]

https://t.co/fRN9lhj4oY

[freddy @falsneg]

@Vonster @FTC @Adobe they should allow changing plans, which would then allow you to cancel without a fee since you’re considered under a new plan and it’s within the two week cancellation timeframe or whatever. not sure if that’s still a thing but that’s how I cancelled previously

[freddy @falsneg]

@nikitabier security research / os internals:
@sixtyvividtails
@x86matthew
@hasherezade
@patrickwardle
@yarden_shafir
@vxunderground
@33y0re

[freddy @falsneg]

@jamieantisocial ah well if i'm not wrong this is just a call to tcpClient->Stop() - maybe just for having some "goodware" characteristics..? not sure

[freddy @falsneg]

@jamieantisocial fwiw that doesn't seem like dead code either.. `(*(v9 + 8))(v7);` is a very real call there (in the if (v8) block)

[freddy @falsneg]

@originhq @michaelbarclay_ @ESET https://t.co/lnwjgQG2ON

[freddy @falsneg]

@originhq @michaelbarclay_ Nice - I wrote a similar thing a while ago. https://t.co/ozBj4zoakv :) also fwiw it got assigned CVE-2025-4952 by @ESET (i was surprised tbh)

[freddy @falsneg]

@yarden_shafir https://t.co/IyFw9qsx7a can't find the full project - wrote this a while ago and vm got nuked since then but there isn't much more. anyway i can share a precompiled bin if u want

[diversenok @diversenok_zero]

I wanted to understand what information is available in .pdb files, so I made a tool for it 🔎🪲

Welcome DiaSymbolView - a debug symbol hierarchy and properties viewer based on MSDIA:
https://t.co/mSWAolfrFt

[freddy @falsneg]

@WhichbufferArda @BackEngineerLab true?

[freddy @falsneg]

@WhichbufferArda it could be that https://t.co/ayIcHkgh62 refused selling them lol

[Two Seven One Three @TwoSevenOneT]

EDR-Redir uses a Bind Filter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the Endpoint Detection and Response (EDR) 's working folder to a folder of the attacker's choice.
https://t.co/7oDmOETdCA

#itsecurity #redteam #pentest

[Tom Dörr @tom_doerr]

https://t.co/y2oWJDx622

[freddy @falsneg]

😂😂