While researching @kaspersky's components, I've decided to write a fun project that makes possible hooking system calls from your own driver by interfacing with its hypervisor: https://t.co/9uFRmmVqDr
New video: creating COM objects with the class moniker.
Most of you know CoCreateInstance.
Here is another way: class moniker. I walk through what the class moniker is, how the registry resolves the clsid: prefix to an implementation in combase.dll, and then rebuild the whole thing manually with MkParseDisplayName and IMoniker::BindToObject.
https://t.co/X1eAjXJeIh
I often need to explore Windows kernel crashdumps when I'm on Linux/macOS.
WinDbg unfortunatelly doesn't work in Wine.
So... I did a thing. It's multiplatform - doesn't depend on dbgeng.dll nor DIA. WinDbg-flavored.
And it's fast. Really fast.
https://t.co/sd44mJo9ax
I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.
https://t.co/GjIZpjhVzw
I'm adding Hyper-V (using the Windows Hypervisor Platform) as emulation backed to Sogen, my Windows userspace emulator:
While providing slightly less analytical functionality, it should be a game changer in terms of speed 🥳
https://t.co/eAcVzlBEUl
Started a blog series on writing a minimal ARM hypervisor from scratch — boots as a UEFI app, claims EL2, identity-maps everything through Stage 2.
Chapter 0 just dropped: ARM vs x86 virtualization, UEFI internals, EDK2 setup, first app at EL2.
https://t.co/NJ7hQu3VZz
Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).
https://t.co/mmYLS4rNCn
My new hobby: Asking AI the same question over and over again, and looking at the results.
Here's an example - I've asked gemini-2.5-flash 100 times to add two large numbers.
It's really undecided.
The correct answer is not there btw.
Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢
My new blog post 🥳
Improving AFD Socket Visibility for Windows Forensics & Troubleshooting
It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥
https://t.co/UDw18wKDdc
ok its finally done: the improved version of no-defender, a tool that interacts with WSC api to disable window defender the way how microsoft intended it
https://t.co/KJX2R3NdTw
Good news! The recording of our talk at @reconmtl 2024, JTAG debug of Windows Hyper-V / Secure Kernel with WinDbg and DCI/EXDI, presented together with @ivanrouzanov, is now available on YouTube: https://t.co/tn7wrURkZy. Turn on subtitles.
Nice to see Intel and MSFT's posts on VT-rp / HVPT.
If you are interested in playing with the feature, simple example code is here: https://t.co/XaA7VHf06z
Intel E-cores behave differently in virtual machines than P-cores. This plays an important role in debugging hypervisor technology within heterogeneous systems. See my article, The Mysterious Behavior of the Intel E-cores, here: https://t.co/STm79Dgwml
Some exciting research to share from Binarly REsearchers @cci_forensics and @pagabuc -- a novel approach to UEFI bootkit detection.
🔥Read the technical paper: "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior"
👉 https://t.co/KwmiNq9hdc