iPower

Just a guy who likes anime, fighting games, hypervisors and reverse engineering. Member of @the_secret_club. Do not DM me about game cheats.

[iPower @iPowerPower]

While researching @kaspersky's components, I've decided to write a fun project that makes possible hooking system calls from your own driver by interfacing with its hypervisor: https://t.co/9uFRmmVqDr

[secret club @the_secret_club]

Striga: Lifting x86 to LLVM IR with Python by @mrexodia

https://t.co/7iYajj8gIZ

[Pavel Yosifovich @zodiacon]

New video: creating COM objects with the class moniker.
Most of you know CoCreateInstance.
Here is another way: class moniker. I walk through what the class moniker is, how the registry resolves the clsid: prefix to an implementation in combase.dll, and then rebuild the whole thing manually with MkParseDisplayName and IMoniker::BindToObject.
https://t.co/X1eAjXJeIh

[Petr Beneš @PetrBenes]

I often need to explore Windows kernel crashdumps when I'm on Linux/macOS.

WinDbg unfortunatelly doesn't work in Wine.

So... I did a thing. It's multiplatform - doesn't depend on dbgeng.dll nor DIA. WinDbg-flavored.

And it's fast. Really fast.
https://t.co/sd44mJo9ax

[Daax @daaximus]

I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.

https://t.co/GjIZpjhVzw

[Maurice Heumann @momo5502]

I'm adding Hyper-V (using the Windows Hypervisor Platform) as emulation backed to Sogen, my Windows userspace emulator:

While providing slightly less analytical functionality, it should be a game changer in terms of speed 🥳

https://t.co/eAcVzlBEUl

[Alexandre Becholey @0xabe_io]

Started a blog series on writing a minimal ARM hypervisor from scratch — boots as a UEFI app, claims EL2, identity-maps everything through Stage 2.

Chapter 0 just dropped: ARM vs x86 virtualization, UEFI internals, EDK2 setup, first app at EL2.

https://t.co/NJ7hQu3VZz

[Daax @daaximus]

Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).

https://t.co/mmYLS4rNCn

[Justas Masiulis @JustasMasiulis]

TIL FILE_READ_ACCESS is not mandatory to map a SEC_IMAGE into memory.

[Duncan Ogilvie 🍍 @mrexodia]

https://t.co/x8ky37TEwb

[Gynvael Coldwind @gynvael]

My new hobby: Asking AI the same question over and over again, and looking at the results.

Here's an example - I've asked gemini-2.5-flash 100 times to add two large numbers.

It's really undecided.

The correct answer is not there btw.

[Steve @processhacker]

Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢

[allthingsida @allthingsida]

Try the ask_ida/c++ GPT [ https://t.co/2UEoY12Xoi ] for IDA SDK related questions in C/C++.

[diversenok @diversenok_zero]

My new blog post 🥳

Improving AFD Socket Visibility for Windows Forensics & Troubleshooting

It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥
https://t.co/UDw18wKDdc

[es3n1n @es3n1n]

ok its finally done: the improved version of no-defender, a tool that interacts with WSC api to disable window defender the way how microsoft intended it

https://t.co/KJX2R3NdTw

[Alan Sguigna @AlanSguigna]

Good news! The recording of our talk at @reconmtl 2024, JTAG debug of Windows Hyper-V / Secure Kernel with WinDbg and DCI/EXDI, presented together with @ivanrouzanov, is now available on YouTube: https://t.co/tn7wrURkZy. Turn on subtitles.

[Satoshi Tanda @standa_t]

Nice to see Intel and MSFT's posts on VT-rp / HVPT.

If you are interested in playing with the feature, simple example code is here: https://t.co/XaA7VHf06z

[Satoshi Tanda @standa_t]

The new blog post on supervisor shadow stack restrictions / supervisor shadow-stack control

https://t.co/YPVai772Zt

[Alan Sguigna @AlanSguigna]

Intel E-cores behave differently in virtual machines than P-cores. This plays an important role in debugging hypervisor technology within heterogeneous systems. See my article, The Mysterious Behavior of the Intel E-cores, here: https://t.co/STm79Dgwml

[BINARLY🔬 @binarly_io]

Some exciting research to share from Binarly REsearchers @cci_forensics and @pagabuc -- a novel approach to UEFI bootkit detection.

🔥Read the technical paper: "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior"

👉 https://t.co/KwmiNq9hdc

[Takahiro Haruyama @cci_forensics]

My presentation slides "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior" @REverseConf are available online https://t.co/QCQaFi8SaY