iPower

Just a guy who likes anime, fighting games, hypervisors and reverse engineering. Member of @the_secret_club. Do not DM me about game cheats.

[iPower @iPowerPower]

While researching @kaspersky's components, I've decided to write a fun project that makes possible hooking system calls from your own driver by interfacing with its hypervisor: https://t.co/9uFRmmVqDr

[Bwit @BwitneyHouston]

I just don't have the time to blog about this so you get a nice little bait image instead.

ps: liblisa lies about recent intel cpus, my own research into this puts the exploitable divergences set at 75 instructions.

[Bwit @BwitneyHouston]

New uefi chain loader, now with llm's built right in, why wait for a DE, when you proompt right away. loading omarchy @dhh.

code available at https://t.co/xNkvMwtcma

[Duncan Ogilvie 🍍 @mrexodia]

As Flare-On starts I am happy to announce the official Hex-Rays IDA MCP Server is out! 🥳

Details and links below ⬇️

[ricochet @mkovavoda]

https://t.co/YmPqZEXit8
Also supports simplifying MBA, with better results than CoBRA, as well as properly handling its edge cases.

[Daax @daaximus]

Love these stories. 20 years ago I encountered ArtMoney for the first time, 18 years ago I copied a C# aimbot from patrickssj6(?), all the way to now… Game hacking, especially through the growth and advancement of modern tech, will teach you so many things.

[ricochet @mkovavoda]

https://t.co/nyff75q8dV has been updated with more performance improvements and extended formal verification. Build times when used as a dependency has also been improved. Grab it on https://t.co/HjKMnikwWH @ cobra-mba !

[Daax @daaximus]

Can you read all of these without your blood pressure rising?

“load-bearing”, “golden path”, “golden files”, “golden artifacts”, “golden smoke tests”, “provenance”, “honest take”, “belt and suspenders”, “that’s the unlock”, “smoking gun”, “that’s not a bug, it’s a feature of the design”, “X isn’t the problem, it’s the symptom”, “not because X, but because Y”, “X, Y, but not Z. Sometimes W”, “X isn’t just Y anymore”, “no longer just X”, “less about X, more about Y”, “not X so much as Y”, “X, but for Y”, “load-bearing <literally anything>”, “the wrong shape”, “the same shape as”, “shaped like a”, “a config file in a trenchcoat”, “vibes in a trenchcoat”, “three functions in a trenchcoat”, “a spreadsheet in a trenchcoat”, “literally anything in a trenchcoat”, “this test is doing a lot of work”, “that comma is doing a lot of work”, “real work”, “the word 'should' is doing a lot of heavy lifting”, “this abstraction is earning its keep”, “this function pulls its weight”, “the duplication is load-bearing, not loose”, “the coupling is intentional, not accidental”, “the seam between”, “cutting along the seam”, “a natural seam”, “the grain of the codebase”, “against the grain of the API”, “the codebase wants to (wants to WHAT?)”, “the type system is telling you”, “dead code walking”, “zombie config”, “the function outlived its purpose”, “the name no longer matches the behavior”, “the compiler is trying to tell you”, “listen to what the code is telling you”, “the tests are screaming”, “this code smells like”, “the blast radius of this”, “the gravity of the module”, “orbiting the real issue”, “dancing around the actual fix”, “the fix is hiding in plain sight”, “the bug was hiding in”, “the quiet part”, “saying the quiet part out loud”, “half right, and the half that (more clanker rambling)”, “quietly load-bearing”, “quietly doing the heavy lifting”, “silently holding everything together”, “held together with hope”, “held together by convention”, “one refactor away from collapse”, “a Jenga tower of dependencies”, “a house of cards”, “the workaround became the architecture”, “the hack calcified”, “fossilized decisions”, “archaeological layers of the codebase”, “code archaeology”, “git blame archaeology”, “the sediment of past decisions”, “scar tissue in the X”, “the codebase has memory”, “the ghosts of a previous design”, “the foundation is sand”, “built on quicksand”, “the scaffolding became the building”, “haunted by an old abstraction”, “the vestigial parameter”, “an appendix of the API”, “the map has drifted from the territory”, “the docs are fan fiction at this point”, “the README is aspirational”, “the comment is a lie waiting to happen”, “the type signature is a promise the function doesn’t keep”, “the interface writes a check the implementation can’t cash”, “actually let me”, “actually let me”, “actually let me”, “actually let me”, “actually I think”, “actually let me”, “actually let me”, “Let me write this”, “actually let me”

Me neither.

[MAS @massgravel]

There's a lot of misinformation and panic going around about the Windows GDID (Global Device ID), let's talk about what it actually is. 🧵

[Can Bölük @can1357]

Ending the Fable experiment here.

After 6 days and ~1400$ in Anthropic subs, we have Py3.14 JIT codegen and pon package-manager! (12,578$ @ API pricing)

1/x Although not 100% conformant, numpy working seamlessly is pretty impressive, esp. considering the wheel installation itself also required it to get meson/Cython working.

[Hex-Rays SA @HexRaysSA]

Here's the last IDA 9.4 pre-release teaser...

We've significantly improved Swift binary analysis. In this blog, we're focusing on two different improvements:
1️⃣ Proper modelling of the Swift ABI
2️⃣ Proper typing of Swift runtime functions

👉 https://t.co/abzYcaxuE5

[secret club @the_secret_club]

Striga: Lifting x86 to LLVM IR with Python by @mrexodia

https://t.co/7iYajj8gIZ

[Pavel Yosifovich @zodiacon]

New video: creating COM objects with the class moniker.
Most of you know CoCreateInstance.
Here is another way: class moniker. I walk through what the class moniker is, how the registry resolves the clsid: prefix to an implementation in combase.dll, and then rebuild the whole thing manually with MkParseDisplayName and IMoniker::BindToObject.
https://t.co/X1eAjXJeIh

[Petr Beneš @PetrBenes]

I often need to explore Windows kernel crashdumps when I'm on Linux/macOS.

WinDbg unfortunatelly doesn't work in Wine.

So... I did a thing. It's multiplatform - doesn't depend on dbgeng.dll nor DIA. WinDbg-flavored.

And it's fast. Really fast.
https://t.co/sd44mJo9ax

[Daax @daaximus]

I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.

https://t.co/GjIZpjhVzw

[Maurice Heumann @momo5502]

I'm adding Hyper-V (using the Windows Hypervisor Platform) as emulation backed to Sogen, my Windows userspace emulator:

While providing slightly less analytical functionality, it should be a game changer in terms of speed 🥳

https://t.co/eAcVzlBEUl

[Alexandre Becholey @0xabe_io]

Started a blog series on writing a minimal ARM hypervisor from scratch — boots as a UEFI app, claims EL2, identity-maps everything through Stage 2.

Chapter 0 just dropped: ARM vs x86 virtualization, UEFI internals, EDK2 setup, first app at EL2.

https://t.co/NJ7hQu3VZz

[Daax @daaximus]

Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).

https://t.co/mmYLS4rNCn

[Justas Masiulis @JustasMasiulis]

TIL FILE_READ_ACCESS is not mandatory to map a SEC_IMAGE into memory.

[Duncan Ogilvie 🍍 @mrexodia]

https://t.co/x8ky37TEwb

[Gynvael Coldwind @gynvael]

My new hobby: Asking AI the same question over and over again, and looking at the results.

Here's an example - I've asked gemini-2.5-flash 100 times to add two large numbers.

It's really undecided.

The correct answer is not there btw.