koyz

Software developer with a robust background in reverse engineering and exploit research.

[koyz @koyzdev]

Released ReClassNetMcp, an MCP server that runs inside ReClass as a plugin.

An agent can attach to a process, read and write memory, run scans, and build class layouts that update live in the
GUI, then generate the C++ or C# header.

https://t.co/oV5wgRoVmR

[Daax @daaximus]

I’m currently convinced after Astra doing my VR challenges that it’s really good at things that are/were open source. Reasoning about the Linux Kernel, QEMU, etc for VR isn’t necessarily “easier” but the connections between subsystems, internals and their details (even if dated) are more apparent and it is trained on that information. It makes things a bit more “straightforward” than it having to use tools like ida-nexus, custom plugins for vm spin up/control, debugging, etc to discover and document relationships.

All of the closed-source blackbox challenges it was given it has had mediocre performance. This is fine imo, there was no steering or additional input; and with human input it’d likely improve the process, but it’s still a far-cry from the marketing claims of OAI regarding it finding new and novel vulnerabilities in closed-source targets without experienced human guidance or redirection. So far the data shows Opus 5, Sol 5.6, and even Qwen3.8 27B (local) were more successful independently. This could also be a process issue on my end, but given the other models were a bit more successful it’s hard to say.

I’ll publish the benchmark and results ideally this week. I need to run Grok 4.6 through it. It would be interesting to see what others experience or how it performs for them and collecting additional data points. I feel like the marketing claims are saturating timelines and overstating the capabilities (these models are still awesome tools though), which, business strategy… but for those of us wanting to know the practicality of them it’s not exactly helpful.

[Daax @daaximus]

This is partly why I'm impatiently awaiting Astra... I have a VR bench based on real (unreported) bugs. I'd love to see how it performs on some of these, and I keep reading mixed results.

Qwen3.8-27B managed to use my tools and discover one of the bugs in rdbss, but it took 22 hours, didn't generate a functioning PoC (timed out at 24hrs), and didn't manage the others. Curious what the consensus is for complex blackbox VR.

[koyz @koyzdev]

@daaximus Once it’s done planning all 3.2 billion eventualities that COULD occur during research it will finally… hit you with your weekly limit /s

[koyz @koyzdev]

@BwitneyHouston @surdo_pte @stencil_labs This is the most Brit response Brit could make. You’re so Brit.

[koyz @koyzdev]

@daaximus Corporations wouldn’t lie for their benefit.

[koyz @koyzdev]

@daaximus One hell of a SoTA post, my LLM giggled!

[Can Bölük @_can1357]

colloquially known as falling

[Daax @daaximus]

All the people citing legality have no idea how this works, the sensational bullshitters like Pirat_Nation as well. It’s an IOMMU block, that is it. If you don’t know what that is: Google.

- https://t.co/YDj76wmvGu

- https://t.co/UhwNLb6rFJ

You’re not going to suddenly have things on your PC stop working. The DMA device will stop working until you remove it. It will operate normally if you put it on a PC that doesn’t have the block. Never seen so many sweats worked up about something they couldn’t even explain with a gun to their head.

[Daax @daaximus]

I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.

https://t.co/GjIZpjhVzw

[Daax @daaximus]

Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).

https://t.co/mmYLS4rNCn

[koyz @koyzdev]

Released sigdrift, a tool that downloads Windows binaries across versions and generates minimal signature sets for function scanning.

https://t.co/IXoOPGJOjo

[Can Bölük @_can1357]

Annual post unlocked 🔓
Reverse-engineered the Hyperliquid validator binary to see what 'decentralized' actually looks like under the hood.

Spoiler: it's worse than a centralized exchange.

https://t.co/qgHhAZ8BhS

[koyz @koyzdev]

@daaximus @davepl1968 Dave Plummer: invented Task Manager, 30 years of experience
daax: made a better one, left
nature is healing

[Daax @daaximus]

If you find yourself wanting a pdf for a single instruction (Intel || AMD), and not dealing with the entire manual: https://t.co/j8m08uYPAm<instruction>.pdf

You can see the index @ https://t.co/j8m08uYPAm

Just as an alternative to FelixCloutier’s site, it will update every new edition.

[Daax @daaximus]

In addition to this, it also uses UMWAIT/UMONITOR in MiSpinForProtoLock (as opposed to MWAIT/MONITOR previously). This will result in a UD on launch or within early execution if the ‘enable user wait/pause bit’ is not set in the secondary process controls.

The solution for finding these issues quickly is trapping and logging all exceptions over serial/network/usb to gather information during your run. You will typically find a suspicious invalid opcode exception (UD). If you’re developing|maintaining a hypervisor use BOCHS or a second physical machine — VMware, et al., are horrible for testing and debugging because of bugs within their own platform.

[koyz @koyzdev]

Hooking Windows APIs through debug exceptions - a patch-less technique using LdrpDebugFlags and stack manipulation.

https://t.co/EICSshDmUd

[koyz @koyzdev]

@daaximus The Rust hashtag is sending me 😂

[Daax @daaximus]

Unlock forbidden Windows knowledge! 🤫💻
Find the PEB through truly undetected means and pop calculator 💥
The non-golf form will be available below 👇

#redteamtips #windowsinternals #rust

[Daax @daaximus]

always entertaining to do a little code golf to get the PEB