kthreat

Vulnerability researcher

[kthreat @kthreat_]

Reversing with AI assistance brings so much joy. I still can’t believe what used to take days can now be done in hours. Boring stuff is not that boring anymore

[kthreat @kthreat_]

@vmpr0be @msftsecresponse Nice finding! Are you considering some blog post about this?

[kthreat @kthreat_]

@TinySecEx @FuzzySec How AI did the debugging?

[kthreat @kthreat_]

@OSdev_ I was toying around with CVE too

[kthreat @kthreat_]

@moyix I’m excited to see the details! Great job! Congrats!

[Daily CyberSecurity @Daily_CyberSec]

PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support 64-bit OS only.

https://t.co/HbNQZz2gdN

[Andrew Case @attrc]

I spoke at @BSidesPhilly last year on how kernel rootkits operate on Windows 10+ systems and how to detect and defend against them. My closing argument was to enable HVCI everywhere possible or it’s hopeless. Full talk is online:

https://t.co/IqeJ3x1kLq

[sixtyvividtails @sixtyvividtails]

Check kCFG cfguard bits for ⓪ address (put tgt func in $t0):

r$t0=nt!longjmp; r$t1=3&(by(poi(nt!guard_icall_bitmap)+(@$t0>>6))>>(((@$t0>>4)&3)<<1)); r$t2='+';.if(@$t1==2){r$t2='!'}.elsif(@$t1==0|(@$t1==((@$t0&0x0F)!=0))){r$t2='-'}; .printf "%y: cfgbits %x, %c\n", @$t0,@$t1,@$t2

[WitherOrNot @witherornot1337]

Improved bypass for Windows 11 OOBE:

1. Shift-F10
2. start ms-cxh:localonly

Only required on Home and Pro editions.

[Nathan Blondel @slowerzs]

Think HVCI and kCET mean the end of kernel code execution? I wrote a blogpost exploring an alternative way to execute a kernel payload! :)
https://t.co/Ty542HtdqL

[Stephen Sims @Steph3nSims]

An Introduction to using Artificial Intelligence (AI) for Vulnerability Research https://t.co/952iFabRqd

[starlabs @starlabs_sg]

CimFS: Crashing in memory, Finding SYSTEM! @cplearns2h4ck dug into Microsoft CimFS, found a sneaky 0-day, and guess what? The fix by Microsoft was just locking the door 🔐on unprivileged users. 😂
Dive into the adventure with us: https://t.co/7g30HpmFzG

[PatchPoint.Official @_patchpoint_]

We released a demo video for the CVE-2025-24993 Windows NTFS RCE Vulnerability, patched by Microsoft in Mar 2025. Watch the video and subscribe to our private vulnerability PoC and detailed report service at https://t.co/hbWyi5lMtY.
https://t.co/cEQRyk79W8

#NTFS #Vulnerability #RCE #HeapOverflow #Microsoft #Windows

[kthreat @kthreat_]

@udunadan Couldn’t disagree but couldn’t agree either

[kthreat @kthreat_]

Yes, there’s a thing called “vibe coding” (unfortunately). What about “vibe fuzzing”?

[PatchPoint.Official @_patchpoint_]

We released a demo video for the CVE-2025-24985 Windows Fast FAT File System Driver RCE Vulnerability, patched by Microsoft in March 2025. Watch the video and subscribe to our private vulnerability PoC and detailed report service.
https://t.co/lVH1gwsNls

[zayne (zeyu) zhang @zeyu1337]

My slides from today's talk about Static Program Analysis. I go into how data flow analysis (like taint propagation in CodeQL) works from first principles - should be digestible with some first-year university maths knowledge

https://t.co/lgvdS7BySo

[Alexandre Borges @ale_sp_brazil]

The fifth article (57 pages) of the Exploiting Reversing Series (ERS) is available on:

https://t.co/rdaPMOm4WM

I would like to thank Ilfak Guilfanov @ilfak and Hex-Rays SA @HexRaysSA for their constant and uninterrupted support, which have helped me write these articles over time.

I hope you enjoy reading it and have an excellent day.

#hypervisor #hyperv #architecture #cybersecurity #research #internals #idapro #informationsecurity #microsoft

[dunadan @udunadan]

I'd argue that this is the single most defining quality of one's skill. Experience is about doing less wrong things, less wasteful movements. Exploit dev exists in a tough life business cycle. Time is the most precious thing. Maybe the only thing at all.

[Takahiro Haruyama @cci_forensics]

My presentation slides "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior" @REverseConf are available online https://t.co/QCQaFi8SaY