vtl0

Currently obsessed with firmware security, SMM and hypervisors (EN/PT)

[vtl0 @vtl_0]

@byovd vamo

[vtl0 @vtl_0]

No AI involved. Writeup tomorrow, also entirely written by me.

[vtl0 @vtl_0]

Im open sourcing my Linux version-agnostic UEFI bootkit tomorrow. It has function & data identification heuristics, self remapping to pgd 511, A UKI TPM opportunity window (preserving UKI), self hiding, initcall hooking, finds and parses kallsyms heuristically, infers config, etc

[vtl0 @vtl_0]

Im open sourcing my Linux version-agnostic UEFI bootkit tomorrow. It has function & data identification heuristics, self remapping to pgd 511, A UKI TPM opportunity window (preserving UKI), self hiding, initcall hooking, finds and parses kallsyms heuristically, infers config, etc

[vtl0 @vtl_0]

"detection engineering"? who the fuck invented this bullshit name?

[vtl0 @vtl_0]

@daaximus what concerns me most are those new "cheaper" alternatives like OpenCode, for sure there must be a catch

[vtl0 @vtl_0]

@byovd o que tem de diferente?

[vtl0 @vtl_0]

wtf is omarchy?

[vtl0 @vtl_0]

quem vai pra BSides CWB?

[vtl0 @vtl_0]

@SpiderMorpheus chad take

[vtl0 @vtl_0]

@byovd eu tbm sou, diagnosticado a uns 7 ou 8 anos

[vtl0 @vtl_0]

@byovd mas preciso me comunicar e jogar com os amiguinhos normies...

[vtl0 @vtl_0]

me dá uma gastura essa comunidade de segurança, desgosto profundamente de várias "referências" da área.

tem um cara do malware hypado que é backseatado por IA, escreve código bosta, se vende pra caralho e consegue atrair atenção de muitos com slop de baixa qualidade

[vtl0 @vtl_0]

@gabefollower where is the info you've supposedly been gatekeeping? are you deadass this is it? is all dataminers can do is read string diffs? lame

[vtl0 @vtl_0]

@whokilleddb steam process also hooks ntdll functions and leave it RWX, AFAIK

[vtl0 @vtl_0]

eu realmente quero escrever algumas coisas, mas sobre o que devo? tenho muita coisa closed source que pretendo tornar open source, e projetos que quero refazer/refatorar

[vtl0 @vtl_0]

@crazyrdp até a print tem cheiro

[vtl0 @vtl_0]

@Anon2Six @1Mortrix btw, bzImage is what is a PE file, not the kernel itself

[vtl0 @vtl_0]

@Anon2Six @1Mortrix yup, because gBS->LoadImage calls CoreLoadImage -> CoreLoadImageCommon -> CoreLoadPeImage. UEFI expects PE images and we can't do much about it

https://t.co/u5tQbh1Sry