Aviad Shamriz (@SHA_MRIZ) profile picture

Windows internals enthusiast and Security researcher

Israel
Joined March 2018
Photo by Aviad Shamriz (@SHA_MRIZ)
The second part of my series of blogposts about hooking miniport and minifilter drivers. In this session I focus on how to hook display miniport callbacks: aviadshamriz.medium.com/part…
4
48
2
119
Aviad Shamriz retweeted
Now speaking: Roey Shua, discussing how to automate edge device memory forensics, including a proof-of-concept that extends Volatility 3 to a MIPS-based router.
1
2
5
317
Aviad Shamriz retweeted
GPT-6 Astra has cracked *another* German WWI radio message encrypted with ADFGVX. This message, "RICHI-240", has a single known key, but, to my knowledge, was never cracked by humans before. My guess is that humans never solved this message because it has 20 characters *missing* for reasons unknown: the "240" in "RICHI-240" signifies that there should be 240 characters in the message, whereas in fact there are only 220. For purposes of cracking this cipher, the big problem is that it's not clear *where* these characters are missing from, because the order of the characters in the message is scrambled using the key. Thus, inserting the characters into the message in even slightly the wrong place leads to utterly nonsensical results. All this was no problem for GPT-6 Astra, which tried the key with various combinations of hypothetical places from which the characters could have been missing and scored the resulting blocks of text using patterns common in the German language. Relatively early on in the process, this approach rendered coherent German text! Inserting the 20 missing characters as a string between the 4th and 5th lines of text in the message worked! The message reads: AN O H L 11 ARMEE ALPENKORPS RAUM PETERREVE VERBASZ 21? 21? ? RDD LINIE NAGYBESSKEREK VERSECZ VERSECZ VON SERBEN BESETZT The three question marks you see are numerical digits, which cannot be restored by decryping (all we know is that they are three different digits from the following set: 5, 6, 7, 8, 9). And so, Astra was forced to check its results against historical WWI records. This search unearthed a French intelligence telegram, which described the situation in the area on November 11, 1918 and identified the German 217 - 219th infantry division and 6th Reserve Division in the area. Plugging in this missing information, we get the final result: AN O H L 11 ARMEE ALPENKORPS RAUM PETERREVE VERBASZ 217 219 6RDD LINIE NAGYBESSKEREK VERSECZ VERSECZ VON SERBEN BESETZT Or, in English: TO SUPREME ARMY COMMAND 11TH ARMY: ALPINE CORPS IN THE PETERREVE-VERBASZ AREA. 217TH - 219TH DIVISIONS, AND 6TH RESERVE DIVISION ON THE NAGYBECSKEREK-VERSEC LINE. VERSEC OCCUPIED BY SERBS. Astra checked the official history of the Serbian city of Vršac (Versec in Hungarian, and Werschetz in German) and found that, on November 10, 1918, German troops left the city and it was occupied by Serbian forces. RICHI-240 was sent at 3:38am on the following day to the German Supreme Army Command, informing them of this fact.
46
168
41
1,797
234,059
I’ve published five firmware reverse engineering skills under OrbitCurve for Claude Code, Codex, and other compatible agents. They cover firmware extraction, ELF analysis, Ghidra, QEMU emulation, and security reporting. Includes four Ghidra scripts, and more. If you use agents for embedded security research, try them on your targets. GitHub repository github.com/OrbitCurve/firmwa…
11
81
3
555
29,646
Aviad Shamriz retweeted
Ok, some seriously impressive work from @tyholms ... Introducing: PatchWatch + Pocsmith (+ a little help from some MCP friends) ➔ Agentic Patch-diffing + N-day exploit generation!! (No Mythos needed + we have open-sourced all the tooling that makes this flow.) originhq.com/blog/patch-diff… [Ø] @originhq
1
5
15
1,191
Aviad Shamriz retweeted
Last week at @offensive_con 2026, @_Noiche and @Pat_Ventuzelo presented "Navigating the MTE Landscape: iOS Memory Protection Deep Dive" A tour through Apple's MIE: (E)MTE internals, XNU integration, kernel zalloc tagging policy, and the new XZone malloc in userland. Slides 👇 fuzzinglabs.com/wp-content/u… #OffensiveCon #iOS #MTE
1
33
2
136
20,097
Aviad Shamriz retweeted
We at @emproofsecurity open-sourced a free firmware reverse engineering workshop for self-study. Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included. github.com/emproof-com/works…
83
1
315
20,857
Aviad Shamriz retweeted
Did you know that LSASS has the ability to execute arbitrary kernel-mode addresses? I wrote a small proof of concept that allows administrators to execute unsigned code in the kernel if LSA Protection is disabled. github.com/floesen/KExecDD
6
176
6
493
76,864
Aviad Shamriz retweeted
Four years after publishing my code stealing passwords from WinLogon I have just realized that NPLogonNotify() has a twin! NPPasswordChangeNotify() obtains old and new cleartext passwords changed via CtrlAltDel. Clearly documented by MS and easy to use: github.com/gtworek/PSBits/tr…
9
207
3
706
63,840
Aviad Shamriz retweeted
Lidor Ben Shitrit & Roee Sagi are here to give us a great glimpse into performing security research on Azure services and the process behind the scenes of triaging such vulnerabilities and mitigating the them.
3
14
2,109
Aviad Shamriz retweeted
New blogpost by @FuzzySec and I! Patch Tuesday -> Exploit Wednesday: Pwning Windows afd.sys in 24 Hours. We reverse engineer a bug + write an exploit using a cool new primitive. We also find out that it's been exploited in the wild (previously unknown). securityintelligence.com/pos…
8
222
12
600
131,433
Aviad Shamriz retweeted
(1/2) Here are a few blog posts on Bluetooth devices reverse engineering: How I Reverse Engineered and Exploited a Smart Massager medium.com/@arunmag/how-i-re… Reverse Engineering a Smart Band — Bluetooth-LE RE medium.com/@arunmag/my-journ… #iot #embedded #infosec
3
77
328
41,887
Aviad Shamriz retweeted
I had an inquiry about ACPI checks, and decided to run through how they work and how to mitigate them on VMware and QEMU. It's a quick and dirty write-up, so excuse the brevity. revers.engineering/evading-t…
4
31
81
13,634
Aviad Shamriz retweeted
#ESETResearch analyze first in-the-wild UEFI bootkit bypassing UEFI Secure Boot even on fully updated Windows 11 systems. Its functionality indicates it is the #BlackLotus UEFI bootkit, for sale on hacking forums since at least Oct 6, 2022. @smolar_m welivesecurity.com/2023/03/0… 1/11
10
236
20
421
112,793
Aviad Shamriz retweeted
What's inside the famous 8086 processor from 1978? I opened up a chip, took microscope photos, and I'm reverse-engineering it. One of the 8086's instructions is HLT, which halts the processor. Seems simple, but there's a lot of circuitry to make the halt instruction work... 🧵
5
112
7
621
76,805
Aviad Shamriz retweeted
Yeah, let me just scrape the SOC to expose JTAG pads on the package…
121
897
168
5,637
927,959
I wrote an IDA plugin that queries #ChatGPT and explains decompiled functions. It's still very bleeding edge, but you can find the code here and try it out: github.com/JusticeRage/Gepet… (Yes, the video was performed on a very basic case for simplicity's sake.)
22
360
28
1,377
Here's how we used @awscloud Redshift to escalate privileges and move laterally to other sensitive data assets. All with an (almost) single permission. bit.ly/3ic6v4I #DSPM #DDR #cloudsecurity
2
6
18