Pinned Tweet
The second part of my series of blogposts about hooking miniport and minifilter drivers. In this session I focus on how to hook display miniport callbacks:
aviadshamriz.medium.com/part…
Aviad Shamriz retweeted
GPT-6 Astra has cracked *another* German WWI radio message encrypted with ADFGVX.
This message, "RICHI-240", has a single known key, but, to my knowledge, was never cracked by humans before. My guess is that humans never solved this message because it has 20 characters *missing* for reasons unknown: the "240" in "RICHI-240" signifies that there should be 240 characters in the message, whereas in fact there are only 220.
For purposes of cracking this cipher, the big problem is that it's not clear *where* these characters are missing from, because the order of the characters in the message is scrambled using the key. Thus, inserting the characters into the message in even slightly the wrong place leads to utterly nonsensical results.
All this was no problem for GPT-6 Astra, which tried the key with various combinations of hypothetical places from which the characters could have been missing and scored the resulting blocks of text using patterns common in the German language. Relatively early on in the process, this approach rendered coherent German text! Inserting the 20 missing characters as a string between the 4th and 5th lines of text in the message worked!
The message reads:
AN O H L
11 ARMEE
ALPENKORPS RAUM PETERREVE VERBASZ
21? 21? ? RDD LINIE NAGYBESSKEREK VERSECZ
VERSECZ VON SERBEN BESETZT
The three question marks you see are numerical digits, which cannot be restored by decryping (all we know is that they are three different digits from the following set: 5, 6, 7, 8, 9). And so, Astra was forced to check its results against historical WWI records. This search unearthed a French intelligence telegram, which described the situation in the area on November 11, 1918 and identified the German 217 - 219th infantry division and 6th Reserve Division in the area.
Plugging in this missing information, we get the final result:
AN O H L
11 ARMEE
ALPENKORPS RAUM PETERREVE VERBASZ
217 219 6RDD LINIE NAGYBESSKEREK VERSECZ
VERSECZ VON SERBEN BESETZT
Or, in English:
TO SUPREME ARMY COMMAND
11TH ARMY:
ALPINE CORPS IN THE PETERREVE-VERBASZ AREA.
217TH - 219TH DIVISIONS, AND 6TH RESERVE DIVISION ON THE NAGYBECSKEREK-VERSEC LINE.
VERSEC OCCUPIED BY SERBS.
Astra checked the official history of the Serbian city of Vršac (Versec in Hungarian, and Werschetz in German) and found that, on November 10, 1918, German troops left the city and it was occupied by Serbian forces. RICHI-240 was sent at 3:38am on the following day to the German Supreme Army Command, informing them of this fact.
Aviad Shamriz retweeted
I’ve published five firmware reverse engineering skills under OrbitCurve for Claude Code, Codex, and other compatible agents.
They cover firmware extraction, ELF analysis, Ghidra, QEMU emulation, and security reporting. Includes four Ghidra scripts, and more.
If you use agents for embedded security research, try them on your targets.
GitHub repository
github.com/OrbitCurve/firmwa…
Aviad Shamriz retweeted
Ok, some seriously impressive work from @tyholms ...
Introducing: PatchWatch + Pocsmith (+ a little help from some MCP friends) ➔ Agentic Patch-diffing + N-day exploit generation!!
(No Mythos needed + we have open-sourced all the tooling that makes this flow.)
originhq.com/blog/patch-diff…
[Ø] @originhq
Aviad Shamriz retweeted
Last week at @offensive_con 2026, @_Noiche and @Pat_Ventuzelo presented "Navigating the MTE Landscape: iOS Memory Protection Deep Dive"
A tour through Apple's MIE: (E)MTE internals, XNU integration, kernel zalloc tagging policy, and the new XZone malloc in userland.
Slides 👇
fuzzinglabs.com/wp-content/u…
#OffensiveCon #iOS #MTE
Aviad Shamriz retweeted
We at @emproofsecurity open-sourced a free firmware reverse engineering workshop for self-study.
Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included.
github.com/emproof-com/works…
Aviad Shamriz retweeted
Did you know that LSASS has the ability to execute arbitrary kernel-mode addresses? I wrote a small proof of concept that allows administrators to execute unsigned code in the kernel if LSA Protection is disabled.
github.com/floesen/KExecDD
Aviad Shamriz retweeted
Four years after publishing my code stealing passwords from WinLogon I have just realized that NPLogonNotify() has a twin!
NPPasswordChangeNotify() obtains old and new cleartext passwords changed via CtrlAltDel. Clearly documented by MS and easy to use: github.com/gtworek/PSBits/tr…
Aviad Shamriz retweeted
Lidor Ben Shitrit & Roee Sagi are here to give us a great glimpse into performing security research on Azure services and the process behind the scenes of triaging such vulnerabilities and mitigating the them.
Aviad Shamriz retweeted
New blogpost by @FuzzySec and I! Patch Tuesday -> Exploit Wednesday: Pwning Windows afd.sys in 24 Hours. We reverse engineer a bug + write an exploit using a cool new primitive. We also find out that it's been exploited in the wild (previously unknown). securityintelligence.com/pos…
Aviad Shamriz retweeted
(1/2)
Here are a few blog posts on Bluetooth devices reverse engineering:
How I Reverse Engineered and Exploited a Smart Massager
medium.com/@arunmag/how-i-re…
Reverse Engineering a Smart Band — Bluetooth-LE RE
medium.com/@arunmag/my-journ…
#iot #embedded #infosec
Aviad Shamriz retweeted
I had an inquiry about ACPI checks, and decided to run through how they work and how to mitigate them on VMware and QEMU. It's a quick and dirty write-up, so excuse the brevity.
revers.engineering/evading-t…
Aviad Shamriz retweeted
#ESETResearch analyze first in-the-wild UEFI bootkit bypassing UEFI Secure Boot even on fully updated Windows 11 systems. Its functionality indicates it is the #BlackLotus UEFI bootkit, for sale on hacking forums since at least Oct 6, 2022. @smolar_m welivesecurity.com/2023/03/0… 1/11
Aviad Shamriz retweeted
Reverse Engineering the Apple Lightning Connector hackaday.com/2023/02/22/reve…
Aviad Shamriz retweeted
For anyone interested in understanding PCIe in practice — ctf.re/windows/kernel/pcie/t…
Digestible and cleanly written.
Aviad Shamriz retweeted
What's inside the famous 8086 processor from 1978? I opened up a chip, took microscope photos, and I'm reverse-engineering it. One of the 8086's instructions is HLT, which halts the processor. Seems simple, but there's a lot of circuitry to make the halt instruction work... 🧵
Aviad Shamriz retweeted
game anticheats: have had this technique for years
infosec: NEW tEchNiQue fOr EDR eVAsIoN wiTh hArdWaRe bReAkPoInTs!!!!!👆👆👆👆
cymulate.com/blog/blindside-…
Aviad Shamriz retweeted
I wrote an IDA plugin that queries #ChatGPT and explains decompiled functions. It's still very bleeding edge, but you can find the code here and try it out:
github.com/JusticeRage/Gepet…
(Yes, the video was performed on a very basic case for simplicity's sake.)
Aviad Shamriz retweeted
Here's how we used @awscloud Redshift to escalate privileges and move laterally to other sensitive data assets.
All with an (almost) single permission.
bit.ly/3ic6v4I
#DSPM #DDR #cloudsecurity































