Chief Technical Innovation Officer @crowdstrike. Windows Internals author and trainer. He/Him. RTs are not endorsements, opinions are my own.
Montréal, Québec
Joined April 2008
- Tweets8.5K
- Following2.1K
- Followers48.1K
- Likes3.6K
Alex Ionescu retweeted
Tune in Friday as we hangout with @yarden_shafir! Super stoked for this guest as Yarden helps lead the industry in Windows research! See you all Friday!
Alex Ionescu retweeted
Been digging deep on this for the past week, fascinating stuff. I put together an analysis of the entire stack, plus a research harness to test things live.
Repo: github.com/marcosd4h/wesp-re…
Tech doc: github.com/marcosd4h/wesp-re…
Alex Ionescu retweeted
Super excited to see WESP land in public preview. I spent the past couple of days reverse engineering wesp.sys and espclient.dll, along with building a consumer POC.
Here is a writeup on my initial analysis: jonny-jhnson.dev/blog/a-firs…
GitHub POC: github.com/jonny-jhnson/Wesp…
Alex Ionescu retweeted
Finally got a POC working. Working on a blog now, hopefully out in a couple of days 😀
Alex Ionescu retweeted
had a quick look at this. The userspace counterpart is espclient.dll. Kernel hot path is rust-heavy (own arc/nt_types, hashbrown, a BDD rule engine plus a string trie) sitting on a fltmgr minifilter with ps/ob/cm callbacks, and it also ties into ELAM and the AM/MpPreCreate path. The driver is not monitoring-only: clients register rules/filters, and the pre-op result maps to FLT_PREOP_COMPLETE/PENDING/DISALLOW_* (the DISALLOW_* ones via the AM/Mp path) and can even rewrite desired access. Notifications themselves are async as expected. Key caller verification is done through WESP://Permission token security attribute off the calling process's primary token at connect, and full-trust callers must be PPL+AM signed. There are also per-message capability checks. Anyways, lot of things to unpack here, really interesting stuff.
Alex Ionescu retweeted
Paying respect to a legend.
If you reverse Windows and don't study @aionescu, you're missing out on some of the best technical material in the industry.
ReactOS kernel dev -> iOS kernel research -> Windows Internals co-author -> critical kernel bugs -> UEFI bootkit research -> SimpleVisor.
SimpleVisor is still one of my favourite examples of making something incredibly complex approachable: a tiny VT-x reference hypervisor demonstrating VMX, VM-exits, EPT, VPID and live-host virtualization in ~500 lines of C and only ~10 x64 ASM instructions.
If you're into Windows internals, kernel security or reverse engineering, his blog is essential reading.
Bookmark it and start digging:
alex-ionescu.com/
#WindowsInternals #ReverseEngineering #KernelSecurity
Alex Ionescu retweeted
Microsoft Killed My Exploit! Enforcing User-Kernel Separation on Windows with Exploit Mitigations xitter.cf/i/broadcasts/1Xxygwzky…
Alex Ionescu retweeted
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
Alex Ionescu retweeted
Microsoft killed my exploit 😢
This Friday on @offby1security I'll talk to @Steph3nSims about what why, how and if this is the end for this class of exploit techniques
Great example of an exploit technique that HLAT (HVPT) mitigates. Since the IDT is protected by a RO VTL0 EPT, remapping the VA to different PA will result in an HLAT #EPF.
We have achieved kernel code execution via the IDT under Windows 11 with VBS/HVCI/kCET enabled.
Read the technical write-up here: exploitpack.com/blogs/news/i…
#Windows11 #KernelExploit #IDT #VBS #HVCI #kCET #DataOnly #RedTeam #ExploitResearch #WindowsSecurity #infosec #pentest
Alex Ionescu retweeted
"Outside-in-protection" in the latest insider preview. Objects have "anti-tamper" associated w/ them. Even new IFEO to read from for various policies (and setting them in a variety of ways - e.g., process, thread, and token policies)
Would be fun for someone to dig into!
Alex Ionescu retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Alex Ionescu retweeted
My #BHUSA 2026 slides are online!
It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.
Blog post coming soon — check out the slides here:
i.blackhat.com/BH-USA-26/Pre…
When you forgot to tell Claude about C̵a̵l̵l̵b̵a̵c̵k̵ ̵O̵b̵j̵e̵c̵t̵s̵.̵ ̵W̵i̵n̵3̵2̵ ̵C̵a̵l̵l̵o̵u̵t̵s̵.̵ ̵E̵x̵t̵e̵n̵s̵i̵o̵n̵ ̵H̵o̵s̵t̵s̵.̵ ̵A̵P̵I̵ ̵S̵e̵t̵s̵.̵ Build a 8th mechanism to pass pointers between the kernel and Win32k.sys.
Alex Ionescu retweeted
If you also wondered why hundreds of CVEs are fixed every month and it still feels like security is getting worse, you might get some answers in my class.
Two dates left this year:
* @CanSecWest in September (Vancouver, Canada)
* @hexacon_fr in October (Paris, France)
Alex Ionescu retweeted
For anyone who wanted to attend my recon class but couldn’t make it, I’ll teach Windows Internals again in North America! This time in @CanSecWest this September!
Only two months till class starts so sign up quickly 😎
secwest.net/csw26-dojos/inte…
Alex Ionescu retweeted
So, years after cleaning up the session heaps from all leaked kernel pointers, Microsoft started re-adding them again? Incredible
I have literally two CVEs over the last decade with the same bug, in the same place, again, and again (and ten other researchers have ten more). It’s insane. When I still taught seminars I used to tell my classes “just scan memory for kernel pointers each build”.
Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC.
github.com/karollooool/CVE-2…
Alex Ionescu retweeted
Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC.
github.com/karollooool/CVE-2…