Security Researcher

Joined August 2015
Really honored to be part of BlueHat Asia. Met so many brilliant researchers and cool people here. Huge thanks to MSRC for the invitation and for organizing such an amazing event. Had a great time!🙌
Sometimes the most interesting vulnerabilities are not caused by a single bug, but by assumptions that quietly break over time. At BlueHat Asia, Microsoft MVRs Zhu Qing and b2ahex (@b2ahex) shared their research into the Windows DirectX kernel, uncovering dozens of vulnerabilities spanning local privilege escalation, guest-to-host attack paths in Hyper-V, information disclosure, and denial-of-service scenarios. Their work resulted in 32 reported vulnerabilities and 26 confirmed CVEs at the time of submission. From user-mode interactions with dxgkrnl to host-side processing in GPU-PV environments, the researchers demonstrated how subtle violations of security assumptions can create powerful exploitation opportunities. Beyond the vulnerability findings themselves, the talk offered a practical framework for security research: trace every path from attacker-controlled input to the final privileged action, and verify that security guarantees still hold at each step. It was a compelling look at how deep technical analysis can uncover entire classes of vulnerabilities across complex systems.
1
13
853
We're excited to announce our next BlueHat Asia speakers: b2ahex (@b2ahex), Senior Security Researcher, four-time MSRC Most Valuable Researcher (MVR), and Pwnie Award winner; and Zhu Qing, CTO of Snowrock, Senior Security Engineer, MVR, and top MSRC Windows Bounty recipient. In their talk, "Broken Contracts in the DirectX Kernel: Local Elevation of Privilege and Hyper-V Guest-to-Host Remote Code Execution," b2ahex and Zhu Qing present a systematic study of object lifetime bugs in the Windows DirectX kernel, a component that today spans the boundaries between user mode, kernel mode, graphics drivers, and virtualized environments. During their research, the pair uncovered recurring vulnerability patterns involving handle resurrection, object type confusion, object lifetime management failures, and guest-controlled handles crossing trust boundaries. These issues affected both traditional Windows graphics paths and Hyper-V GPU paravirtualization scenarios, demonstrating how security flaws in graphics subsystems can evolve into virtualization isolation risks. Their work led to the reporting of 32 vulnerabilities in Dxgkrnl components, spanning Windows Hyper-V remote code execution, elevation of privilege, kernel information disclosure, and denial of service vulnerabilities. At the time of submission, 26 of these reports had been confirmed and assigned CVEs. Through real-world case studies, the session examines both local privilege escalation and Hyper-V guest-to-host vulnerabilities, explores the root causes behind these bug classes, and discusses practical approaches for strengthening object lifetime management, handle validation, locking mechanisms, and virtualization boundary protections. This is a rare opportunity to hear directly from researchers who have spent years uncovering some of the most impactful vulnerability classes within the Windows graphics stack.
3
21
3,315
AI is getting really useful for vuln research. With some manual guidance, I used GPT-5.4 to find some Windows kernel bugs, and the points in the image still feel obvious. Even so, its already a fun and powerful tool in the workflow. Curious how other researchers are using it😃
1
1
605
hope everyone has fun playing with it~
419
Congratulations to all the researchers recognized in this quarter’s MSRC 2025 Q3 Security Researcher Leaderboard! Thanks to all the researchers who partnered with us for your hard work and continued dedication to securing our customers. Learn more in our blog post: msft.it/6016sfncp We also want to recognize the top 10 researchers in the leaderboard: 🥇Brad Schlintz (@nmdhkr) 🥈 Yuval Avrahami 🥉 b2ahex 4. Jianyang song 5. Felix B. 6. Haifei Li @HaifeiLi 6. tuandv of Viettel Cyber Security 8. P1hcn 9. 0x140ce @0x140ce 10. Matthew Jensen
2
7
2
32
14,636
Thanks for the 2023 MVR swag, Excited to use it! @msftsecresponse
1
17
2,503
Won the @PwnieAwards for Best Desktop Bug and was nominated for Best RCE Bug. Congratulations to all the winners and nominees! 🫣☺️
3
16
5,000
#5 😸
Congratulations to all the researchers recognized in this quarter’s MSRC 2022 Q4 Security Researcher Leaderboard! For more information, check out our blog post: msrc-blog.microsoft.com/2023…   #cybersecurity #securityresearch #msrc
1
9
2,515
Here is my writeup for 2 Windows kernel bugs I reported to MSRC. Both are race conditions that cause Use-After-Free. As there is very few windows kernel writeups I share my research methodology and more. Hope it helps other researchers. Share it😀 dannyodler.hashnode.dev/raci…
4
156
1
442
46,676
Happy to Get MSRC 2021/2022 MVRs #27 and Windows Leaderboard #9 Congrats to all MVRs~
Congratulations to our MSRC 2022 Most Valuable Researchers! Thank you to all the researchers who have helped secure our customers. Check out our blog for the full list: msrc-blog.microsoft.com/2022… #cybersecurity #securityresearch
2
15
Recently discovered some unauthenticated RCEs~
2
21
127
I make a BSOD of Win10 with CVE-2022-30151, which was discovered by @b2ahex and patched last week. This vulnerability is a race condition bug, which results in Double-Free. I share my scenario slide to trigger this vulnerability and a crash screenshot. Thx.
3
41
1
106
Sadly, the nt object reference count overflow vulnerability I reported earlier was defined as a "moderate severity, non-persistent denial of service vulnerability" no bounty..😑
4
2
21
But as I recall, I did see similar bugs fixed from the patch diff before..
1
Privilege Escalation and Information Disclosure in nt CVE-2022-29142 CVE-2022-29116
2
3
22
CVE-2022-24542, although there is only one cve number, it contains more than 10 different privilege escalation vulnerabilities that I submitted last December, and they have basically existed in the system for 20-30 years. #CVE_2022_24542
7
15
1
115
I just found out when I checked the status of recent cases😅
1
CVE-2022-22710: New vulnerabilities discovered after analyzing a 1day wild exploit😀
2
6
1
73