This is why the anti-cheat arms race is getting so interesting. Riot is pushing Vanguard further into hardware-backed trust, attestation, VBS/HVCI, IOMMU and deeper platform security. At the same time, AI-assisted reverse engineering is making it much faster to tear apart the software sitting on top of those protections. @k0mkc is showing heavily devirtualized VGK internals and says he can now devirtualize the entire thing. On the EAC side, @in19h has published tooling that recovers large parts of a heavily virtualized Easy Anti-Cheat Linux sample into readable code and IDA artifacts: github.com/19h/eac-linux-dev… There is an important parallel here with EDR. An EDR is only as effective as the detection engineering, threat hunting and R&D behind it. Anti-cheat works the same way. You need researchers constantly following new techniques, detection engineers turning that research into useful telemetry and detections, and people actively hunting for behaviour that existing rules may miss. That means continuously keeping up with: - new cheat architectures - kernel abuse - BYOVD - hypervisors - DMA - firmware tricks - input manipulation - virtualization + obfuscation - new bypass techniques The game was already there. AI is speeding it up and lowering the barrier to reversing, classification, devirtualization and research. That forces both sides to iterate faster. A lot of respect to the Vanguard team as well. They have clearly been keeping up with some of the most cutting-edge work in Windows security, hardware-backed trust, kernel security and anti-cheat research, and their recent Vanguard On-Demand changes show how quickly the defensive side is evolving too. This is becoming a much faster research cycle on both sides. Where does the arms race go next? Huge credit to @k0mkc and @in19h for the research. #AntiCheat #ReverseEngineering #WindowsInternals

If you're into Windows internals, malware analysis or low-level offensive security, bookmark this. @AliceCliment has a great FREE technical research archive covering: - Windows kernel internals - BYOVD + vulnerable driver research - Driver reversing + IOCTLs - Process-killer drivers - EDR bypass techniques - Import Address Table hooking + unhooking - Direct syscalls - Hell's Gate + Halo's Gate - FreshyCalls + SysWhispers2 - SSDT + syscall dispatch internals - NotPetya reverse engineering - Named pipes - Linux disk-encryption attacks Some particularly good rabbit holes: - Finding exploitable process-killer drivers using LOLDrivers - Reversing Avast + PowerTool kernel drivers - Following a syscall from user mode into the Windows kernel - Comparing syscall-ID retrieval techniques - Unhooking EDR modifications to the IAT - Reverse engineering NotPetya's named-pipe behavior A lot of it walks through the actual reversing process rather than just describing the technique at a high level. Start digging: alice.climent.red/ Huge credit to @AliceCliment for keeping the research publicly available. #WindowsInternals #ReverseEngineering #MalwareAnalysis

If you're into malware analysis, reverse engineering or threat intelligence, bookmark this. @embee_research has built an incredible FREE archive of practical security research covering: • Ghidra + x64dbg • Malware unpacking + shellcode • Cobalt Strike analysis • API hashing + string decryption • PE-bear + Dumpulator • .NET malware + dnSpy • CyberChef + Python deobfuscation • YARA + Sigma • Qakbot, IcedID, AgentTesla, DarkGate + more • Passive DNS + infrastructure hunting • Censys / FOFA pivots • APT infrastructure tracking • URL hunting • Module stomping + API hash evasion A lot of this is hands-on research using real malware samples, not just theory. Also includes deep dives into campaigns like SideWinder and Gamaredon infrastructure hunting. Main site: embeeresearch.io/ Full archive: embeeresearch.io/index/ Huge credit to fellow Australian @embee_research / Matthew for making this research publicly available. #MalwareAnalysis #ReverseEngineering #ThreatIntel

One of the wildest things about Windows security is how far the cheat vs anti-cheat arms race has pushed low-level research. It basically became: User mode ↓ Kernel ↓ Vulnerable drivers ↓ Page table manipulation ↓ Custom hypervisors ↓ Hyper-V hijacking ↓ VMEXIT + EPT hooks ↓ UEFI bootkits ↓ VMProtect / Themida devirtualization Aftermath Labs' archive is almost a timeline of that evolution. They've published research on: • EasyAntiCheat exploitation • EQU8 kernel reversing • VDM vulnerable driver abuse • PTM user-mode page table manipulation • Unsigned kernel driver mapping • Hidden address spaces • Hyper-V hijacking • AMD-V hypervisors • VMProtect internals • Themida devirtualization • Tencent VM devirtualization • Custom binary obfuscation • Ring-1's UEFI -> Hyper-V -> EPT architecture And the Ring-1 research is especially insane: a Themida-protected UEFI implant hooks the Hyper-V launch path, maps itself into Hyper-V, intercepts VMEXITs and uses EPT to hide executable memory from the guest. All of this because cheat developers and anti-cheat vendors kept trying to get underneath each other. Whatever you think about game cheating, this arms race has produced some seriously deep Windows internals, reverse engineering, hypervisor and kernel research. Full archive: aftermathlabs.net/blog/ Credit: @aftermath_labs and most underrated & talented reverse engineer @_xeroxz #WindowsInternals #ReverseEngineering #GameSecurity