Binary security researcher

Joined February 2011
Today was my last day at Qihoo360. It’s feeling great to grown up together with No.1 security teams & products of China for 14 years. Not quite feel sad with the good memories of the amazing people there. Time for new challenges.
30
6
2
176
So. Same as I guessed --> "PerfInfoLogSyscallEntry"
1
pgboy retweeted
Happy Ghidra month everybody! nsa.gov/resources/everyone/g…
Interested in Hyper-V Internals? Read Part 2 of my continuing series on "Writing a Hyper-V "Bridge" for Fuzzing" as we get into the guts of hypercalls: alex-ionescu.com/?p=471 with sample code and more!
6
198
2
455
In an effort to share more of my source code publicly, I've uploaded Bochspwn Reloaded (the kernel infoleak detector) to GitHub. For those interested, it may shed some light on the implementation details of the project. See: github.com/google/bochspwn-r…
3
206
4
408
What People believes what programming is - VS - Reality @Maliciouslink @MalwareTechBlog
47
1,164
94
2,379
Announcing Bochspwn Reloaded – a new kernel memory infoleak detector – and the REcon Montreal 2017 slides. j00ru.vexillium.org/?p=3295
4
271
7
322
See the leakinfo part in my cansecwest2017 slide.This bug could be found by that method.And as i known this bug is filtered by appconainter. xitter.cf/ProjectZeroBugs/status…
Windows Kernel stack memory disclosure in win32kfull!SfnINLPUAHDRAWMENUITEM bugs.chromium.org/p/project-…
3
6
Sigh, looks like Microsoft broke public symbols for latest ntdll on win7. ntdll!_PEB not defined, so !heap, !peb, !address etc. all broken.
4
13
17
UAC Bypass Vulnerability in the Windows Script Host. - The Windows Script Host executables suffer from a vulnerabi... ow.ly/334Wbx
#Pwn2own 2015 is a joke: reduced prices but raised difficulties (64bit apps, EMET, sandboxes, no logoff/logon, etc). Let's wait for 2016...
32
28
Congratulations to @n3tsphereCorp @shrek_wzw @bluerust @vessial @programmeboy @c0_shaun & @r3shl4k1sh for completing the #FLAREOnChallenge!
3
2