security, kernel, debugging, hacking, research..
Joined August 2011
- Tweets747
- Following1.2K
- Followers592
- Likes835
sessionpool retweeted
More details on all the updates we made for Hardware-enforced stack protection available on #IntelCET and AMD.
techcommunity.microsoft.com/…
sessionpool retweeted
The slides and videos from my @USENIXSecurity WOOT 2020 talk are now posted: usenix.org/conference/woot20…
sessionpool retweeted
Capturing Network Packets from Windows endpoints leveraging built-in ETW mechanisms via Netsh ⚔️and Azure cloud native services via Azure Network Watcher extensions 🌩️ Documenting and extending the concepts behind @Mordor_Project PCAP files 😈
medium.com/threat-hunters-fo…
sessionpool retweeted
Happy to share that @JosephBialek and I just published a new research paper that analyzes the effort of enabling SMAP for NTOS: github.com/microsoft/MSRC-Se…
We'd love to discuss && hear other perspectives :)
sessionpool retweeted
Finallly! My write-up on KDP is online! 🍾🍾
Kernel Data Protection is a new technology that prevents data corruption attacks by protecting parts of the Windows kernel and drivers through a set of APIs that provide the ability to mark some kernel memory as read-only: msft.it/6012TmrK2
sessionpool retweeted
It has been a long journey!
After almost a year of work the first draft of my book about performance analysis and tuning is ready.🎉
I know many people are struggling these days so I decided to make the book FREE.
I'm looking for people who would like to review the book.
(1/2)
sessionpool retweeted
A recording of today's presentation of "10 Years of Linux Security - A Report Card" is now available to view here: youtu.be/F_Kza6fdkSU PDF: grsecurity.net/10_years_of_l… PPT: grsecurity.net/10_years_of_l…
ALT 10 Years of Linux Security - A Report Card, delivered at the 2020 Linux Security Summit North America on July 2nd, 2020
sessionpool retweeted
Video of my keynote in @OPCDE #6 is up and it has the coolest cover photo ever!
Had so much fun in my first virtual conference. Thank you @msuiche for organizing it and inviting me and thanks to anyone who watched!
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
sessionpool retweeted
If you are curious about how DMA remapping (VT-d) can be configured to protect memory from DMA, here is a short introduction to it with sample code.
standa-note.blogspot.com/202…
Code: github.com/tandasat/HelloIom…
sessionpool retweeted
#Sysmon 11 is out with a new Event type and several improvements!
I’ve published a blog post detailing all new features here: medium.com/falconforce/sysmo…
#DFIR #Sysinternals #ThreatHunting
sessionpool retweeted
Bored in isolation? Do not despair! #OffensiveCon20 videos are now up! youtube.com/playlist?list=PL…
sessionpool retweeted
Let's write a new bootloader for x86 in Rust twitch.tv/gamozo
sessionpool retweeted
Guys & girls!
Exactly a year ago I promised over 15 bugs in win32k.
You're welcome to read and find out about my biggest research so far: #win32k #SmashTheRef bug class - github.com/gdabah/win32k-bug…
Check out the paper and the POCs, there are some crazy stuff going on. Promise!
sessionpool retweeted
First part of a research on Windows Defender main driver - WdFilter
n4r1b.netlify.com/en/posts/2…
sessionpool retweeted
we have an update to DTrace on Windows. with the latest 20H1 insider build, no more KD required to use dtrace on windows. plus arm64 MSI.
techcommunity.microsoft.com/…
sessionpool retweeted
The 7th part of the tutorial Hypervisor From Scratch is published!
In this part, I described EPT.
Thanks to Petr @PetrBenes as Hypervisor From Scratch could never have existed without his help and to Alex @aionescu for patiently answering my questions.
rayanfam.com/topics/hypervis…
sessionpool retweeted
After a lot of work and some crypto-related delays, I couldn't be more proud to publish @aionescu's and mine latest research - The complete overview of CET internals on Windows (so far!):
windows-internals.com/cet-on…
sessionpool retweeted
I decided to create a tutorial called "Reversing Windows Internals" and explain about Windows Internals.
The first part describes about Handles, Callbacks and Hidden Callbacks and ObjectTypes in Windows
Thanks to @Dark_Puzzle for answering my questions.
rayanfam.com/topics/reversin…
sessionpool retweeted
Everyone knows Driver Signature Enforcement.... 🙃
The problem is: Attackers can load any signed driver and abuse its functionality. For example, the process hacker driver can be abused to dump the memory of lsass.exe.
Read about it in my blog😋
repnz.github.io/posts/abusin…
