security, kernel, debugging, hacking, research..
Joined August 2011
- Tweets747
- Following1.2K
- Followers592
- Likes835
sessionpool retweeted
More details on all the updates we made for Hardware-enforced stack protection available on #IntelCET and AMD.
techcommunity.microsoft.com/…
sessionpool retweeted
The slides and videos from my @USENIXSecurity WOOT 2020 talk are now posted: usenix.org/conference/woot20…
sessionpool retweeted
Capturing Network Packets from Windows endpoints leveraging built-in ETW mechanisms via Netsh ⚔️and Azure cloud native services via Azure Network Watcher extensions 🌩️ Documenting and extending the concepts behind @Mordor_Project PCAP files 😈
medium.com/threat-hunters-fo…
sessionpool retweeted
Happy to share that @JosephBialek and I just published a new research paper that analyzes the effort of enabling SMAP for NTOS: github.com/microsoft/MSRC-Se…
We'd love to discuss && hear other perspectives :)
sessionpool retweeted
Finallly! My write-up on KDP is online! 🍾🍾
Kernel Data Protection is a new technology that prevents data corruption attacks by protecting parts of the Windows kernel and drivers through a set of APIs that provide the ability to mark some kernel memory as read-only: msft.it/6012TmrK2
sessionpool retweeted
It has been a long journey!
After almost a year of work the first draft of my book about performance analysis and tuning is ready.🎉
I know many people are struggling these days so I decided to make the book FREE.
I'm looking for people who would like to review the book.
(1/2)
sessionpool retweeted
A recording of today's presentation of "10 Years of Linux Security - A Report Card" is now available to view here: youtu.be/F_Kza6fdkSU PDF: grsecurity.net/10_years_of_l… PPT: grsecurity.net/10_years_of_l…
ALT 10 Years of Linux Security - A Report Card, delivered at the 2020 Linux Security Summit North America on July 2nd, 2020
vOPCDE #6 - WinDbg: time to put the @ back in the bag (Yarden Shafir) youtu.be/eONddXQjy2k
sessionpool retweeted
If you are curious about how DMA remapping (VT-d) can be configured to protect memory from DMA, here is a short introduction to it with sample code.
standa-note.blogspot.com/202…
Code: github.com/tandasat/HelloIom…
sessionpool retweeted
#Sysmon 11 is out with a new Event type and several improvements!
I’ve published a blog post detailing all new features here: medium.com/falconforce/sysmo…
#DFIR #Sysinternals #ThreatHunting
sessionpool retweeted
Bored in isolation? Do not despair! #OffensiveCon20 videos are now up! youtube.com/playlist?list=PL…
sessionpool retweeted
Let's write a new bootloader for x86 in Rust twitch.tv/gamozo
sessionpool retweeted
Guys & girls!
Exactly a year ago I promised over 15 bugs in win32k.
You're welcome to read and find out about my biggest research so far: #win32k #SmashTheRef bug class - github.com/gdabah/win32k-bug…
Check out the paper and the POCs, there are some crazy stuff going on. Promise!
sessionpool retweeted
First part of a research on Windows Defender main driver - WdFilter
n4r1b.netlify.com/en/posts/2…
sessionpool retweeted
we have an update to DTrace on Windows. with the latest 20H1 insider build, no more KD required to use dtrace on windows. plus arm64 MSI.
techcommunity.microsoft.com/…
sessionpool retweeted
The 7th part of the tutorial Hypervisor From Scratch is published!
In this part, I described EPT.
Thanks to Petr @PetrBenes as Hypervisor From Scratch could never have existed without his help and to Alex @aionescu for patiently answering my questions.
rayanfam.com/topics/hypervis…
sessionpool retweeted
After a lot of work and some crypto-related delays, I couldn't be more proud to publish @aionescu's and mine latest research - The complete overview of CET internals on Windows (so far!):
windows-internals.com/cet-on…