Pinned Tweet
Multiple vulnerabilities in the Realtek card reader driver. The vulns allow a non-privileged user to write to virtual kernel memory and gain access to physical memory via the DMA controller. Dell, Lenovo and other OEMs affected. The first part of the post: zwclose.github.io/2024/10/14…
Every time I read news about AI hacking something, I get the feeling that we'll need an air-gapped-human-only internet much sooner than we think.
How pwn agents escaped the hardest-known sandbox setup: Google’s KVM (kvmCTF).
pwn.ai/blog/kvmescape
To celebrate 10K followers 🥳, we’re launching Stories from Inside the Sandbox, our new sandbox escape series.
The PoC now supports both directions of DMA transfers, making it possible to dump physical memory to an SD card.
Currently, each DMA transfer is limited to 512 bytes, but multi-block transfers are already working and just need some more tuning.
github.com/zwclose/realtek-d…
A vulnerability in Realtek's card reader driver allows non-privileged users to program the DMA controller, enabling arbitrary physical memory reads and writes. Neither additional hardware nor a custom kernel driver is required to exploit the vuln. Details: zwclose.github.io/2026/07/08…
Some researcher has a grudge against Microsoft
One anonymous researcher dropped 9 working Windows zero-days in 3 months. Each one timed for the day after Patch Tuesday to maximize the unpatched window. The latest one, LegacyHive, dropped 17 hours ago.
BlueHammer. RedSun. UnDefend. YellowKey. GreenPlasma. MiniPlasma. RoguePlanet. GreatXML. LegacyHive. All targeting Windows Defender, BitLocker, and core Windows components.
Three were exploited in the wild before patches shipped. CISA added them to KEV. Huntress confirmed live intrusions using BlueHammer, RedSun, and UnDefend together in a single attack chain.
MiniPlasma revived a 2020 Google Project Zero bug that Microsoft said was fixed. The original PoC still worked unmodified. Six years “patched.”
Microsoft invoked its Digital Crimes Unit and called it criminal activity. GitHub banned the repos. GitLab banned the repos. The same pattern we saw with @jonasLyk @WeirdQuadratic and @5mukx. The community pushed back hard. Microsoft walked it back within days.
The researcher self-hosted on their own Gitea server. “Microsoft cannot unwrite my code.”
Blog: blog.projectnightcrawler.dev
Blogspot: deadeclipse666.blogspot.com
GitHub: github.com/MSNightmare
Gitea: git.projectnightcrawler.dev/…
@ChaoticEclipse0
#InfoSec #WindowsInternals #ThreatIntel
A vulnerability in Realtek's card reader driver allows non-privileged users to program the DMA controller, enabling arbitrary physical memory reads and writes. Neither additional hardware nor a custom kernel driver is required to exploit the vuln. Details: zwclose.github.io/2026/07/08…
ZwClose retweeted
Just shipped a WinDbg x64 extension that turns live disassembly into verified pseudocode via LLM — chunked multi-pass analysis, in-process HTTP, mock fallback, and a verification pass that cross-checks LLM output against original analysis facts.
github.com/kernullist/windbg…
ZwClose retweeted
Check out the KUSER_SHARED_DATA docs that were submitted to NtDoc by @sixtyvividtails, and are probably the most comprehensive source of information about this struct known to humanity.
ntdoc.m417z.com/kuser_shared…
Also featured on @pagedout_zine, issue #7, page 33, check it out!
Older WDKs are back! With each update Microsoft dropped pieces like code samples, so I hoarded a few WDKs, and even planned to search far corners of the web to get more. This is not needed anymore: MS just published a collection of legacy WDKs: learn.microsoft.com/en-us/wi…
ZwClose retweeted
This blogpost is interesting - has Windows internals, my own novel solution to a problem red teamers have had for a while, EDR bypasses, debugging and much more.
Spoofing command lines on Windows and solving the problem of length limitations:
github.com/yo-yo-yo-jbo/comm…
ZwClose retweeted
I wanted to understand what information is available in .pdb files, so I made a tool for it 🔎🪲
Welcome DiaSymbolView - a debug symbol hierarchy and properties viewer based on MSDIA:
github.com/diversenok/DiaSym…
ALT A screenshot of DiaSymbolView inspecting combase.pdb
I may be late to the party, but I didn't know about deepwiki.org/, which looks really cool!
TIL that DMA remapping is not specific to the driver I was working on, but is part of Windows' protection against DMA attacks: learn.microsoft.com/en-us/wi…
ZwClose retweeted
Today I am releasing a new blog post on VSM "secure calls" + the SkBridge project to manually issue them!!
This blog talks about how VTL 0 requests the services of VTL 1 and outlines common secure call patterns!!!
Blog: connormcgarr.github.io/secur…
SkBridge: github.com/connormcgarr/SkBr…
Took a look at this driver too. Damn, MS does nasty things there. They log a lot. They walk stack frames. They lower IRQL!
New blog post: UCPD.sys – UserChoice Protection Driver Part 2: kolbi.cz/blog/2025/07/15/ucp…
Glad to be mentioned and recommend following the people on the list. Thank you, @therealdreg
If you like Windows internals + x86_64 follow: @sixtyvividtails @ivanrouzanov @C5pider @mrexodia @yarden_shafir @chompie1337 @timmisiak @Intel80x86 @_winterknife_ @horsicq @d_olex @UlfFrisk @aall86 @zodiacon @standa_t @0vercl0k @PetrBenes @zwclose @rwfpl @TheEnergyStory
Kernel Address Sanitizer for Windows drivers is now available, this should make life even more difficult for vulnerability developers. The feature is off by default so far.
KASAN is now available for your own Windows Drivers: learn.microsoft.com/en-us/wi…
Turns out that Dell (and possibly other OEMs) didn’t bother to update their driver packages with the fix for the vulnerabilities in RtsPer.sys. @stuartwalker1 found a link to manual download of the fixed driver from the Microsoft Catalog.
If anyone else has the same issue, you can download the driver manually here catalog.update.microsoft.com… and install using the device manager update driver function
ZwClose retweeted
I implemented a PoC for CVE-2024-30090, which @scwuaptx discovered. The PoC uses an arbitrary increment primitive on nt!SeDebugPrivilege to escalate privileges to SYSTEM.
github.com/Dor00tkit/CVE-202…
#CVE-2024-30090 #PoC #LPE