Melting Down PatchGuard: Leveraging KPTI to Bypass Kernel Patch Protection
A patch for meltdown by MSFT opened patchguard for hooking syscalls.Great research by @UdiYavo from @ensilo.https://t.co/bXjfGLsC90 — Gil Dabah (@_arkon) October 27, 2018 by Omri Misgav & Udi Yavo...
View ArticleFuzzNDIS: a fuzzer for Windows NDIS drivers by IOActive
A Fuzzer for Windows NDIS Drivers OID Handlers developed by @kiqueNissim of @IOActive: https://t.co/JSF9tm9CMM … anyone interested in fuzzing, in general, is welcome to a digital copy of...
View ArticleClik here to view.
NASM-UEFI: UEFI sample application built in NASM
OS Development on Windows – Part 1: Building a UEFI Application in NASM This is a series of articles on developing your own operating system. We will be focusing on modern techniques, like UEFI booting...
View Articlehdk – (unofficial) Hyper-V® Development Kit
I made a thing: https://t.co/4bgsXy3uTy — Alex Ionescu (@aionescu) January 11, 2019 The HDK is an updated version of the HvGdk.h header file published under MSR-LA as part of the Singularity Research...
View ArticleWriting a Hyper-V “Bridge” for Fuzzing — Part 1: WDF
New Year, New Blog. I've updated my blog theme for the first time in 12 years and kicking things off with a multi-part post on Hyper-V Fuzzing. To start, we begin with a little tutorial on WDF driver...
View ArticleClik here to view.
bootnext: Windows tray icon to set EFI BootNext
https://github.com/geek1011/bootnext https://github.com/geek1011/bootnext/blob/master/bootnext/EFI.cs
View ArticlePatching Yourself into Windows Code Integrity, Part 1: On-Disk Patching
https://t.co/rd1GfpAAnK — Avery Mosher (@Avery3R) January 23, 2019 I started this whole thing because I wanted to run my own kernel-mode code while still having access games protected by anti-cheat...
View ArticleGet-USBHistory: get history of a USB flash driving using PowerShell
#DFIR tip: You can mass query USB devices used across an enterprise by leveraging PowerShell. Leverage this to hunt for malicious insiders. Keep historical records to detect anomalies. 1)...
View ArticleClik here to view.
Star LabTop Mk III: Open Source Edition (with coreboot)
Interesting, StarLabs makes a laptop with coreboot and optionally includes Windows. It this the only OEM/VAR system with coreboot+Windows?? StarLabsTheme 0.47, US keyboards, 16GB RAM, Coreboot and more...
View Articlebcdedit-revert-uefi-gpt-boot-order: Powershell script to modify the UEFI/GPT...
This powershell script modifies the UEFI/GPT boot order by finding the first non-Windows entry and moving it to the top of the order. When using UEFI+GPT, the Windows installation (since Windows 7?)...
View Article
