Windy Bug @0xwindybug

github.com/0mWindyBug Earth Joined August 2019

Tweets

6K
Followers

355
Following

2K
Likes

76K

Daax @daaximus

3 weeks ago

How do I delete someone else's post?

Low Level @LowLevelTweets

3 weeks ago

How do I delete someone else's post?

26 6 381 279K 11

18 4 200 25K 21

My new blog post 🥳 Improving AFD Socket Visibility for Windows Forensics & Troubleshooting It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥 huntandhackett.com/blog/improving…

2 41 79 7K 47

DebugPrivilege @DebugPrivilege

4 months ago

I often get asked what to do after running !analyze -v on a kernel memory dump. If you're wondering what steps you could take next to explore it further, check out this section: github.com/DebugPrivilege…

4 32 116 10K 100

DebugPrivilege @DebugPrivilege

4 months ago

Unpopular opinion? I think we have too many people within InfoSec who want to play the “coordinator” role rather than actually doing hands-on work?

41 19 267 28K 25

Archie @Archie_1997

5 months ago

Getting code execution in a process that cannot be located using traditional kernel APIs and is untouchable from usermode? All while staying PatchGuard-friendly? Sign me up: archie-osu.github.io/2025/04/13/pow…

4 91 434 26K 281

Adam Chester 🏴‍☠️{AFK} @_xpn_

5 months ago

Love this article. It’s something that I’ve tried to follow throughout my career, having a line of sight to business profit centres. Even more important in the days of tech layoffs seangoedecke.com/where-the-mone…

0 9 62 4K 38

Daax @daaximus

5 months ago

Given all the Claude+IDA MCP hype, I present to you the Anti-Clida: .rept 200001 pushq %rax addq $8, %rsp .endr @mrexodia must be stopped.

0 5 49 2K 6

x86matthew @x86matthew

8 months ago

I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. elastic.co/security-labs/… Project: github.com/x86matthew/Win…

30 353 1K 109K 683

Samuel Tulach @tulachsam

10 months ago

Pong, but it's VBS enclave tulach.cc/using-vbs-encl…

2 17 93 25K 39

Download Image

Daax @daaximus

11 months ago

If you want an entertaining and educational read about a missed optimization in one of the core components of LLVM (author doesn't Twitter, he's a mastodon enjoyer): secret.club/2024/10/21/unn…

0 16 71 6K 22

Rolf Rolles @RolfRolles

a year ago

New blog entry: C++ Unwind Metadata: A Hidden Reverse Engineering Bonanza msreverseengineering.com/blog/2024/8/20…

2 117 322 30K 138

Download Image

Daax @daaximus

12 months ago

@yarden_shafir A function of leadership is to produce more leaders, not more followers. That’s how you ensure (hopefully) continued success within a team.

0 1 6 949 0

Windy Bug @0xwindybug

a year ago

Introducing RansomGuard, an anti-ransom filter driver, capable of dealing with challenges posed by memory mapped I/O, understanding how file-systems handle file deletions and more! Shoutout @Mattiwatti1 & @jonasLyk for their respective contributions🙂 0mwindybug.github.io/RansomGuard/

5 25 60 6K 34

Mark Ermolov @_markel___

a year ago

Intel HW is too complex to be absolutely secure! After years of research we finally extracted Intel SGX Fuse Key0, AKA Root Provisioning Key. Together with FK1 or Root Sealing Key (also compromised), it represents Root of Trust for SGX. Here's the key from a genuine Intel CPU😀

105 986 5K 967K 2K

Download Image

William R. Messmer @wmessmer

a year ago

If you've updated WinDbg in the last week or so and open a kernel dump, you may have noticed that there's an "Extensions" tab on the ribbon and a few icons in that tab. On the latest debuggers -- extensions can add icons to the ribbon that invoke data model visualizations!

1 13 33 5K 8

Download Image

chompie @chompie1337

a year ago

Writing about low-level Windows concepts is more challenging than writing about Linux. Each term requires defining three other terms and a history lesson, making it hard to convey the "big picture" without getting bogged down in the minutiae to ensure complete accuracy

15 20 365 30K 46

namazso @namazso

a year ago

@AzakaSekai_ There is a grain of truth to the kernel thing: You really shouldn’t be writing custom file format parsers in your C kernel driver. Just look at the font mess Windows had until they moved that stuff into a usermode service.

0 5 20 2K 1

Can Bölük @_can1357

a year ago

Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles. It has worked against every version of Patchguard for the last 7 years, without needing any updates! blog.can.ac/2024/06/28/pgc…

14 124 328 46K 136

sixtyvividtails @sixtyvividtails

a year ago

You know IMAGE_SCN_MEM_NOT_PAGED attribute for PE section? The one which supposedly makes your driver section non-pageable? Shocking truth: this attribute is totally ignored! Decisions for what parts of image should be locked are based on... substrings in section names. 🤣😂🤣