Forrest Orr @_ForrestOrr

Red Teamer, low level coding extremist and malware researcher. Windows exploit writer and bug hunter forrest-orr.net Joined September 2017

Tweets

179
Followers

4K
Following

526
Likes

261

Forrest Orr @_ForrestOrr

6 months ago

Does anyone know what mechanisms can be used to detect suspended (non-UWP) and frozen UWP app processes, and how to programmatically wake them up in a safe and persistent way where they don't just immediately freeze again?

3 0 3 1K 2

Forrest Orr @_ForrestOrr

8 months ago

Is the ability of a non admin user to obtain a full query handle to a System integrity process and unravel its ASLR considered a security boundary? I know a PROCESS_QUERY_INFORMATION handle on a PPL is considered a breach of a security boundary even if the owner is local admin.…

1 0 8 1K 3

Forrest Orr @_ForrestOrr

9 months ago

I’m surprised to have recently learned that there does not seem to be a trivial way to receive notifications of suspended process launches in Windows via kernel proc notif callback, kernel ETW or EtwTi. Any ideas on how to do this? @zodiacon

2 1 1 2K 6

Forrest Orr @_ForrestOrr

a year ago

Great patch, thanks for making the pull request.

Gabriel Landau @GabrielLandau

a year ago

Great patch, thanks for making the pull request.

0 15 45 14K 13

0 0 1 1K 0

Forrest Orr @_ForrestOrr

2 years ago

Very well put together research that expands on some of the memory forensics articles I wrote several years ago, it’s excellent to see improvements are still being made to malware tradecraft in this niche

Petar Jr. Pranic @ipSlav

2 years ago

9 72 187 32K 74

0 1 5 1K 1

Petar Jr. Pranic @ipSlav

2 years ago

My first research and tool are finally out. If you want to deep dive into some CLR internals and understand how we can abuse it to blend-in within its own logic go check it out. Hope you'll enjoy the read. ipslav.github.io/2023-12-12-let…

9 72 187 32K 74

BRDNS @brandon_shi

2 years ago

CVE-2021-38001: A Brief Introduction to V8 Inline Cache and Exploitating Type Confusion y4y.space/2023/05/06/cve…

2 57 170 15K 65

Connor McGarr @33y0re

3 years ago

Today I am releasing a blog about kernel exploitation in the age of HVCI. This post addresses calling arbitrary kernel-mode APIs, to go beyond “traditional token stealing” data-only attacks, while also dealing with kernel control flow integrity. connormcgarr.github.Io/hvci

6 222 581 0 146

Forrest Orr @_ForrestOrr

3 years ago

Last summer I attended the Advanced Windows Heap Exploitation class given by @corelanc0d3r and cannot speak highly enough of his skill, dedication and enthusiasm for the topic. This is the training I recommend for learning memory corruption exploits. Truly one of a kind.

2 6 51 0 7

Forrest Orr @_ForrestOrr

3 years ago

Excellent work, I think you’ve found (what is at present) the most optimal fusion of stealth techniques for evasion in memory. It doesn’t get any more cutting edge than this when it comes to the memory dimension of malware design these days

waldoirc @waldoirc

3 years ago

14 152 343 0 87

1 1 19 0 3

Forrest Orr @_ForrestOrr

3 years ago

Excellent work on this. Well done!

Connor McGarr @33y0re

4 years ago

Excellent work on this. Well done!

5 160 420 0 130

0 1 2 0 0

maxpl0it @maxpl0it

4 years ago

Going to Blackhat USA this year? I’ll be teaching a 2-day training: Day 1 - Browser internals (Firefox and Chrome) Day 2 - Virtualisation Internals (VirtualBox and QEMU) Come learn from real source code and debug real world targets! blackhat.com/us-22/training…

1 14 107 0 17

waldoirc @waldoirc

4 years ago

Already released way earlier but I'm sharing on Twitter too just because. Blog post + poc on detecting malware through return addresses. Recommend also looking at the following made by @thefLinkk github.com/thefLink/Hunt-… arashparsa.com/catching-a-mal…

3 81 167 0 41

Forrest Orr @_ForrestOrr

4 years ago

Thanks for bringing this to my attention Andrew, this would be a much more elegant way of filtering CLR JIT memory in Moneta.

Andrew Case @attrc

4 years ago

Thanks for bringing this to my attention Andrew, this would be a much more elegant way of filtering CLR JIT memory in Moneta.

0 0 0 0 0

0 0 3 0 0

Forrest Orr @_ForrestOrr

4 years ago

My personalized Windows 10 re-creation of the HYDSEVEN exploit chain used to target Coinbase. This chain involves the use of a Firefox RCE (CVE-2019-11707) and Firefox sandbox escape (CVE-2019-11708) for shellcode execution as Medium Integrity github.com/forrest-orr/Ex…