Scott Noone @analyzev

Engineering Partner at OSR community.osr.com Manchester, NH Joined August 2010

Tweets

332
Followers

873
Following

114
Likes

528

Scott Noone @analyzev

a year ago

Has anyone else tried to decipher WinDbg's rdmsr/wrmsr syntax for ARM64? I *think* I have it figured out would gladly take a second opinion on what exactly KdpEncodeMsrAccess wants... community.osr.com/t/how-to-retri…

1 2 10 843 4

Scott Noone @analyzev

a year ago

If you rely on Driver Verifier beware that it's not working as expected on Windows 11: osr.com/blog/2024/05/0…

3 6 25 9K 11

Scott Noone @analyzev

a year ago

WinDbg session is getting real: .prompt_allow +reg .asm no_code_bytes

0 0 2 278 0

lander @landaire

a year ago

Exploiting the NT Kernel in 24H2: New Bugs in Old Code & Side Channels Against KASLR by @gabe_k exploits.forsale/24h2-nt-exploi…

4 36 94 16K 30

Scott Noone @analyzev

a year ago

Anyone have any kernel crash dumps they want me to analyze in WinDbg? I'm working on updates for our next Kernel Debugging seminar and could use some new real world case studies (because ofc all bugs in my code are for demonstration purposes only 😂) osr.com/seminars/kerne…

0 2 4 413 1

Gynvael Coldwind @gynvael

a year ago

So @j00ru published two posts on Windows Registry; given that there were a lot of fixes in Windows Registry in recent months I expect these to be fun ;) googleprojectzero.blogspot.com/2024/04/the-wi… googleprojectzero.blogspot.com/2024/04/the-wi…

8 127 290 40K 128

Ian Beer @i41nbeer

2 years ago

If you like memory corruption, low-level internals and building custom decompilers to analyse novel exploits check out the write-up here: googleprojectzero.blogspot.com/2023/10/an-ana…

7 148 483 90K 119

Gabriel Landau @GabrielLandau

2 years ago

ProcMon 3.93 supports configurable minifilter altitudes. This is great for teams that have to support minifilters! Thanks @markrussinovich!

0 3 15 3K 2

Download Image

John U @jdu2600

2 years ago

I took a tilt at solving LRPC client provenance - specifically the problem of parent correlation evasion via RPC-based indirect process creation. But ended up taking on a telemetry trustworthiness side quest… elastic.co/security-labs/…

1 12 29 4K 3

Rob Noeth @RobNoeth

3 years ago

I'm super proud of this 🚀

Huntress @HuntressLabs

3 years ago

I'm super proud of this 🚀

0 7 29 0 2

Download Image

0 2 8 0 0

Bill Demirkapi @BillDemirkapi

3 years ago

This is a pretty neat way to detect legacy NtCreateProcess calls that are generally abused for attacks like Process Doppelganging or Herpaderping.

Microsoft Threat Intelligence @MsftSecIntel

3 years ago

This is a pretty neat way to detect legacy NtCreateProcess calls that are generally abused for attacks like Process Doppelganging or Herpaderping.

1 54 144 0 31

0 7 30 0 9

Emmanuel Macron @EmmanuelMacron

3 years ago

Abortion is a fundamental right for all women. It must be protected. I wish to express my solidarity with the women whose liberties are being undermined by the Supreme Court of the United States.

14K 31K 248K 0 908

Connor McGarr @33y0re

4 years ago

I took the past several days to do a write-up on my methodology in respect to identifying how a new change to KUSER_SHARED_DATA in Windows 11 Insider Preview was implemented. tl;dr looks like 0xfffff78000000000 is now read-only + a new randomized R/W view. connormcgarr.github.io/kuser-shared-d…

5 108 276 0 55

OSR @OSRDrivers

4 years ago

OSR's File System Minifilter and WDF Seminar Schedule - mailchi.mp/osr/osrs-file-…

0 7 13 0 0

Scott Noone @analyzev

5 years ago

Most important lesson learned this week: never trust someone with a WinDbg icon as their profile pic

0 0 10 0 0

Download Image

OSR @OSRDrivers

5 years ago

The NTFS :$I30:$Bitmap bug found by @jonasLyk is super weird and annoying...FIFY: osr.com/blog/2021/01/2… (source + binaries github.com/OSRDrivers/i30…)