0xedh (@0xedh) header
0xedh (@0xedh) profile picture

I've been passionate about hacking for as long as I can remember. Red Team engagements and security research. https://nitter.cf/t.co/MhKl2D7sgv

¯\_(ツ)_/¯
Joined May 2011
Photo by 0xedh (@0xedh)Photo by 0xedh (@0xedh)Photo by 0xedh (@0xedh)Photo by 0xedh (@0xedh)
Pinned Tweet
You don't need a USB. You need to look like one. Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen. DEF CON 34 talk w/ @Qm9yamFN. Link at the first comment.
17
267
14
1,269
144,592
0xedh retweeted
Unlocking everything on the AMD CPU with DRAM scrambling (@xoreaxeaxeax) github.com/xoreaxeaxeax/skit… #infosec
12
110
3
831
41,999
0xedh retweeted
i thought read() was a syscall wrapper, but it can dlopen a bytecode interpreter and execute your code "house of windy" turns this into leakless code execution with only OOB null byte writes pepsipu.com/blog/2026-09-dwa…
9
56
3
398
58,161
Replying to @0xedh @Qm9yamFN
More details and other interesting things at: plugandpwn.com
1
12
88
9,146
How a SIM can (and will) hack you: Security analysis of SIMs, attacks, and tools for research. 👨🏻‍💻🎫📱🩻👾 More details on: LinkedIn: linkedin.com/posts/dlaskov_c… Substack: it4sec.substack.com/p/how-a-…
93
4
482
21,120
My recent post on the mediatek 0day has been added to the legendary collection of Linux kernel exploitation resources by @andreyknvl !!! This is a huge milestone, thanks a lot!! :D github.com/xairy/linux-kerne…
17
120
8,387
0xedh retweeted
I wrote a book (in Spanish 🥲). It's a fairly niche book where I recount some anonymized Red Team operations I've executed over the last ten years. It doesn't cover modern TTPs, nor does it reveal anything "juicy", but I think it might be of interest to see how things changed.
7
11
1
51
7,315
Tired of noobs complaining the WINAPI for malware development is weird. It's not. How do you create a file? The CreateFile function. How do you open a file for reading? The CreateFile function. How do you open a file for writing? The CreateFile function. How do you get a handle to a directory? The CreateFile function. How do delete a file? The CreateFile function. How do you get access to a physical disk? The CreateFile function. How do you get access to a file stream? The CreateFile function. How do you get access to the console buffer? The CreateFile function. How do you get access to pipes? The CreateFile function. How do you perform interprocess communication? The CreateFile function. Just make sure you use the appropriate version of CreateFile (CreateFileA for ANSI, or CreateFileW for wide characters). Alternatively, you can use CreateFile2 which is the same as CreateFile except the parameters are passed as a data structure named CREATEFILE2_EXTENDED_PARAMETERS. However, be aware CreateFile2 only works on Windows 8 and above and designed more or less for programs running from the Windows app store. Alternatively, alternatively, you could use CreateFile3 which is nearly identical to CreateFile2 except it uses the CREATEFILE3_EXTENDED_PARAMETERS structure and is more or less designed for sandboxed packaged applications. However, be aware CreateFile3 only works on Windows11 24H2 and above. It's shrimple, honestly.
84
137
17
2,831
139,337
shipping v5 of LitterBox after way too many late nights real EDR in the loop now. drop an agent on your VM, fire payloads at it, alerts land back with full call stacks. Elastic Defend + Fibratus work. new UI + better performance — notes in the release. github.com/BlackSnufkin/Litt…
4
66
1
260
15,821
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
108
362
41
2,580
224,757
My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂 projectzero.google/2026/05/p…
2
57
1
230
22,777
0xedh retweeted
to celebrate the release of Copy Fail and the professional way the embargo and disclosure was handled by all involved parties i have sacrificed my lunchbreak to do a quick C port (with aarch64 support and some other small things) of the original PoC gist.github.com/blasty/d7b5d…
9
61
3
292
21,660
So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato securelist.com/phantomrpc-rp…
16
162
2
772
51,671
Introducing OpenMythos An open-source, first-principles theoretical reconstruction of Claude Mythos, implemented in PyTorch. The architecture instantiates a looped transformer with a Mixture-of-Experts (MoE) routing mechanism, enabling iterative depth via weight sharing and conditional computation across experts. My implementation explores the hypothesis that recursive application of a fixed parameterized block, coupled with sparse expert activation, can yield improved efficiency–performance tradeoffs and emergent multi-step reasoning. Learn more ⬇️🧵
237
1,209
196
8,124
1,686,945
0xedh retweeted
An automated N-day research pipeline at PwnFuzz. Ghidra + Ollama + n8n →Diffs Patch Tuesday binaries → LLM analyzes the output → Structured vuln reports, monthly AI-generated reports gets you oriented fast! Blog: ghostbyt3.github.io/blog/nda… Repo: github.com/ghostbyt3/nday-au…
114
1
492
26,744
Spread the word! @phrack CFP with demoscene cracktro is live. Turn up the volume and enjoy the awesome stylings of @PiotrBania with some hopefully inspiring text from phrack staff :) phrack.org/
6
135
5
251
41,610
Want to launch the REAL Notepad, and not the Copilot, tabbed, restart-surviving one? Use psexec.exe -s. And follow me for more Windows optimization tips!!1 ;)
27
45
4
450
42,075
0xedh retweeted
PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026 outflank.nl/blog/2026/01/07/…
2
62
240
11,781