low-level developer with a focus on ๐ธ๐๐๐๐ ๐ก๐พ๐ผ ISA devices running ๐๐๐๐๐๐ ๐ | R&D @BHinfoSecurity | https://nitter.cf/t.co/lyJL0y7qRZ
Coruscant
Joined June 2017
- Tweets1.1K
- Following5.2K
- Followers5.4K
- Likes8.6K
Pinned Tweet
Releasing SILVERPICK, a Windows shellcode development framework using C/C++.
github.com/winterknife/SILVEโฆ
winterknife ๐ป retweeted
Video of my @UnpromptedAU & Bsides Canberra talks out now
I built an autonomous N-Day exploit pipeline for the Windows kernel w/ mix of deterministic and AI-led stages. Results were comparable to what Anthropic achieved with Mythos using a much less powerful model.
Now online from BSides Canberra 2026: @chompie1337 presents โBuilding an Autonomous N-day Exploit Generation Pipelineโ.
Watch now: youtu.be/03Xh_6_6U4M
winterknife ๐ป retweeted
Itโs good to learn about wesp but no one is being โevictedโ from the kernel.
This will help EDRs move at least some of their monitoring and detection logic into user mode. This is a good thing!
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform.
TLDR; Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
Elastic Blog: elastic.co/security-labs/bloโฆ
winterknife ๐ป retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
โข wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
โข EspFilterPort: the filter communication port it uses to reach user mode
โข espclient.dll: 120 Esp* exports for rules, filters and event queues
winterknife ๐ป retweeted
๐ข IDA 9.5 is here: more platforms, more agentic power.
โ 3 new decompilers: Android Dalvik, Infineon TriCore and Qualcomm Hexagon
โ IDA MCP and Assist for AI-driven reverse engineering
โ Recursive decompilation across call graphs
โ IDA Home now includes 11 cloud decompilers instead of 2, at the same price
โ And much, much more
Itโs one of our biggest releases yet. Active license holders can download it now from the Download Center.
hex-rays.com/blog/ida-9.5-reโฆ
winterknife ๐ป retweeted
Another M6 gem: return addresses that remember where they came from (PAuth_LR).
On M6, Apple's x1 slice signs each return address with the address of the instruction that signed it, not just the stack pointer. Is pacibsp reuse dead?
Let's find out: almamatertech.com/notes/retuโฆ
winterknife ๐ป retweeted
Get introduced to IDA, an industry-standard disassembler! Learn breakpoints, stepping, memory/register inspection. The essential start for any RE path. Debuggers 1101: Introductory IDA ost2.fyi/Dbg1101
winterknife ๐ป retweeted
๐ New Windows vulnerability discovered by Adrian Denkiewicz (@a_denkiewicz) of #doyensec - a high-severity flaw in one of Windowsโ Virtualization-Based Security (VBS) enclaves that enables VTL1 code reuse. A first look at our ongoing research into this class of vulnerabilities.
๐ blog.doyensec.com/2026/10/13โฆ
#appsec #security
ALT Sparks coming out of the monitor while Adrian is typing, because his bug is so "shocking" :)
winterknife ๐ป retweeted
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/dโฆ
winterknife ๐ป retweeted
Apple's M6 brings a new gem: checked pointer arithmetic (CPA).
Letโs dig in: almamatertech.com/notes/checโฆ
winterknife ๐ป retweeted
If you update WinDbg, you might notice a few changes :) There's now an official MCP server for the debugger.
devblogs.microsoft.com/perfoโฆ
winterknife ๐ป retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. Iโm at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-Bโฆ
winterknife ๐ป retweeted
Today weโre soft launching BitBender, a SaaS for automated binary deobfuscation: unpacking, import fixing, OEP restore, and related prep.
IDA and Binja MCP are powerful, but packed or obfuscated samples still bog down LLM analysis. BitBender is meant to clear that layer first.
Early beta. If you want access, get in touch: bitbender.io
winterknife ๐ป retweeted
New video: basic reversing of a Windows kernel driver.
WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port.
Full write-up: trainsec.net/library/malwareโฆ
A cute little trick to get TEB* without accessing the FS segment register: load the TEB segment selector into SS and the 0x18 offset into ESP before executing a POP ESP.
Big TEB will not be happy about this :)
gist.github.com/winterknife/โฆ
winterknife ๐ป retweeted
Disclosing Branch Target Reuse (BTR): speculative execute-after-free in JIT engines. Code gets freed, but branch predictions survive. BTR exploits this mismatch to mount practical Spectre-v2 attacks (cBPF /etc/shadow exploit demo below). Details at: vusec.net/projects/btr
winterknife ๐ป retweeted
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform.
Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now.
Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential.
RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary theyโre emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid humanโAI teams, and AI operators.
The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout.
Itโs been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . Weโre now 15 strong and growing, with some of the most talented security researchers Iโve ever worked with.
Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldnโt be prouder of this team and what weโve built together.
If you lead an internal enterprise red team or build capabilities for the warfighter, Iโd welcome a conversation.
businesswire.com/news/home/2โฆ
winterknife ๐ป retweeted
I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paintโฆ 1/3
winterknife ๐ป retweeted
Part 2 of our CVE-2025-13032 research is live.
From a paged pool overflow to full LPE on Windows 11: IORing RegBuffers corruption, MDL-based kernel address leak, and SYSTEM token theft.
CVE is patched. Full write-up:
safateam.com/intelligence-huโฆ
winterknife ๐ป retweeted
Is antivirus coming to iPhone?
Find out in the latest installment of our Apple Internals series, by the one and only @blacktop__
calif.io/research/ios-endpoiโฆ
