Starting 2026 with a new blog! I've really been enjoying my Windows on ARM machine - so my post is about interrupts for WoA. This includes x64/ARM differences, virtual interrupts, Hyper-V's synthetic controller, and Secure Kernel interrupts/intercepts connormcgarr.github.io/windows-arm64-…

github.com/LabGuy94/CopyM… readcc.net/posts/copymywr… Released my POC which earned me a 3000$ bug bounty.

Yarden Shafir flux I dumped my research docs on it a little while ago, but it's not fully comprehensive gist.github.com/Kristal-g/eec0…

[New Origin blog+POC] No PPL? No problem! SecurityTrace, an undocumented ETW feature, restricts some AutoLogger traces to PPL only — yet we found this current design still allows non-PPL processes to consume from Threat-Intelligence as admin only! originhq.com/blog/securityt…

Obfusk8 : Lightweight Obfuscation library based on C++17 / Header Only for windows binaries : github.com/x86byte/Obfusk8

In you missed it (I did, I don't know how), Microsoft is aiming to phase out UAC and replace it with a more secure thingie called "Administrative Protection". They're doing this because UAC currently has over 81 bypasses and, for reasons unknown to me, Microsoft decided to

Reversing a Microsoft-Signed Rootkit: The Netfilter Driver - Reverse Engineering Attempts. Author: ⁦⁦Splintersfury⁩ Great detailed write-up. If anyone interested in driver reversing, do check his work out. 🫡🔥 splintersfury.github.io/mal_blog/post/…

x.com/i/article/2017…

THE CHINESE GOVERNMENT USED MICROSOFT WARBIRD APIS FOR OBFUSCATION > proof-of-concept by Michael B. in 2023 > 30 stars on GitHub > 62 likes on Xitter This is fucking FIRE research. Insanely slept on research. I am FLABBERGASTED.

Patch diffing + RCA for clfs.sys can awhile. I gave the diff + binary to a local LLM. It mapped the UAF path, race condition, all IOCTLs in <20 min LLMs don't replace the work, they are momentum. New blog post following the UAF trail of CVE-2025-29824: clearbluejar.github.io/posts/how-llms…

We’re releasing our analysis of ring-1.io, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.

Ever wanted to draw a triangle with OpenGL as a 2kb position-independent shellcode? No? Me neither. But you can do it anyway: github.com/wbenny/scfw

Writing a C Compiler from scratch? The book teaches you compilers. I wanted to understand Clang. After 10 chapters of @NoStarch's "Writing a C Compiler", I have decided to also implement a Codegen for LLVM IR. A Simpler Clang 🧵

You thought rust avoids memory leaks? Think again - In rust, global variables are leaked by design. This means that practically there is no 'safe' way to use Rust in a dynamic library that can unload - if some third party crate decides to use a global variable it won't be freed.

I've published the first entry in my new Windows vulnerability research series. It details how exploring Windows I/O completion internals led to uncovering a use-after-free in afd.sys (CVE-2026-21241). rce4fun.blogspot.com/2026/02/use-af…

In the final part of his blog series, James Forshaw tells the story of how a bug was introduced into a Windows API. Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process. projectzero.google/2026/02/gphfh-…

One of our engineers just did a detailed writeup for one of his Google kCTF kernel exploits. The bug is 20 years old and has been there since Linux 2.6.12! open.substack.com/pub/calif/p/a-…

vibecoder asks claude code to build a chat app, gets a working prototype in 20 minutes, immediately tweets "just killed slack and discord"… brother you don't even know what a distributed system is. you don't know what database replication means. you have no idea how websocket

[RELEASE] Better late than never! Part 3 is out! Fantastic unwind information and where to find them. We went digging through .pdata, RTF Lookups, and a few ntdll internals that probably weren't meant to be touched. BYOUD dropping alongside. Enjoy 😉 klezvirus.github.io/posts/Byoud/