Sabitlenmiş Tweet
While researching @kaspersky's components, I've decided to write a fun project that makes possible hooking system calls from your own driver by interfacing with its hypervisor: github.com/iPower/Kaspers…
English
iPower
552 posts
iPower
@iPowerPower
Just a guy who likes anime, fighting games, hypervisors and reverse engineering. Member of @the_secret_club. Do not DM me about game cheats.
Katılım Nisan 2020
143 Takip Edilen1.9K Takipçiler
iPower retweetledi
There's a lot of misinformation and panic going around about the Windows GDID (Global Device ID), let's talk about what it actually is. 🧵
vx-underground@vxunderground
> Peter Stokes > Scattered Spider guy > Arrested > Microsoft helps FBI > Read court documents > Page 12 > Microsoft tracks Stokes from GDID > Microsoft Global Device Identifier (GDID) > Stokes used Windows > Page 34 > GDID assigned to each OS install > GDID unique to each device > GDID only change if OS wiped > Stokes GDID 6755467234350028 > GDID reported internet activity to Microsoft > GDID showed Stokes using Ngrok > GDID reported Stokes IP address > GDID showed Stokes web activity > GDID showed timestamps of web activity > GDID mapped with video game activity > GDID showed games played > GDID undocumented > GDID only mentioned in one MSDN document > Azure UCDOStatus > Azure Monitor Logging
English
iPower retweetledi
Ending the Fable experiment here.
After 6 days and ~1400$ in Anthropic subs, we have Py3.14 JIT codegen and pon package-manager! (12,578$ @ API pricing)
1/x Although not 100% conformant, numpy working seamlessly is pretty impressive, esp. considering the wheel installation itself also required it to get meson/Cython working.
Can Bölük@_can1357
Can't use fable for work (sec), but I really wanted to push it's limits, so went with: > Write an AoT compiler for Python 3.14 in Rust with GreenTea GC, make no mistakes. We're 150 agents & 2 days in, it's going pretty OK ngl.
English
iPower retweetledi
Here's the last IDA 9.4 pre-release teaser...
We've significantly improved Swift binary analysis. In this blog, we're focusing on two different improvements:
1️⃣ Proper modelling of the Swift ABI
2️⃣ Proper typing of Swift runtime functions
👉 hex-rays.com/blog/ida-9.4-i…
English
iPower retweetledi
Striga: Lifting x86 to LLVM IR with Python by @mrexodia
secret.club/2026/05/21/str…
English
iPower retweetledi
New video: creating COM objects with the class moniker.
Most of you know CoCreateInstance.
Here is another way: class moniker. I walk through what the class moniker is, how the registry resolves the clsid: prefix to an implementation in combase.dll, and then rebuild the whole thing manually with MkParseDisplayName and IMoniker::BindToObject.
youtu.be/P-L-gTjbtSI
YouTube
English
iPower retweetledi
I often need to explore Windows kernel crashdumps when I'm on Linux/macOS.
WinDbg unfortunatelly doesn't work in Wine.
So... I did a thing. It's multiplatform - doesn't depend on dbgeng.dll nor DIA. WinDbg-flavored.
And it's fast. Really fast.
github.com/vmi-rs/ephemera
English
iPower retweetledi
I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.
revers.engineering/applied-re-cru…
English
iPower retweetledi
I'm adding Hyper-V (using the Windows Hypervisor Platform) as emulation backed to Sogen, my Windows userspace emulator:
While providing slightly less analytical functionality, it should be a game changer in terms of speed 🥳
sogen.dev
English
iPower retweetledi
Started a blog series on writing a minimal ARM hypervisor from scratch — boots as a UEFI app, claims EL2, identity-maps everything through Stage 2.
Chapter 0 just dropped: ARM vs x86 virtualization, UEFI internals, EDK2 setup, first app at EL2.
0xabe.io/hypervisor/arm…
English
iPower retweetledi
Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).
github.com/daaximus/ida-r…
English
iPower retweetledi
TIL FILE_READ_ACCESS is not mandatory to map a SEC_IMAGE into memory.
English
iPower retweetledi
iPower retweetledi
My new hobby: Asking AI the same question over and over again, and looking at the results.
Here's an example - I've asked gemini-2.5-flash 100 times to add two large numbers.
It's really undecided.
The correct answer is not there btw.
English
iPower retweetledi
iPower retweetledi
Try the ask_ida/c++ GPT [ chat.openai.com/g/g-VgbIr9TQQ-… ] for IDA SDK related questions in C/C++.
English
iPower retweetledi
My new blog post 🥳
Improving AFD Socket Visibility for Windows Forensics & Troubleshooting
It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥
huntandhackett.com/blog/improving…
English
iPower retweetledi
ok its finally done: the improved version of no-defender, a tool that interacts with WSC api to disable window defender the way how microsoft intended it
github.com/es3n1n/defendn…
English
iPower retweetledi
Good news! The recording of our talk at @reconmtl 2024, JTAG debug of Windows Hyper-V / Secure Kernel with WinDbg and DCI/EXDI, presented together with @ivanrouzanov, is now available on YouTube: youtube.com/watch?v=YKFXWs…. Turn on subtitles.
YouTube
English
iPower retweetledi
Nice to see Intel and MSFT's posts on VT-rp / HVPT.
If you are interested in playing with the feature, simple example code is here: github.com/tandasat/Hello…
Kunal Mehta@kmgkv1
Intel VT-rp community.intel.com/t5/Blogs/Tech-…
English
iPower retweetledi
The new blog post on supervisor shadow stack restrictions / supervisor shadow-stack control
tandasat.github.io/blog/2025/04/0…
English