ö
@r0keb
low level enthusiast
Good Morning! Just published a blog post diving into Windows Kernel LFH exploitation in the latest Windows 24h2 build, Focusing on controlled allocations to achieve arbitrary read/write in the kernel. r0keb.github.io/posts/Modern-(…
Good morning! Just published a blog post diving into Windows Kernel Pool internals: basics, memory allocation functions, internal structures, and how Segment Heap, LFH, and VS work. r0keb.github.io/posts/Windows-…
Just published a blog post exploring junk code engines used in polymorphic malware. Part one covers ETG by Z0MBiE (32-bit). Part two introduces TrashFormer, my 64-bit implementation. Both fully written in assembly. r0keb.github.io/posts/Junk-Cod…
Good morning! Just published a deep dive into PatchGuard internals: how it works, key internal functions, context init, and possible bypasses. r0keb.github.io/posts/PatchGua…
Good morning! I just published a blog post about a KASLR bypass that works on modern Windows 11 versions. It leverages Intel CPU cache timings to exfiltrate the base address of ntoskrnl.exe. I hope you like it! r0keb.github.io/posts/Bypassin…
`CVE-2025-24203`: hierarchy of vm_object_t when changing `MAP_SHARED` to `MAP_PRIVATE`. The topmost object has its own physical page.
obfus.h is the powerfull compile-time obfuscator for C (win32/64). Supports virtualization, anti-debugging, control flow obfuscation and other code mutation techniques to prevent disassembly or decompilation. github.com/DosX-dev/obfus… #CodeSecurity #Obfuscation #infosec
Just dropped a blog post on NtQuerySystemInformation changes that killed an old kASLR bypass. Added some internals research too, pre & post 24H2. Check it out! r0keb.github.io/posts/kASLR-In…
Unlock forbidden Windows knowledge! 🤫💻 Find the PEB through truly undetected means and pop calculator 💥 The non-golf form will be available below 👇 #redteamtips #windowsinternals #rust
New blog post out! I cover two SMEP bypass techniques in the Windows Kernel: one using a Write-What-Where to flip the U/S bit in the PTE, and another via type confusion with ROP and stack pivoting. Check it out! r0keb.github.io/posts/Bypassin…
I've just published a new blog post where I explain various Shellcoding techniques in the Windows Kernel. There's also a GitHub repo with the code used. Hope you enjoy it! r0keb.github.io/posts/Windows-…
Think HVCI and kCET mean the end of kernel code execution? I wrote a blogpost exploring an alternative way to execute a kernel payload! :) blog.slowerzs.net/posts/keyjumpe…
Write-up of my v8 bug: Critical type confusion in V8's Turboshaft compiler allowed stale pointers to bypass GC, leading to exploitable memory corruption. Full details + PoC: bushido-sec.com/index.php/2025…
Better domatolpm generation: groups.google.com/a/chromium.org… Add a notification_service domatolpm MojoJS fuzzer: chromium-review.googlesource.com/c/chromium/src… Introduce an automated MojoJS IPC fuzzer that uses DomatoLPM to generate JS based testcases: chromium-review.googlesource.com/c/chromium/src…
I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm! Go check it out at github.com/googleprojectz…. While we still have a way to go in improving it, we think it shows a promising approach!
Today I’m sharing a blog post on the implementation of kernel mode shadow stacks on Windows! This post covers actively debugging the Secure Kernel and also outlines why VTL 1 is relied on to help maintain the integrity of the supervisor shadow stacks! connormcgarr.github.io/km-shadow-stac…
For the hardcore reverse engineers and malware analysts out there, my ex-colleague just dropped a deep dive into 'Scatterbrain,' the obfuscator behind PoisonPlug malware. If you're into long technical breakdowns, this one's worth a read. cloud.google.com/blog/topics/th…
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. elastic.co/security-labs/… Project: github.com/x86matthew/Win…
Here's a video series of someone struggling to build an 8-bit superscalar CPU, and they're still not finished after a year. youtube.com/@fabianschuiki…