low-level developer with a focus on 𝙸𝚗𝚝𝚎𝚕 𝚡𝟾𝟼 ISA devices running 𝚆𝚒𝚗𝚍𝚘𝚠𝚜 | R&D @BHinfoSecurity | infosec.exchange/@winterknif…
Joined June 2017
- Tweets 1,002
- Following 5,077
- Followers 5,198
- Likes 8,200
41 Photos and videos
Pinned Tweet
14 Nov 2025
Releasing SILVERPICK, a Windows shellcode development framework using C/C .
github.com/winterknife/SILVE…
3
53
239
17,682
winterknife 🌻 retweeted
Apple open-sourced Darwin's #XZone allocator in libmalloc-792 late last year. #DFF Co-Founder & CTO Jonathan Levin (@Morpheus______) breaks it all down, expanded from his book Disarming Code: type isolation, the xzm_malloc() path, and walking the heap with memento(j).
df-f.com/blog/darwin-libsyst…
#DFFenders Blog
28
132
7,755
after a three year hiatus, I decided to finally start posting again‼️
in which I look at "ND3WY.sys", also known as SleepySheriff - a malicious NDIS driver used by Equation Group starting in the early 2000s.
straitbizarre.com/blog/disse…
1
28
79
7,136
winterknife 🌻 retweeted
Jun 10
Cobalt Strike 4.13 is live! Say "Hello World" to our Beacon Interpreter for native C scripting - plus an LLVM Beacon, smoother docking UX, sharper payload management and more. Read about all the new features in the release blog!
cobaltstrike.com/blog/cobalt…
3
35
94
11,156
Updated my project to bypass write protection via PFN remapping, including a demo against KDP (one of the few techniques that still work against VBS features).
Note that Intel VT-rp HLAT (vPro Enterprise chipsets only) will prevent this class of attack.
github.com/winterknife/EVENS…
May 23
Updated my project to bypass write protection via PTE manipulation.
HVCI / KDP will prevent this technique by marking the code / data page as read-only in the SLAT entry.
Do note that the Dirty bit is clear in the PxE despite the page being written to.
github.com/winterknife/EVENS…
2
16
99
6,225
Even without HLAT, HyperGuard runs checks at random intervals and will detect the swap, unless it is restored afterward.
2
694
We're mostly an IDA shop at @CellebriteLabs, but I decided to play around with Ghidra. My main motivation was to experiment with agentic reverse engineering techniques. The result is an agent skill for Ghidra, which we are releasing publicly:
github.com/cellebrite-labs/g… >>
7
103
422
59,185
winterknife 🌻 retweeted
Jun 4
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
praetorian.com/blog/wasmforg…
#wasm #malware #sliver
3
24
72
8,734
winterknife 🌻 retweeted
This gets even dumber. Microsoft built a VBS enclave into msedge! It protects data even from kernel drivers! That would've been the perfect place to store passwords! And they are using it to store... a bit of static configuration data.
Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.
9
32
413
40,667
winterknife 🌻 retweeted
Jun 3
It seems like in the latest preview build(s) ETW functionality has been encapsulated in it's own DLL (ETW.dll) -e.g., ControlTrace/etc. are now exported by this DLL instead of sechost/ADVAPI32/etc. Seems to just be code re-org (for now) - but maybe the future will reveal more!
1
25
147
7,745
winterknife 🌻 retweeted
New Zero Day Engineering research: Chrome Exploit Mitigations, by @alisaesage zerodayengineering.com/resea…
33
114
19,811
winterknife 🌻 retweeted
We’re opening the Exodus research vault.
Over the coming weeks, we’ll publish technical writeups highlighting vulnerability research, exploit development, and deep reverse engineering from our team.
First up: Michele Campa’s Adobe Acrobat Reader Escript.api use-after-free RCE.
blog.exodusintel.com/2026/06…
#VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #OffensiveSecurity #CyberSecurity
74
315
18,942
winterknife 🌻 retweeted
Jun 2
Fresh @safebreach Labs research! 🔥
CVE-2025-59199 breaks down a highly creative low-integrity Windows LPE path.
Learn how Notifications, COM objects, URIs, DevTools, and Windows Apps chain together in a single exploit. Great work team! 👇
safebreach.com/blog/click-or…
1
17
43
3,455
winterknife 🌻 retweeted
May 29
I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.
Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.
praetorian.com/blog/llm-edr-…
1
19
67
9,798
winterknife 🌻 retweeted
Reverse Engineering - Resolving Confusion Over PsGetCurrentProcess, PsGetCurrentProcessId and PsGetProcessId - Using WinDbg to understand dependency between KPCR, KPRCB, K/ETHREAD, K/EPROCESS and KAPC_STATE structures. dennisbabkin.com/blog/?i=AAA…
18
59
6,910
RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation
Just showing some appreciation for @ChaoticEclipse0's excellent work. Hopefully this won't get us banned!
open.substack.com/pub/calif/…
1
46
164
17,444
winterknife 🌻 retweeted
Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:
github.com/eversinc33/MogVMP
The approach is different from my last blog, as it lifts the whole x86 code of the VM
17
92
406
17,877
May 23
Updated my project to bypass write protection via PTE manipulation.
HVCI / KDP will prevent this technique by marking the code / data page as read-only in the SLAT entry.
Do note that the Dirty bit is clear in the PxE despite the page being written to.
github.com/winterknife/EVENS…
May 17
Made a small project to bypass write protection and write to read-only pages in kernel space.
Nothing novel here, but the code is well commented for your reading pleasure.
I hope you will find it useful in your no doubt questionable endeavors :)
github.com/winterknife/EVENS…
2
17
127
17,111
winterknife 🌻 retweeted
May 22
Striga: Lifting x86 to LLVM IR with Python by @mrexodia
secret.club/2026/05/21/strig…
13
83
6,290
winterknife 🌻 retweeted
I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX.
voidsec.com/cve-2026-40369-b…
1
61
207
15,993