low-level developer with a focus on 𝙸𝚗𝚝𝚎𝚕 𝚡𝟾𝟼 ISA devices running 𝚆𝚒𝚗𝚍𝚘𝚠𝚜 | R&D @BHinfoSecurity | infosec.exchange/@winterknif…
Coruscant
- Tweets 1,079
- Following 5,157
- Followers 5,393
- Likes 8,558
Pinned Tweet
Releasing SILVERPICK, a Windows shellcode development framework using C/C++.
github.com/winterknife/SILVE…
3
52
242
18,619
winterknife 🌻 retweeted
Another M6 gem: return addresses that remember where they came from (PAuth_LR).
On M6, Apple's x1 slice signs each return address with the address of the instruction that signed it, not just the stack pointer. Is pacibsp reuse dead?
Let's find out: almamatertech.com/notes/retu…
3
5
377
winterknife 🌻 retweeted
Get introduced to IDA, an industry-standard disassembler! Learn breakpoints, stepping, memory/register inspection. The essential start for any RE path. Debuggers 1101: Introductory IDA ost2.fyi/Dbg1101
9
87
3,306
🔎 New Windows vulnerability discovered by Adrian Denkiewicz (@a_denkiewicz) of #doyensec - a high-severity flaw in one of Windows’ Virtualization-Based Security (VBS) enclaves that enables VTL1 code reuse. A first look at our ongoing research into this class of vulnerabilities.
🔗 blog.doyensec.com/2026/10/13…
#appsec #security
ALT Sparks coming out of the monitor while Adrian is typing, because his bug is so "shocking" :)
1
29
102
5,905
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/d…
2
31
151
7,220
winterknife 🌻 retweeted
Apple's M6 brings a new gem: checked pointer arithmetic (CPA).
Let’s dig in: almamatertech.com/notes/chec…
18
66
7,391
winterknife 🌻 retweeted
If you update WinDbg, you might notice a few changes :) There's now an official MCP server for the debugger.
devblogs.microsoft.com/perfo…
7
39
183
10,310
winterknife 🌻 retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
12
89
336
20,039
winterknife 🌻 retweeted
Today we’re soft launching BitBender, a SaaS for automated binary deobfuscation: unpacking, import fixing, OEP restore, and related prep.
IDA and Binja MCP are powerful, but packed or obfuscated samples still bog down LLM analysis. BitBender is meant to clear that layer first.
Early beta. If you want access, get in touch: bitbender.io
9
19
108
5,993
winterknife 🌻 retweeted
New video: basic reversing of a Windows kernel driver.
WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port.
Full write-up: trainsec.net/library/malware…
3
113
564
17,166
A cute little trick to get TEB* without accessing the FS segment register: load the TEB segment selector into SS and the 0x18 offset into ESP before executing a POP ESP.
Big TEB will not be happy about this :)
gist.github.com/winterknife/…
3
21
133
12,913
Disclosing Branch Target Reuse (BTR): speculative execute-after-free in JIT engines. Code gets freed, but branch predictions survive. BTR exploits this mismatch to mount practical Spectre-v2 attacks (cBPF /etc/shadow exploit demo below). Details at: vusec.net/projects/btr
1
48
147
13,033
winterknife 🌻 retweeted
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform.
Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now.
Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential.
RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators.
The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout.
It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with.
Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together.
If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation.
businesswire.com/news/home/2…
16
28
165
9,506
winterknife 🌻 retweeted
I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paint… 1/3
1
24
119
9,228
winterknife 🌻 retweeted
Part 2 of our CVE-2025-13032 research is live.
From a paged pool overflow to full LPE on Windows 11: IORing RegBuffers corruption, MDL-based kernel address leak, and SYSTEM token theft.
CVE is patched. Full write-up:
safateam.com/intelligence-hu…
14
29
2,385
Is antivirus coming to iPhone?
Find out in the latest installment of our Apple Internals series, by the one and only @blacktop__
calif.io/research/ios-endpoi…
1
20
103
24,466
winterknife 🌻 retweeted
Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while.
The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background.
I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking.
Repo: github.com/marcosd4h/wesp_re…
Tech doc: github.com/marcosd4h/wesp-re…
Thanks to @yarden_shafir for putting this on my radar
1
61
182
13,695
Releasing another pywintrace-based ETW consumer for SysCallEnter + StackWalk events.
TL;DR: System call tracing from user mode but it's asynchronous, and you get the call stack rather than the arguments.
Link: github.com/winterknife/EVENS…
15
61
3,629
Releasing another mini project: pywintrace-based consumer for Microsoft-Windows-Kernel-Audit-API-Calls ETW provider.
Link: github.com/winterknife/EVENS…
P.S. This could be how Elastic Defend gets the call stack for SetThreadContext calls since it is not available with ETW-TI event.
3
19
121
5,486