@sixtyvividtails.bsky.social - sixtyvividtails

05 Oct 2025 00:14 +0000

Close your eyes and ✨imagine: From a low-integrity process (from LPAC even), you can inject your data anywhere you want: privileged tasks, PPL/protected processes, the OS kernel itself, and VTL1 trustlets. Now open your eyes. It is not hypothetical. It is the reality. Read it on page 33. [contains quote post or other embedded content]

30 Aug 2025 21:00 +0000

Error you may randomly get anytime you delete stuff: błąd 0x80070050. Nevermind the shellful bin and Shellberus the dog (recycler shell32 dev). Error is due to rnd name generation for the bin: $R[A-Z0-9]{6}<.ext>. Deleting 2 files: 36⁻⁶ ≈ 2⁻³¹ fail chance. 🎈Birthday paradox: 50% 🎲 for 54933 files.

23 Aug 2025 22:46 +0000

What is Volume Serial Number (aka VolId/VolumeId)? For ntfs it's 64 bits at offset +0x48 from the volume start (in the $Boot file). You see its lower dword with "dir C:". But how it's calculated? Is it good for #DFIR? 👉 It's just a weak hash over 429.5 seconds of system time.

15 Aug 2025 07:02 +0000

Greetings, fellow timetravelers. Today is Monday. But if I could convince Pope Gregory XIII not to skip weekdays @1582-10-15, today could still be Friday! But there's a problem. To meet Pope, I gotta set clock on my Windows to the year 1582, yet it refuses: only allows 1601. How to set it to 1582?

01 Aug 2025 15:57 +0000

Finally, a script to estimate IQ of your PC! Copypaste it into powershell console, get instant result! $9={[Runtime.InteropServices.Marshal]:: ReadInt64(1TB-64MB-+-$args[0]-shr9)};` (&$9 4KB)/(&$9 (900.9MB/9.9/7-shr5))/` 25/(&$9)*(2L-shl55) Is your PC smart? Can you deduce what is that metric?

23 Jun 2025 23:05 +0000

Windows can seamlessly patch your code when it catches #GP. So called "alignment fixup". KiOpPatchCode modifies user code: movaps->movups, movdqa->movdqu. Needs x64 code, and opt-in: SetErrorMode(SEM_NOALIGNMENTFAULTEXCEPT), or ProcessEnableAlignmentFaultFixup, or ThreadEnableAlignmentFaultFixup.

15 Jun 2025 12:23 +0000

Did you know Windows has built-in RAM disk? And not just your regular RAM disk. It's pmem/nvdimm, via built-in scmbus.sys facility! That means you can make 🦆🦆🦆 #dax volume, so data/image mappings (section views) will use "drive" directly! No data persistence, no w10; only ws2022/w11+. EZ 📀 create:

05 Jun 2025 17:27 +0000

ntoskrnl #kASLR 🚫: r$t0=0;# and*77FFFF winload!MmArchInitialize L200;r$t0=@$exp;.while(by(@$t0)){r$t0=@$t0+1};ed@$t0-3 0; ed MmArchKsegAddressRange 0 FFFFF800; r$t0=SymCryptRngAesGenerate;ed@$t0 33CA8B48 E9D2;ed@$t0+6 memset-@$t0-A; ed OslGatherEntropy C3C033; ed BlArchGetPerformanceCounter C3C033 [contains quote post or other embedded content]

01 Jun 2025 18:15 +0000

There are lots of misoptimisations in the OS kernel with /dynamicValueFixupSym. E.g. index check for SK PFN db — is it "cmp rcx, 0x07FF'FFFF'FFFF>>3"? Size is constant after all. Nope. Gotta load SKMM_PFN_DATABASE_END, SKMM_PFN_DATABASE, sub, shift, etc — dozens of extra instr, in a lot of places.

06 May 2025 22:06 +0000

Heard of #ContextJail? It's a nasty new technique: puts target thread into ⓪ deadloop, for as long as you can afford. Requires THREAD_GET_CONTEXT right. The gist? Just spam NtGetContextThread(tgt).😸 Target will be jailed, running nt!PspGetSetContextSpecialApc 🔁. Src & binary in [ALT]. Usecases: ⤵️

16 Apr 2025 00:53 +0000

Kernel VA region for system images has size 512_GB (256_TB LA57). And nt!MiAssignTopLevelRanges shuffles regions order before VA assignment. So why is ntoskrnl always in the first 31_GB from 0xFFFF_FF80_0000_0000?! That's just how winload.efi randomizes MmArchKsegBias. #KASLR #0xFFFFFF8000000000

31 Mar 2025 04:07 +0000

WinDbg script to check kCFG target function validity, and also to dump actual cfguard bitmap (which can be quite different from what's specified in the image GFIDS, needs more research): pastebin.com/64kujJNb. !check_cfguard "nt!longjmp" !dump_cfguard_bitmap "nt", "C:/cfguard_bitmap_ntoskrnl.bin" https://pastebin.com/64kujJNb

12 Feb 2025 00:41 +0000

Is your EDR a dump? With crashdmp it literally is: cmd /v/c "set R=reg add HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /f /v&!R! CrashDumpEnabled /d ୭ /t ൪&!R! DumpFileSize /d ൬৬६ /t ៤&for /f "delims=*" %i in ('sc qc WinDefend^|find "PATH_"')do (set t=%i&!R! DedicatedDumpFile /d !t:~๒੯,-១!)"

10 Feb 2025 04:59 +0000

Stack /GS cookie - GuardStack "__security_cookie" - has protected NT for nearly 25 years. Do you know why higher word zeroed in 64-bit 🍪? Yep, it's against attacks like strcat/wcscat. But did you realize that's 𝗵𝗮𝗹𝗳-𝗯𝗿𝗼𝗸𝗲𝗻?! Yes, xoring "0000" with ⓪ RSP gives "FFFF" 😹. …and it's worse with LA57.

03 Feb 2025 07:18 +0000

24H2 has reduced KiCyclesPerClockQuantum by a factor of 6 - from ~(15.625/3) ms to ~(15.625/18) ms. But QuantumReset compute changed too, so final revise is not so drastic. Was: 31.25 to 93.75 ms; now: 15.625 to 31.25 ms, yet min is 1.74 ms. But WTF: clock interrupts every 2 ms across *each* CPU!

10 Nov 2024 22:59 +0000

Nel mezzo del cammin di nostra vita, mi ritrovai per una selva oscura, ché la diritta via era smarrita.