Hobby security researcher, 20.

Joined October 2021
That's right - an unsigned driver loaded and running with #HVCI enabled. And the best part? The system still appears as locked down. Article coming soon.
12
17
343
12,173
Looks like this post attracted the attention of MSRC - so just to confirm: this is not a vuln! This is a teaser of my upcoming Secure Kernel research series, and while I did get unsigned drivers to load, it can only be done by breaking the root of trust. Not VTL 0.
1
2
144
Wintel is coming for your SMEP bypasses! No more flipping the U/S bit in a PTE to mark a user-mode page as supervisor-mode on Intel Arrow Lake CPUs :) (note: this is meant for protection against speculative attacks, with the side effect of becoming SMEP 2.0)
7
29
2,834
TIL: If you disable DSE by modifying nt!g_CiOptions to load an unsigned kernel driver, it will be logged :)
1
10
52
4,497
Microsoft put C:\inetpub junk there for a reason 🫠 CVE-2025-21204 #greatfix
3
25
334
21,490
Dug into @RiotVanguard's kernel driver's dispatch table hooks. The article took an unexpected turn half way through, as I found some not yet documented stuff, such as the complete list of system calls hooked by the driver. Article link: archie-osu.github.io/2025/04…
1
54
172
12,165
ETW is an incredibly powerful tool in the wrong hands. Just finished writing about how it allows drivers to hook context switches on Windows 11 24H2 while remaining PatchGuard and HVCI compatible: archie-osu.github.io/etw/hoo…
5
72
236
16,112
Hooking context switches on 24H2 like InfinityHook did in the old days... My first writeup's coming soon 😊
4
1
5
755
Is it me or does it look like the crowdstrike driver is loading arbitrary binary files into kernel space and executing them?? Is csagent bypassing all security of the kernel?? The faulty file is all 00s!!
5
12
3
55
12,560
Turns out if you bp nt!MiCopyFromUntrustedMemory, you prevent WinDbg from working at all
11
1
3
433
yooo why vgk.sys tryna query KVM clocks, I ain't even running the riot client 😭😭😭 #valorant #vanguard
1
1
7
1,114
Ever wondered how those custom loaders work? They're native user-mode applications running under SMSS — «BootExecute applications». That's the earliest stage a user-mode application can be invoked in, right before winlogon.
14
14
278
11,127
just updated Windows what the FUCK is this
148
325
48
5,836
385,625
#HoloCure modding has made a lot of advances in 2023, and it's now possible to mod the official YYC versions. Most of the currently worked-on projects are listed in this Reddit thread on the official subreddit: reddit.com/r/holocure/s/STjb… 2024 will hopefully bring even more mods.
307
so apparently it's possible to delete files that are in-use in Windows - nuking the entire C:\Windows folder was a bad idea😅 i wonder what happens if this runs during the windows setup🤔 @endermanch
1
256
The Anti-AntiAdblocker uBlock Origin filter to get rid of the annoying YouTube message. It turns off the JavaScript anti-adblock payload: go.enderman.ch/cKoci
322
5,200
585
35,070
2,556,534
170 of the loldrivers.io drivers load with the most recent HVCI driver blocklist. Do with this information what you will.
6
81
1
325
112,752
Archie retweeted
hehe
4
25
172
12,247
Archie retweeted
Amazing how many problems you can solve on Windows by killing dllhost. Its almost like COM was a mistake
2
1
110