Researcher at Talos. No infosec drama, no opinions, no politics, Tech and Tools only. Author of Dyn. Data Resolver (Winner of Hex-Rays Plugin Contest 2020).
Germany
Joined May 2015
- Tweets293
- Following844
- Followers682
- Likes1.1K
Holger Unterbrink retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Holger Unterbrink retweeted
Unlocking AMD CPU with DRAM scrambling: PSP, C6, microcode, SMM, etc
github.com/xoreaxeaxeax/skit…
Credits @xoreaxeaxeax
#infosec
Holger Unterbrink retweeted
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/d…
Holger Unterbrink retweeted
BREAKING NEWS: Riot just announced Vanguard On-Demand. Vanguard no longer needs to start at boot.
If you enable Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU, Vanguard will only run while you play. Microsoft built a Runtime Driver Attestation Report that lets Vanguard verify driver integrity without needing to be present at boot.
For everyone who complained about Vanguard running at startup, this is the answer. Enable your hardware security features and it goes away.
The blog also breaks down every cheat vector in detail: kernel exploits, BYOVD, DMA hardware cheats, bootkits, hypervisors, and pixelbots. With real data showing cheaters deliberately downgrade to older Windows to avoid security features.
riotgames.com/en/news/vangua…
Some of the best security engineers in the industry working on one of the hardest problems in gaming. Massive respect for publishing this level of detail publicly.
@deteccphilippe @nickeverdox @aidankhoury
#AntiCheat #Vanguard #GameSecurity
Satoshi Tanda found bugs in Microsoft's own Hyper-V hypervisor and HVCI implementation as a by-product of learning how they work. Let that sink in.
His blog covers Intel VT-rp (the hardware defense Intel built to counter EPT-based hooking), kernel shadow stacks, SMM isolation, Hyper-V enforced security policies, and how he hunted down a HVCI bug in UEFI.
His open-source projects include a hypervisor for stealth EPT-based kernel API monitoring (DdiMon), a UEFI hypervisor that boots a full operating system, minimal hypervisors for both Intel and AMD, and a full training course on building hypervisors from scratch for security researchers.
DdiMon and HyperPlatform have been forked and adapted by game cheaters for years as the foundation for EPT-based hooking in the wild. The same code that was built for research became the backbone of an entire cheating ecosystem.
If you are learning hypervisor development, Windows internals, or platform security, his work is where you start.
Blog: tandasat.github.io/blog/
GitHub: github.com/tandasat
Training: tandasat.github.io
Author: @standa_t
#WindowsInternals #ReverseEngineering #InfoSec
Holger Unterbrink retweeted
Here's the fourth part of my blog series on Compiler and LLVM internals. Co-authored with @0xP0ch1ta
This blog provides a basic introduction to Machine IR, followed by an in-depth explanation of how to write and run an LLVM Machine Function Pass.
Key concepts covered:
1. Machine IR
2. Machine Basic Blocks
3. MachineModuleInfo
4. Target, TargetRegistry and TargetMachine.
5. MIR Parser
sh4dy.com/2026/10/04/learnin…
Holger Unterbrink retweeted
If you're into reverse engineering, Windows internals or anti-cheat research, @cra0_net 's blog is one of those archives you can lose an entire weekend in.
Years of reversing games, engines and protection systems:
• IDA tooling + function signature preservation
• Windows kernel debugging with WinDbg/KDNET
• Source 2 reversing
• VAC / VAC3 / VAC Live
• Code integrity + DLL verification
• Byfron Hyperion anti-tamper
• BattlEye + Windows loader internals
• Anti-debugging
• File formats, game engines and asset formats
• Hardware reversing
Some particularly good rabbit holes:
VAC3 / Valve false-positive research:
cra0.net/blog/posts/archived…
CS2 Code Integrity, VAC, VACnet + VAC Live:
cra0.net/blog/posts/counter-…
Byfron Hyperion Anti-Tamper:
cra0.net/blog/posts/byfron-h…
BattlEye + ntdll loader internals:
cra0.net/blog/posts/archived…
Preserving RE work across binary updates with IDA:
cra0.net/blog/posts/ida-plug…
Windows kernel debugging Part 1:
cra0.net/blog/posts/debuggin…
Windows kernel debugging Part 2 / KDNET:
cra0.net/blog/posts/debuggin…
Full archive:
cra0.net/blog/
Game hacking is often just reverse engineering with a different objective.
Anti-cheat research in particular sits right at the intersection of RE, Windows internals, anti-tamper, detection engineering and systems security.
Old and new, there's a lot of gold in this archive.
#ReverseEngineering #WindowsInternals #InfoSec
Holger Unterbrink retweeted
idasql v0.0.18 - "SELECT * FROM binary" edition.
Oh, btw, ...."SELECT * FROM true_believers"
github.com/allthingsida/idas…
Holger Unterbrink retweeted
Finally, I made a video showing a new approaching to vibe reverse engineering.
What you can do with this, is up to your imagination.
Check the vibe-re gallery here too: github.com/0xeb/vibe-re
Stop reverse engineering by hand.
New video: I introduce IDASQL, the first tool in the xSQL family. It exposes IDA Pro's database and API as live SQL, so your AI agent can query a binary the way it queries a database.
Headless RE, source recovery, multi-binary queries.
youtu.be/OSfuKLWMtAA
Holger Unterbrink retweeted
Bots constantly flooding with malware on GitHub, same stars count on the new repositories, and GitHub's process is too slow / time consuming to report all.
Holger Unterbrink retweeted
Friends, @allthingsida was a fun experiment while it lasted.
The account is now parked and links to @BinaryWizards.
The AllThingsIDA YouTube channel will no longer receive updates. Going forward, new videos will be published on the Binary Wizards channel:
youtube.com/@binary-wizards
I’m still focused on learning, teaching, and sharing what I find interesting. The difference is that the scope is now broader than just IDA. Expect workshops, training courses, videos, articles, and discussions covering reverse engineering, binary analysis, low-level programming, systems, tooling, and other topics that fit under the Binary Wizards umbrella.
Thanks to everyone who followed AllThingsIDA. I hope you’ll continue the journey with me at BinaryWizards.
Holger Unterbrink retweeted
What's new in IDA 9.4 Beta.
(This video also acts as a mini tutorial for some of the new features).
youtube.com/watch?v=LCYkkYL9…
@HexRaysSA
Holger Unterbrink retweeted
My talk "SELECT * FROM binary - Vibe Reversing Across IDA, Ghidra, and Binary Ninja" got accepted at @reconmtl .
I am happy to talk about this toolset (idasql, bnsql and ghidrasql) and how it is designed to allow AI agents to work across all these top 3 reverse engineering tools.
Point Claude, Codex, or your favorite agent to any single one or all of them at once, and allow your agent can now use the tools all at once to analyze one or more binary at once.
These work nicely with loops like "/goal" to allow e2e analysis over many hours.
Use cases:
- Full source code recovery (with types and code structure)
- Full database annotations (also with type recovery, comments, etc.)
- Binary diffing
- Or just any kind of Q&A against your binary or binaries
cfp.recon.cx/recon-2026/talk…
Holger Unterbrink retweeted
This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.
A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).
Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.
Reads like malware. Because it is. Videos and full technical breakdown in the link.
Author: gsmll.github.io/hypervenom/w…
#ReverseEngineering #Malware #AntiCheat
While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.
After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.
They found $12 million in Bitcoin and kept going.
This is what kernel anti-cheat is actually fighting.
back.engineering/blog/04/02/…
Authors: @BackEngineerLab
#AntiCheat #Malware #InfoSec
Holger Unterbrink retweeted
Static Devirtualization of Themida/CodeVirtualizer. The techniques in this article apply to pretty much every virtual machine obfuscator with minor modifications.
back.engineering/blog/09/05/…
Original Program & Devirtualized Output
github.com/backengineering/t…
Holger Unterbrink retweeted
With the help of Claude Mythos Preview, the Firefox team fixed more security bugs in April than in the past 15 months combined.
I am very happy that @reconmtl accepted my talk about real world EDR killer. Looking forward to see you guys in Montréal 😁
cfp.recon.cx/recon-2026/talk…
Holger Unterbrink retweeted
We have started announcing Recon 2026 Presentations recon.cx/2026/en/speakers.ht…
More talks to be announced soon once we have confirmations @frodosobon @realytcracker @allthingsida @hexnomad @0x464D @hunterbr72 @joegrand @clearbluejar @InvokeReversing @LennertWo @pinkflawd @Coiffeur0x90 @MathildeVenault @NicoleFishi19 @nicolodev @phLaul @SinSinology @i0n1c @mr_phrazer @tmanning @hex86_64
#REcon2026 #ReverseEngineering #InfoSec #cybersecurity
