@33y0re Profile picture

Connor McGarr

@33y0re

Security Researcher @preludeorg

Similar User
x86matthew photo

@x86matthew

Reverse Engineering and More photo

@re_and_more

offensivecon photo

@offensive_con

Yarden Shafir photo

@yarden_shafir

Pavel Yosifovich photo

@zodiacon

Saar Amar photo

@AmarSaar

Chetan Nayak (Brute Ratel C4 Author) photo

@NinjaParanoid

RET2 Systems photo

@ret2systems

Matt Hand photo

@matterpreter

S3cur3Th1sSh1t photo

@ShitSecure

Daniel F. photo

@VirtualAllocEx

James Forshaw photo

@tiraniddo

maxpl0it photo

@maxpl0it

an0n photo

@an0n_r0

Samuel Groß photo

@5aelo

Pinned

Recently I was writing up a blog about Secure Kernel and NT working together to initialize Kernel CFG. I realized there were a lot of concepts in SK I was unfamiliar with. Because of this I wrote a post on one of those topics - Secure Image Objects. Enjoy! connormcgarr.github.io/secure-images/


A big thank you to the awesome @AlanSguigna for kindly and patiently giving me an overview of the powerful SourcePoint Debugger! I now have a really cool Secure Kernel debugging environment and I look forward to what the weekend holds 😊

Tweet Image 1

I am very happy to have presented my talk "Redefining Security Boundaries: Unveiling Hypervisor-Backed Security Features For Windows Security" at SANS HackFest 2024! The slides can be found here for anyone who is interested: (github.com/connormcgarr/P…)

.@33y0re is here discussing how hypervisor-backed security features are changing the game in Windows security by blocking modern Bring Your Own Vulnerable Driver (BYOVD) attacks. 🚀 Register Free Online & Join Us: sans.org/u/1vBt #SANSHackFest

Tweet Image 1


Connor McGarr Reposted

Debugging the Windows Hypervisor and dissecting Secure Kernel calls – my latest blog post takes you through the process, step-by-step. dor00tkit.github.io/Dor00tkit/post… #Hyperv #ReverseEngineering


Connor McGarr Reposted

Proud of the team for getting this new mitigation to address CLFS issues to Insiders this month. Bypasses for this feature are in-scope for Windows Bounty, so please tell us what we've missed!

Security mitigation for the Common Log Filesystem (CLFS) techcommunity.microsoft.com/t5/security-co…



After 5 years, today is my last day at CrowdStrike. It’s been so fulfilling to ship so many awesome features to customers and to learn what low-level development is about! I am happy to say I will be joining @preludeorg & I look forward to working on some really cool projects 😀


Connor McGarr Reposted

Join us at #SANSHackFest when @33y0re will discuss how hypervisor-backed security features are redefining Windows security & blocking modern Bring Your Own Vulnerable Driver (BYOVD) attacks. View Agenda & Register: sans.org/u/1vBt

Tweet Image 1

Connor McGarr Reposted

Join me in Los Angeles this October! Now that DEFCON is over I'm focusing my energy on Hackfest Hollywood on October 28th and 29th! I'm looking forward to connecting with so many folks who I missed in Las Vegas. ...and it's Halloween Horror Nights at Universal Studios, where the…


Connor McGarr Reposted

Wanted to share a technical blog post that I coauthored on some of the architectural decisions that I helped drive during my time as Chief Architect @CrowdStrike all those years ago. Thank you to the team and @dwizzzleMSFT for the partnership. crowdstrike.com/blog/tech-anal…


Connor McGarr Reposted

📣 The #SANSHackFest Agenda is LIVE & packed w/ highly technical talks from @dwizzzleMSFT @yarden_shafir @buffaloverflow & David Cash @33y0re & more! Join us in Hollywood for exclusive access to ALL talks, workshops, & challenges. ➡️ Agenda: sans.org/u/1vBt #PenTest

Tweet Image 1

Connor McGarr Reposted

I'm happy to share that I'll be giving a workshop at @44CON about WinDbg, where I'll introduce a tool I've developed to make debugging much easier. Time to tame the Windows debugger together! 44con.com/44con-2024-tal…


Connor McGarr Reposted

I’m thrilled to share my latest blog post! This one focuses on the bug hunting process: inspiration, approach, and execution. I also provide a retrospective on how the bug was introduced and analyze the insufficient “patch”. Check it out: securityintelligence.com/x-force/little…


Connor McGarr Reposted

Following in @33y0re's footsteps by reviewing his excellent article, Windows Internals: Dissecting Secure Image Objects - Part 1 (connormcgarr.github.io/secure-images/) in my latest Hyper-V blog: asset-intertech.com/resources/blog….

Tweet Image 1

Conditional breakpoint for monitoring Secure System Calls: ba e1 /w "@$curregisters.User.rdx == SECURE_SYSTEM_CALL_NUMBER" nt!VslpEnterIumSecureMode Useful for dynamic parameter inspection since the calls aren't really all that documented!

Tweet Image 1

Connor McGarr Reposted

Thanks to everyone who attended my talk! @offensive_con was an incredible experience. Couldn't make it? Don't worry- here are my slides! Recommend them to anyone wanting to learn more about Secure Boot's third-party risks. nbviewer.org/github/microso…

Ecstatic to share that my talk was accepted to Offensive Con. Excited to have an excuse to visit the city I was born in. Hope to see you there!

Tweet Image 1


Loading...

Something went wrong.


Something went wrong.