Inside hypervisors, kernels & firmware.

Oct 29 · 33 min read

What discrete and firmware TPMs are, how they keep keys, record the boot in PCRs, and prove a machine's state to a remote verifier through credential activation and quotes.

• TPM 2.0
• Attestation
• Measured boot
• Hardware security
• Firmware security

Oct 24 · 43 min read

Tracing EDK II's TPM 2.0 initialization, PCR usage, measured byte streams, crypto-agile event logs, replay and the firmware-to-OS handoff.

• UEFI
• TPM 2.0
• EDK II
• Measured boot
• Firmware security

Oct 15 · 34 min read

Tracing TPM key release, PCRs, PIN hashing, EFI update servicing and anti-rollback checks—and assessing the security boundaries of Windows' BitLocker boot chain.

• BitLocker
• TPM 2.0
• UEFI
• Secure Boot
• Windows internals
• Reverse engineering

Oct 8 · 21 min read

Tracing VMCS ownership, segment state, host interrupts, enlightened VMCS access and VTL switching through Hyper-⁠V's Intel execution paths.

• Hyper-V
• Reverse engineering
• Intel VMX
• VTL
• Windows internals

Sep 27 · 12 min read

Following Hyper-⁠V's partition hypercalls to recover the current-partition context, child enumeration, ownership checks and synchronization around teardown.

• Hyper-V
• Reverse engineering
• Windows internals
• Intel x64