# Berkan YILDIZ — Blog

> Reverse engineering and security research on Hyper-V, Windows internals and UEFI firmware, with disassembly and reconstructed code.

Writeups by Berkan YILDIZ. Each article is available as Markdown by appending `.md` to its HTML URL. Markdown responses contain publication metadata and the original article body, including code, tables and source links. Relative links resolve against the blog's origin. The canonical HTML URL is included in each response.

## Writeups

- [How a TPM works, from PCRs to remote attestation](https://blog.berkan.fr/how-a-tpm-works.md): What discrete and firmware TPMs are, how they keep keys, record the boot in PCRs, and prove a machine's state to a remote verifier through credential activation and quotes.
- [Inside UEFI: TPM initialization, PCRs and the event log](https://blog.berkan.fr/uefi-tpm-initialization.md): Tracing EDK II's TPM 2.0 initialization, PCR usage, measured byte streams, crypto-agile event logs, replay and the firmware-to-OS handoff.
- [BitLocker, the TPM and the UEFI boot chain](https://blog.berkan.fr/bitlocker-tpm-boot-chain.md): Tracing TPM key release, PCRs, PIN hashing, EFI update servicing and anti-rollback checks—and assessing the security boundaries of Windows' BitLocker boot chain.
- [Inside hvix64: the guest execution engine](https://blog.berkan.fr/hvix64-execution-engine.md): Tracing VMCS ownership, segment state, host interrupts, enlightened VMCS access and VTL switching through Hyper-⁠V's Intel execution paths.
- [Inside hvix64: partition IDs, ownership and lifetime](https://blog.berkan.fr/hvix64-partition-lifecycle.md): Following Hyper-⁠V's partition hypercalls to recover the current-partition context, child enumeration, ownership checks and synchronization around teardown.

## Optional

- [Blog](https://blog.berkan.fr): Browse or search all published writeups.
- [Atom feed](https://blog.berkan.fr/feed.xml): Recent writeups in full, with publication dates.
- [Sitemap](https://blog.berkan.fr/sitemap.xml): Canonical HTML URLs and last modification dates.