Windows internals

Oct 15 · 34 min read

Tracing TPM key release, PCRs, PIN hashing, EFI update servicing and anti-rollback checks—and assessing the security boundaries of Windows' BitLocker boot chain.

• BitLocker
• TPM 2.0
• UEFI
• Secure Boot
• Windows internals
• Reverse engineering

Oct 8 · 21 min read

Tracing VMCS ownership, segment state, host interrupts, enlightened VMCS access and VTL switching through Hyper-⁠V's Intel execution paths.

• Hyper-V
• Reverse engineering
• Intel VMX
• VTL
• Windows internals

Sep 27 · 12 min read

Following Hyper-⁠V's partition hypercalls to recover the current-partition context, child enumeration, ownership checks and synchronization around teardown.

• Hyper-V
• Reverse engineering
• Windows internals
• Intel x64