Can Bölük
@_can1357
Followers
7K
Following
734
Media
46
Statuses
381
Security researcher and reverse engineer. Interested in Windows kernel development, low-level programming, static program analysis and cryptography.
Joined June 2012
It's been a while since I wrote anything so I wrote an article on how to discover the entire x86-64 instruction set in seconds including any hidden instructions and learn their basic properties while on it. There were some pretty interesting results! https://t.co/t7vMwYDYas
blog.can.ac
As cheesy as the title sounds, I promise it cannot beat the cheesiness of the technique I’ll be telling you about in this post. The morning I saw Mark Ermolov’s tweet about the undocume
9
416
1K
Threw a diagram I sketched out at Gemini expecting some barely coherent mermaid diagram and it perfectly reconstructed the entire state machine with precisely matching flow arrows. Guess paper is back. This thing reads my handwriting better than I do.😅
0
0
12
Europe has already slipped into the totalitarian shadow on speech. 12,000 yearly arrests in the UK for SoMe posts. Germany doing their best to catch up. France detained Pavel. Danmark convicting people for jokes. @JDVance was right in Munich.
world.hey.com
The new American vice president JD Vance just gave a remarkable talk at the Munich Security Conference on free speech and mass immigration. It did not go over well with many European politicians,...
The EU weaponizes people’s strong emotions about child protection to push mass surveillance and censorship. Their surveillance law proposals conveniently exempted EU officials from having their own messages scanned — and David’s post helps explain why.
70
372
3K
It's official: I'm co-founding zystem Inc, building a new continuous profiling platform called zymtrace. The idea is to take "whole system" one step further to also cover CUDA/GPU/ML workloads. We also see a looot of unrealized potential left in CPU profiling. [1/n]
3
12
98
Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles. It has worked against every version of Patchguard for the last 7 years, without needing any updates! https://t.co/H5dDddpuMP
blog.can.ac
I have released another article about Patchguard almost 5 years ago, ByePg, which was about exception hooking in the kernel, but let’s be frank, it didn’t entirely get rid of Patchguard
14
123
330
A preprint of my paper "Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions" ( https://t.co/RZUjlMfUvc) is now available. This work extends algebraic MBA deobfuscation techniques to handle semi-linear MBAs - a class that existing techniques struggle with.
arxiv.org
Mixed Boolean-Arithmetic (MBA) obfuscation is a common technique used to transform simple expressions into semantically equivalent but more complex combinations of boolean and arithmetic...
3
31
82
Europe is maybe two months from passing laws that end private communication as we know it, and folks are looking the other way (understandably.) You’re not going to get a do-over once these laws are passed.
Two major changes: target detection based on risk and require more than one hit to reduce false positives will not have meaningful impact on protection of fundamental rights. 2/10
40
817
2K
> Want to reverse engineer notepad.exe for lulz to figure out what hotkey is toggling right-to-left reading order because I keep hitting it accidentally > MBA obfuscated imports
17
36
463
Similar sitution for ci, netio, ntdll etc as well, just lost track at this point 😓
0
0
6
Whats going on with MSDL? I feel like half the binaries Microsoft shipped over the past 3-4 months have missing PDBs. July 2023: https://t.co/SkJ5487CGr June 2023:
2
1
15
We’ve just published another great Plugin Focus article! Can Bölük ( @_can1357 ) introduces his NtRays plugin for automated simplification of Windows Kernel decompilation. Read more 🌐 https://t.co/59PKiBDlSY
#IDAPro #IDAPython #IDAPlugin #NtRays
0
24
80
I had an inquiry about ACPI checks, and decided to run through how they work and how to mitigate them on VMware and QEMU. It's a quick and dirty write-up, so excuse the brevity. https://t.co/uzCH6kRtr7
revers.engineering
Walkthrough of detecting VMware through ACPI checks in user mode, and mitigating the checks in VMware.
4
31
81
@dwizzzleMSFT I thought you said this wasn't for drm? 🤥
1
1
10
Happy to release a neat little plugin for IDA Pro! Bitfield and bitflag accesses have been an annoyance that requires another window open and constant fiddling. You can now fix that with just a few key presses! https://t.co/alM0J36oee
1
60
192
They literally started using the name Pluton again with no shame... It's hilarious to me what the consumers are willing to trade for a fancy (yet unusable) UI from a company that refuses to update its previous generation scheduler just to make people switch. </rant>
0
3
28
I was given the opportunity by @ByfronTech to analyze their current work w/ @_can1357. I could see it competing with if not overtaking some of the solutions on the market. Outstanding work by the engineers behind it, and it isn't even done yet. https://t.co/PGTa9xMRMn
corp.roblox.com
Roblox is reimagining the way people come together. Our platform enables anyone to create, connect, learn, shop and express themselves in immersive 3D experiences.
2
9
52
Added Intel CET, VMX extensions + rdrand/rdseed, invpcid/invlpga, xsaves/xrstors as well.
0
0
7
NtRays can now lift RCR, RCL, CLAC, STAC, SWAPGS, CPUID, XSETBV, XGETBV, IRETQ, SYSRETQ, Trapframe access in ISRs and KUSER_SHARED_DATA access both kernel-mode and user-mode. It's all slowly becoming readable!
4
12
115
Also releasing a C++20 wrapper for Hex-Rays API, which can be found at https://t.co/FYm9Plu1HC. Thanks to @RolfRolles for giving me some samples to get started at!
github.com
Header only wrapper around Hex-Rays API in C++20. - GitHub - can1357/HexSuite: Header only wrapper around Hex-Rays API in C++20.
0
5
58
Been experimenting with Hex-Rays API today and wrote a plugin that simplifies NT Kernel decompilation. So far it can remove instrumentation, lift dynrelocs and RSB flushes. Source code and the binary are below, let me know if you have any feedback! https://t.co/bfRSvdwLkC
7
91
370
