iiinova — where your digital self keeps evolving

Yarden Shafir @yardenshafir.bsky.social · 27/07/2026

Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself. Might be common knowledge but it surprised me so I'm sharing it here windows-internals.com/random-windo...

071

Yarden Shafir @yardenshafir.bsky.social · 23/04/2026

I checked and it's been 2 years since my last blog post??? So anyway, here's a quick blog post about KDP pool - the latest KDP feature that will replace the secure pool in future Windows versions: windows-internals.com/goodbye-secu...

082

Yarden Shafir @yardenshafir.bsky.social · 31/01/2026

Registration is open to all RECon classes! As usual, I’ll be teaching Windows Internals. This is the only time this year that the class is offered in North America 😊 And if windows isn’t your thing, there are lots of other great classes! recon.cx/2026/en/trai...

042

Yarden Shafir @yardenshafir.bsky.social · 29/05/2025

Looks like BlueHatIL talks are online now, so here’s my talk for anyone who wanted to learn about the latest episode of KASLR and couldn’t make it: www.youtube.com/watch?v=Dk2r...

youtube.com

BlueHat IL 2025 - Yarden Shafir - Look, Ma—No Privileges! How Windows Gives You Kernel Pointers...

YouTube video by Microsoft Israel R&D Center

192

Yarden Shafir @yardenshafir.bsky.social · 25/04/2025

AI search engines are the future

130

Yarden Shafir @yardenshafir.bsky.social · 07/04/2025

Microsoft threat actor found in the wild

060

Yarden Shafir @yardenshafir.bsky.social · 03/04/2025

For about a year now, WdBoot.sys essentially does nothing. Microsoft installs 2 versions: - \System32\drivers\wdboot.sys is the “full”, functional version - \System32\drivers\wd\wdboot.sys is the “empty” version, which is the one being updated and loaded. Does anyone know the reason behind this?

Wdboot.sys driver entry, function is empty and has no functionality.

221

Yarden Shafir @yardenshafir.bsky.social · 29/03/2025

Oh look they’re going to vibe program the SSA systems. I’m sure this will be perfectly fine and will cause no issues.

050

Yarden Shafir @yardenshafir.bsky.social · 20/03/2025

This cute little thing sounds like a witch laughing in a dark forest and has tried to kill me twice so far

1100

Yarden Shafir @yardenshafir.bsky.social · 16/03/2025

I was told Australia is scary but didn’t expect to land and immediately get threatened by a public bus

071

Reposted by Yarden Shafir

netspooky @vacci.ne · 06/03/2025

"Zen and the Art of Microcode Hacking" Tragic signature bypass enables custom microcode loading on AMD processors, and a tool to do it. The blog is extremely well written and provides concise explanations of topics mentioned + plenty of resources! A must read. bughunters.google.com/blog/5424842...

bughunters.google.com

Blog: Zen and the Art of Microcode Hacking

This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

0339

Yarden Shafir @yardenshafir.bsky.social · 06/03/2025

Small anecdote about thread priorities and throttling on Windows 11: I’m downloading a large file. Estimated time left: 28 minutes. Open notepad, put it as the front window. Download time left: 57 minutes. Close notepad, browser back in front. Time left: 27 minutes.

130

Yarden Shafir @yardenshafir.bsky.social · 05/03/2025

I’m not saying you definitely have to go to @BlueHatIL this year, I’m just letting you know it’s free, by the beach and I’ll be there dropping kernel pointers to anyone who asks nicely

050

Yarden Shafir @yardenshafir.bsky.social · 19/02/2025

Going to a Rocky Horror show in a quiet UK town and the crowd is almost entirely old British people so I’m expecting an incredible time

270

Yarden Shafir @yardenshafir.bsky.social · 07/02/2025

Every single Canadian stereotype is correct. It is -4c (24f) today and I've seen one people walking around in shorts and another one in a short-sleeved t-shirt. Not a single person is wearing a hat.

000

Yarden Shafir @yardenshafir.bsky.social · 02/02/2025

Did a bit of baking this weekend

050

Yarden Shafir @yardenshafir.bsky.social · 27/01/2025

Does anyone know companies hiring for entry level roles (in Canada/remote)? And I mean *real* entry level, not degree + 2 certs + 3 years experience “entry level”. Not just cybersecurity, any entry level roles at all, in any area.

110

Yarden Shafir @yardenshafir.bsky.social · 15/01/2025

Yesterday Microsoft fixed 6 kernel address leaks that I reported CVE-2025-21316 CVE-2025-21317 CVE-2025-21318 CVE-2025-21319 CVE-2025-21320 CVE-2025-21321

2362

Yarden Shafir @yardenshafir.bsky.social · 05/01/2025

The fact those toggles have a different design is driving me crazy

1112

Yarden Shafir @yardenshafir.bsky.social · 31/12/2024

I see someone is working through their backlog

Diff showing a Windows change called Feature_ButtonMakeAssertFixFrom2018

050

Yarden Shafir @yardenshafir.bsky.social · 26/12/2024

My grandma made this dinosaur tail vase

050

Yarden Shafir @yardenshafir.bsky.social · 16/12/2024

You should all see this photo that my phone just reminded me of

080

Yarden Shafir @yardenshafir.bsky.social · 16/12/2024

Important news: Microsoft is working to bring SMAP into Windows www.youtube.com/watch?v=-3jx... Great talk by Joe Bialek from MORSE team

youtube.com

BlueHat 2024: S09: Pointer Problems – Why We’re Refactoring the Windows Kernel

YouTube video by Microsoft Security Response Center (MSRC)

1187

Yarden Shafir @yardenshafir.bsky.social · 27/08/2023

Sudden eye infection and doctor visit is not how I planned to spend my Sunday morning. But it does mean I can spoil myself with the world’s largest pizza slice and not feel guilty about it.

030

Yarden Shafir @yardenshafir.bsky.social · 25/08/2023

My summer associate Michael Lin wrote a powershell script to help you find out which vulnerable/malicious drivers from loldrivers.io will successfully load on your HVCI-enabled system: github.com/trailofbits/...

github.com

GitHub - trailofbits/HVCI-loldrivers-check

Contribute to trailofbits/HVCI-loldrivers-check development by creating an account on GitHub.

020

Yarden Shafir @yardenshafir.bsky.social · 19/08/2023

Friend and I were walking around when we heard a very loud bug. Started digging in the dirt to try and find it. Within 5 minutes 2 separate groups of men got curious and joined us. Is this how men make friends?

300

Yarden Shafir @yardenshafir.bsky.social · 30/07/2023

As of build 25915 (latest Preview) all known API based kernel address leaks no longer work unless requested by a process with SeDebugPrivilege (only available to admin processes)

Screenshot of program output showing a call to NtQuerySystemInformation with SystemModuleInformation class returning 0 for all ImageBase fields

020

Yarden Shafir @yardenshafir.bsky.social · 22/07/2023

Guess who got to visit an erupting volcano today

120

Yarden Shafir @yardenshafir.bsky.social · 15/06/2023

My new hair got my barista so distracted he forgot how to do latte art. I’m gonna count it as a compliment

140

Yarden Shafir @yardenshafir.bsky.social · 13/06/2023

When you stare long enough into the void of tax forms, eventually it’ll stare back and ask why you still haven’t filed your taxes for 2021

010

Yarden Shafir @yardenshafir.bsky.social · 13/06/2023

Looks like two major conferences in a month is more than I can handle. Conference fatigue is intense.

010

Yarden Shafir @yardenshafir.bsky.social · 18/05/2023

To one day be as confident as the student who approached me over break with a speech on how I can improve my class…

020

Yarden Shafir @yardenshafir.bsky.social · 13/05/2023

This coffee shop sticker wall is across from the anti capitalist art wall

000

Yarden Shafir @yardenshafir.bsky.social · 09/05/2023

Achievement unlocked: made an open source C++ project compile

000

Yarden Shafir @yardenshafir.bsky.social · 09/05/2023

Finally got the chance to try out SymbolBuilder and it's incredible. Here are some WNF callbacks generated with it. Symbol builder code and instructions are here: github.com/microsoft/WinD…

000

Yarden Shafir @yardenshafir.bsky.social · 09/05/2023

Good morning, here is a pile of kittens on a trampoline

130

Yarden Shafir @yardenshafir.bsky.social · 08/05/2023

This cat is living its best life

000

Yarden Shafir @yardenshafir.bsky.social · 08/05/2023

This baby deer is so tiny and so good at pretending to be a rock

020