iiinova — where your digital self keeps evolving

Yarden Shafir @yardenshafir.bsky.social · 27/07/2026

Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself. Might be common knowledge but it surprised me so I'm sharing it here windows-internals.com/random-windo...

071

Yarden Shafir @yardenshafir.bsky.social · 23/04/2026

I checked and it's been 2 years since my last blog post??? So anyway, here's a quick blog post about KDP pool - the latest KDP feature that will replace the secure pool in future Windows versions: windows-internals.com/goodbye-secu...

082

Yarden Shafir @yardenshafir.bsky.social · 31/01/2026

Registration is open to all RECon classes! As usual, I’ll be teaching Windows Internals. This is the only time this year that the class is offered in North America 😊 And if windows isn’t your thing, there are lots of other great classes! recon.cx/2026/en/trai...

042

Yarden Shafir @yardenshafir.bsky.social · 29/05/2025

Haven’t uploaded them but happy to do that if you find them useful on their own :)

110

Yarden Shafir @yardenshafir.bsky.social · 29/05/2025

Looks like BlueHatIL talks are online now, so here’s my talk for anyone who wanted to learn about the latest episode of KASLR and couldn’t make it: www.youtube.com/watch?v=Dk2r...

youtube.com

BlueHat IL 2025 - Yarden Shafir - Look, Ma—No Privileges! How Windows Gives You Kernel Pointers...

YouTube video by Microsoft Israel R&D Center

192

Yarden Shafir @yardenshafir.bsky.social · 25/04/2025

I wonder if Google maps can give me driving directions to TraceView, Tennessee

010

Yarden Shafir @yardenshafir.bsky.social · 25/04/2025

AI search engines are the future

130

Yarden Shafir @yardenshafir.bsky.social · 07/04/2025

Microsoft threat actor found in the wild

060

Yarden Shafir @yardenshafir.bsky.social · 03/04/2025

To me this looks like an oversight by Microsoft, not an intentional thing, but I’m not sure windows defender ever blocked any drivers through the ELAM callback so I don’t know if this changes much. Other EDRs: do you use the ELAM blocking functionality or only use it for the cert?

020

Yarden Shafir @yardenshafir.bsky.social · 03/04/2025

For about a year now, WdBoot.sys essentially does nothing. Microsoft installs 2 versions: - \System32\drivers\wdboot.sys is the “full”, functional version - \System32\drivers\wd\wdboot.sys is the “empty” version, which is the one being updated and loaded. Does anyone know the reason behind this?

Wdboot.sys driver entry, function is empty and has no functionality.

221

Yarden Shafir @yardenshafir.bsky.social · 29/03/2025

The dying words of the American empire will be “I don’t think this code does anything. I’ll go ahead and delete that.”

1170

Yarden Shafir @yardenshafir.bsky.social · 29/03/2025

Oh look they’re going to vibe program the SSA systems. I’m sure this will be perfectly fine and will cause no issues.

050

Yarden Shafir @yardenshafir.bsky.social · 22/03/2025

Knowing they eat steak makes them even scarier

010

Yarden Shafir @yardenshafir.bsky.social · 20/03/2025

This cute little thing sounds like a witch laughing in a dark forest and has tried to kill me twice so far

1100

Yarden Shafir @yardenshafir.bsky.social · 16/03/2025

I was told Australia is scary but didn’t expect to land and immediately get threatened by a public bus

071

Yarden Shafir @yardenshafir.bsky.social · 06/03/2025

Windows is going through some stuff right now

110

Reposted by Yarden Shafir

netspooky @vacci.ne · 06/03/2025

"Zen and the Art of Microcode Hacking" Tragic signature bypass enables custom microcode loading on AMD processors, and a tool to do it. The blog is extremely well written and provides concise explanations of topics mentioned + plenty of resources! A must read. bughunters.google.com/blog/5424842...

bughunters.google.com

Blog: Zen and the Art of Microcode Hacking

This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

0339

Yarden Shafir @yardenshafir.bsky.social · 06/03/2025

Small anecdote about thread priorities and throttling on Windows 11: I’m downloading a large file. Estimated time left: 28 minutes. Open notepad, put it as the front window. Download time left: 57 minutes. Close notepad, browser back in front. Time left: 27 minutes.

130

Yarden Shafir @yardenshafir.bsky.social · 05/03/2025

I’m not saying you definitely have to go to @BlueHatIL this year, I’m just letting you know it’s free, by the beach and I’ll be there dropping kernel pointers to anyone who asks nicely

050

Yarden Shafir @yardenshafir.bsky.social · 20/02/2025

Wanted to live tweet so bad but also didn’t wanna look away from the show it was so good. And the best singer in this was Janet!

010

Yarden Shafir @yardenshafir.bsky.social · 19/02/2025

Not that I saw but there were some of the usual shout outs and the narrator responded to all of them

010

Yarden Shafir @yardenshafir.bsky.social · 19/02/2025

“It was a strange night… how strange? As strange as the strangest thing going through Trump’s head”

000

Yarden Shafir @yardenshafir.bsky.social · 19/02/2025

This is a full theatre production, live singing and all. This is everything I could ever ask for. The narrator is brilliant and I’m crying laughing.

210

Yarden Shafir @yardenshafir.bsky.social · 19/02/2025

Going to a Rocky Horror show in a quiet UK town and the crowd is almost entirely old British people so I’m expecting an incredible time

270

Yarden Shafir @yardenshafir.bsky.social · 07/02/2025

Every single Canadian stereotype is correct. It is -4c (24f) today and I've seen one people walking around in shorts and another one in a short-sleeved t-shirt. Not a single person is wearing a hat.

000

Yarden Shafir @yardenshafir.bsky.social · 02/02/2025

Did a bit of baking this weekend

050

Yarden Shafir @yardenshafir.bsky.social · 27/01/2025

Does anyone know companies hiring for entry level roles (in Canada/remote)? And I mean *real* entry level, not degree + 2 certs + 3 years experience “entry level”. Not just cybersecurity, any entry level roles at all, in any area.

110

Yarden Shafir @yardenshafir.bsky.social · 15/01/2025

Yesterday Microsoft fixed 6 kernel address leaks that I reported CVE-2025-21316 CVE-2025-21317 CVE-2025-21318 CVE-2025-21319 CVE-2025-21320 CVE-2025-21321

2362

Yarden Shafir @yardenshafir.bsky.social · 05/01/2025

The fact those toggles have a different design is driving me crazy

1112

Yarden Shafir @yardenshafir.bsky.social · 31/12/2024

I see someone is working through their backlog

Diff showing a Windows change called Feature_ButtonMakeAssertFixFrom2018

050

Yarden Shafir @yardenshafir.bsky.social · 28/12/2024

I have three parking apps and seven taxi/ride share apps installed and I feel this so much

010

Yarden Shafir @yardenshafir.bsky.social · 26/12/2024

My grandma made this dinosaur tail vase

050

Yarden Shafir @yardenshafir.bsky.social · 16/12/2024

Lol yes, still getting used to the ARM terms myself

010

Yarden Shafir @yardenshafir.bsky.social · 16/12/2024

You should all see this photo that my phone just reminded me of

080

Yarden Shafir @yardenshafir.bsky.social · 16/12/2024

Important news: Microsoft is working to bring SMAP into Windows www.youtube.com/watch?v=-3jx... Great talk by Joe Bialek from MORSE team

youtube.com

BlueHat 2024: S09: Pointer Problems – Why We’re Refactoring the Windows Kernel

YouTube video by Microsoft Security Response Center (MSRC)

1187

Yarden Shafir @yardenshafir.bsky.social · 27/08/2023

Sudden eye infection and doctor visit is not how I planned to spend my Sunday morning. But it does mean I can spoil myself with the world’s largest pizza slice and not feel guilty about it.

030

Yarden Shafir @yardenshafir.bsky.social · 25/08/2023

My summer associate Michael Lin wrote a powershell script to help you find out which vulnerable/malicious drivers from loldrivers.io will successfully load on your HVCI-enabled system: github.com/trailofbits/...

github.com

GitHub - trailofbits/HVCI-loldrivers-check

Contribute to trailofbits/HVCI-loldrivers-check development by creating an account on GitHub.

020

Yarden Shafir @yardenshafir.bsky.social · 19/08/2023

Friend and I were walking around when we heard a very loud bug. Started digging in the dirt to try and find it. Within 5 minutes 2 separate groups of men got curious and joined us. Is this how men make friends?

300

Yarden Shafir @yardenshafir.bsky.social · 30/07/2023

As of build 25915 (latest Preview) all known API based kernel address leaks no longer work unless requested by a process with SeDebugPrivilege (only available to admin processes)

Screenshot of program output showing a call to NtQuerySystemInformation with SystemModuleInformation class returning 0 for all ImageBase fields

020

Yarden Shafir @yardenshafir.bsky.social · 22/07/2023

Guess who got to visit an erupting volcano today

120

Yarden Shafir @yardenshafir.bsky.social · 15/06/2023

My new hair got my barista so distracted he forgot how to do latte art. I’m gonna count it as a compliment

140