about

who i am

Red team operator and offensive security researcher with a deep obsession for low-level Windows internals. I spend most of my time at the intersection of kernel exploitation, hypervisor research, and reverse engineering tearing apart security mechanisms to understand how they work and where they fail.

My current focus is Windows kernel and hypervisor security: VBS/Hyper-V architecture, VTL isolation boundaries, and the internals of securekernel.exe. When I'm not staring at IDA or WinDbg, I'm probably writing about what I found.

areas of interest

• Windows Kernel Exploitation
• Hypervisor Internals (VBS, Hyper-V, WHP API)
• Secure Kernel & VTL 0 → 1 Boundaries
• Driver Development & Analysis
• Reverse Engineering (IDA Pro, WinDbg)
• EDR Evasion & Bypass Research

projects

• VulnDriver - Vulnerable kernel driver demonstrating UAF via non-atomic reference counting, race condition exploitation, and LPE to SYSTEM.
• Mirage-RS - Rust reimplementation of Akamai's Mirage technique for VBS enclave payload staging across VTL boundaries.
• VFCoop - IDAPython vfGadget enumerator for COOP (Counterfeit Object-Oriented Programming) gadget discovery.
• Volstgalph - x86-64 4-level paging simulator for studying virtual address translation mechanics.
• Solemn - HVCI driver blocklist automation tooling.
• Misery - EDR bypass loader.

contact

• github: @unkvolism
• email: sorahed@proton.me
• twitter: @ExallocatePool2