Software security engineer and trainer https://xitter.cf/t.co/tenaquooTc
Vancouver, Canada
Joined February 2013
- Tweets1.3K
- Following396
- Followers8.1K
- Likes1.3K
Pinned Tweet
Excited to announce that registration for my remote hypervisor class in October is open! tandasat.github.io
The class teaches you how hypervisors can be used for security and research, including hardening, fuzzing and reversing, as well as common designs and vulnerabilities
Early-bird pricing for my fully remote hypervisor course ends in 2 weeks. Register before then if interested: systemprogramminglab.regfox.…
Excited to announce that registration for my remote hypervisor class in October is open! tandasat.github.io
The class teaches you how hypervisors can be used for security and research, including hardening, fuzzing and reversing, as well as common designs and vulnerabilities
I like understanding how low-level technologies work and how they are used for platform security. I also enjoy building, breaking, and teaching these kinds of things. Check out my training class on them if you are interested: tandasat.github.io
Satoshi Tanda found bugs in Microsoft's own Hyper-V hypervisor and HVCI implementation as a by-product of learning how they work. Let that sink in.
His blog covers Intel VT-rp (the hardware defense Intel built to counter EPT-based hooking), kernel shadow stacks, SMM isolation, Hyper-V enforced security policies, and how he hunted down a HVCI bug in UEFI.
His open-source projects include a hypervisor for stealth EPT-based kernel API monitoring (DdiMon), a UEFI hypervisor that boots a full operating system, minimal hypervisors for both Intel and AMD, and a full training course on building hypervisors from scratch for security researchers.
DdiMon and HyperPlatform have been forked and adapted by game cheaters for years as the foundation for EPT-based hooking in the wild. The same code that was built for research became the backbone of an entire cheating ecosystem.
If you are learning hypervisor development, Windows internals, or platform security, his work is where you start.
Blog: tandasat.github.io/blog/
GitHub: github.com/tandasat
Training: tandasat.github.io
Author: @standa_t
#WindowsInternals #ReverseEngineering #InfoSec
AMD APM has been updated for the first time in over a year.
docs.amd.com/v/u/en-US/24593…
Looks like a cool project.
Do not be confused with NOVA Microhypervisor, which is another fabulous project:
github.com/udosteinberg/NOVA
I'm happy to finally release NovaHypervisor! NovaHypervisor is a defensive hypervisor with the goal of protecting AV/EDR vendors and crucial kernel structures that are currently uncovered by VBS and PatchGuard.
Full explanation below 1/6.
github.com/Idov31/NovaHyperv…
Satoshi Tanda retweeted
The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today.
English writeup: coderush.me/hydroph0bia-part…
Excellent write-up on stealth hooking with hypervisors on the Intel processors. It discusses two different approaches in detail with actual implementations you can play with.
Hypervisors for Memory Introspection and Reverse Engineering by @memn0ps
secret.club/2025/06/02/hyper…
Satoshi Tanda retweeted
Our talk at #BHUSA @BlackHatEvents Briefings has been accepted!
This is a presentation on an initiative to make the BIOS usable even after the OS has booted, enabling malbehavior to occur solely within the BIOS, independent of the OS.
blackhat.com/us-25/briefings…
The best talk I have been in a while
The recording of our OffensiveCon presentation about EntrySign is live! youtu.be/sUFDKTaCQEk
Slides at entrysign.top
@sirdarckcat @__spq__
Just wrapped up teaching my hypervisor development class. Always refreshing to work with sharp folks from diverse backgrounds—and rewarding to help them get started.
The next class will be in person at @hexacon_fr. Check out the conference page if you're interested.
ALT laptop and training class materials
It is amazing to see someone taking a class and then making stellar output by extending what they learned in the class.
Obviously, @_jaelkoh dedication was the key, but also, @saidelike must have done a fabulous job helping his students learn and get started. Very cool.
The video for my talk at @offensive_con with @saidelike is out! It was an absolute pleasure working with Cedric on this dream of mine!
youtu.be/goEb7eKj660
The registration is open now. See you in Paris!
I am thrilled to be back and offer the in-person training once again at Hexacon, the fabulous conf. in Paris
hexacon.fr/trainer/tanda/
Get hands-on experience with virtualization and learn real-world applications and bugs of them!
The tickets will be available for purchase soon.
My talk about the recent SMM architecture and security at @TheSAScon : youtube.com/watch?v=AIGj6Qvq…
The conference was well organized and had plenty of networking opportunities. Though, the best thing was the venue :) It is at a beautiful resort again this year, so you will love it.
This is like "VT-x 101". The essence of HW-assisted VT, everything needed to virtualize Windows on-the-fly, and a bit of security in 2 days.
It misses a ton of fun discussions and exercises that are in my 4 days class, but I am giving back to the community that helped me learn.
We wanted to point out specifically the update to the System Security Learning Path that the excellent low level engineer & researcher Satoshi Tanda @standa_t has agreed to create our long-desired 'Architecture 3001: Intel Virtual Machine Extensions (VMX)' class!
I am thrilled to be back and offer the in-person training once again at Hexacon, the fabulous conf. in Paris
hexacon.fr/trainer/tanda/
Get hands-on experience with virtualization and learn real-world applications and bugs of them!
The tickets will be available for purchase soon.
The Documentation Change file got updated. Thank you @IntelSupport for fixing it quickly!
Intel SDM rev 87 was out. Updates? Good luck with diffing 5000+ pages of PDF files. @intel forgot to update the Documentation Changes file.
The new blog post on supervisor shadow stack restrictions / supervisor shadow-stack control
tandasat.github.io/blog/2025…
Intel SDM rev 87 was out. Updates? Good luck with diffing 5000+ pages of PDF files. @intel forgot to update the Documentation Changes file.
Nice to see Intel and MSFT's posts on VT-rp / HVPT.
If you are interested in playing with the feature, simple example code is here: github.com/tandasat/Hello-VT…
Excellent post on Samsung's hypervisor!
I did not know they too were transitioning to Rust. Good move.
I've published a write-up on reversing and analyzing Samsung's H-Arx hypervisor architecture for Exynos devices, which has had a lot of changes in recent years and pretty interesting design. Hope you all enjoy :)
dayzerosec.com/blog/2025/03/…
