Pinned Tweet
After more than a year in the making it is finally out and available here: xintra.org/courses/11-win… :)
I will always do open source and publish papers but I've been working for a long time to create a course for people that want structured and in-depth content 1/
I will always do open source and publish papers but I've been working for a long time to create a course for people that want structured and in-depth content 1/
NEW XINTRA COURSE!!!🥳
Windows Kernel: Offensive, Defensive & Reverse Engineering by @Idov31
xintra.org/courses/11-win…
Build an EDR and rootkits from scratch while mastering the Windows kernel.
Over 70 videos and labs covering:
> Build your own EDR (detection + prevention)
> Rootkits &> Reversing Windows kernel & drivers
> Kernel callbacks, ETW, minifilter and more
There are preview videos too if you wanna see some snippets of the course content ;)
This course is instructed by Ido Veltzman (@Idov31), a senior security researcher specializing in reverse engineering, operating system internals, vulnerability research, and exploit development.
His work spans UEFI, hypervisors, kernel, and user mode, where he has developed advanced evasion, persistence, and injection techniques.
@XintraOrg
7
20
112
14,858
Ido Veltzman retweeted
Your OS hasn't loaded, but the attack has already begun. 💀
At #NullconBerlin2026, Ido Veltzman reveals how a Linux UEFI bootkit can deploy a rootkit, complete with a live demo!
🎥 Hear from @Idov31 himself on what went into the research!
Register now: nullcon.net/talk/taking-co…
At #NullconBerlin2026, Ido Veltzman reveals how a Linux UEFI bootkit can deploy a rootkit, complete with a live demo!
🎥 Hear from @Idov31 himself on what went into the research!
Register now: nullcon.net/talk/taking-co…
0
1
2
200
I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paint-it… 1/3
1
24
119
9,266
To answer that, I traced the path from win32u.dll and KiSystemCall64 through GUI-thread conversion to PsInvokeWin32Callout. The same numbered callback path handles GDI batch flushes, object events, power notifications, and more interesting operations. 2/3
1
0
5
681
The post aims to shed more light on the under documented win32k subsystem with explanation about the callback IDs, session-routing modes, and the relationship between win32k and the kernel. I hope it will help people in their journey when investigating win32k :) 3/3
0
0
5
603
I'm thrilled to make Silverseal public!. It is among the first publicly available UEFI bootkit research frameworks for Linux-based systems to demonstrate an end-to-end path from GRUB to a running Rust kernel-module rootkit: github.com/Idov31/Silvers… 1/3
8
55
183
10,604
Kernel patching during boot is one common scope for public bootkit demonstrations. Silverseal examines a better chain: using the modified boot sequence to load and run a complete kernel-module rootkit. 2/3
1
0
5
649
The repository includes the bootkit, loader, rootkit, Ubuntu and WSL setup scripts, build documentation, and a YARA rule. Feel free to contact me and ask me any question :) 3/3
0
0
5
394
I'd like to say a huge thank you to @SEC_T_org for an amazing conference and for having me!
Amazing people, a great atmosphere, and definitely one of the best conferences in Europe. I highly recommend checking it out!
Amazing people, a great atmosphere, and definitely one of the best conferences in Europe. I highly recommend checking it out!
0
0
3
588
I'm very excited to speak at @nullcon Berlin this year about the Linux boot chain, show my Linux UEFI bootkit, and explain how you can build your own: nullcon.net/talk/taking-co…
Would love to see you there!
Would love to see you there!
0
6
23
2,693
ETW is one of the richest telemetry sources on Windows, and one of the easiest to get lost in. This is why I made a video that follows that path - from ETW internals to a practical workflow with EtwSuite. 1/2
idov31.github.io/posts/inside-e…
idov31.github.io/posts/inside-e…
3
31
150
7,521
The video covers under-documented parts of ETW: subsystem initialization, provider registration, event consumption, and the practical workflow for finding providers worth investigating and collecting useful telemetry. I'd appreciate feedback as I try this new format. 2/2
0
0
3
612
What platform are you using for comfortable and free video management and uploading? Since YouTube's verification doesnt really work it isnt really an option :/
0
0
3
1,218
Ido Veltzman retweeted
I don’t usually post on here, but as a Venezuelan I feel compelled to share this.
Venezuela has recently been severely affected by the earthquake, and many of the impacted areas are currently facing a critical shortage of supplies and personnel. Families are struggling, and on-the-ground resources are extremely limited at this time.
I also want to specifically call on the infosec community. If you are in cybersecurity, tech, or adjacent spaces, any visibility, amplification, or support can genuinely help expand the reach of relief efforts.
Any support, no matter how small, can make a real difference for those affected.
If you are able to contribute, repost or share, it would be greatly appreciated:
gofundme.com/f/emergency-re…
Venezuela has recently been severely affected by the earthquake, and many of the impacted areas are currently facing a critical shortage of supplies and personnel. Families are struggling, and on-the-ground resources are extremely limited at this time.
I also want to specifically call on the infosec community. If you are in cybersecurity, tech, or adjacent spaces, any visibility, amplification, or support can genuinely help expand the reach of relief efforts.
Any support, no matter how small, can make a real difference for those affected.
If you are able to contribute, repost or share, it would be greatly appreciated:
gofundme.com/f/emergency-re…
0
8
5
1,595
I released EtwSuite: A Windows native ETW inspection suite for listing providers, reading metadata, parsing manifests, creating sessions, consuming events, and opening ETL files from one place for x64 and ARM64. github.com/idov31/EtwSuite
2
32
143
6,470
The project is heavily inspired by @zodiacon 's excellent EtwExplorer. The goal is to build a broader ETW workbench for provider discovery, live collection, ETL inspection, filtering, SQL-style analysis, export, and the workflows around them.
0
1
9
1,459
and snippets from the kernel itself. Another thing that was important to me is that on top of theoretical and practical knowledge you will receive practical tools that you can use for your research or daily work - which is why by the end of the course you will have 3/
1
0
9
818
your very own EPP (prevention & EDR) and rootkit with a bunch of cool features ready to use. I'd like to also thank for @XintraOrg and specifically Lina and Ty for everything and to the many people that heard my ideas along the way. My DMs are open for any question :)
0
0
7
527