254 Followers
70 Following
82 Posts
System software developer, reverse engineer, trainer.
Websitehttps://github.com/tandasat
Xhttps://twitter.com/standa_t
Discordtandasat
Blueskyhttps://bsky.app/profile/satoshi-tanda.bsky.social

Just wrapped up teaching my hypervisor development class. Always refreshing to work with sharp folks from diverse backgrounds—and rewarding to help them get started.

The next class will be in person at @hexacon_fr Check out the conference page if you're interested.

The registration is open now. See you in Paris!

https://infosec.exchange/@satoshi_tanda/114345572221007129

Satoshi (@[email protected])

Attached: 1 image I am thrilled to be back and offer the in-person training once again at Hexacon, the fabulous conf. in Paris https://hexacon.fr/trainer/tanda/ Get hands-on experience with virtualization and learn real-world applications and bugs of them! The tickets will be available for purchase soon.

Infosec Exchange

I am thrilled to be back and offer the in-person training once again at Hexacon, the fabulous conf. in Paris

https://hexacon.fr/trainer/tanda/

Get hands-on experience with virtualization and learn real-world applications and bugs of them!

The tickets will be available for purchase soon.

Hexacon - Conference – Speakers

Discover the accepted talks for this edition!

Hexacon

My talk about the recent SMM architecture and security at @thesascon https://youtube.com/watch?v=AIGj6QvqACQ

The conference was well organized and had plenty of networking opportunities. Though, the best thing was the venue :) It is at a beautiful resort again this year, so you will love it.

Voyage Below the OS: SMM Isolation on the Intel Platform | Satoshi Tanda

YouTube

This is like "VT-x 101". The essence of HW-assisted VT, everything needed to virtualize Windows on-the-fly, and a bit of security in 2 days.

It misses a ton of fun discussions and exercises that are in my 4 days class, but I am giving back to the community that helped me learn.

https://infosec.exchange/@OpenSecurityTraining2/114359032824440463

OpenSecurityTraining2 (@[email protected])

We wanted to point out specifically the update to the System Security Learning Path that the excellent low level engineer & researcher Satoshi Tanda @[email protected] has agreed to create our long-desired 'Architecture 3001: Intel Virtual Machine Extensions (VMX)' class! The class is still a ways off, but this will fill an important hole in our curriculum, which is increasingly relevant as Microsoft pushes further into virtualization-based security. https://infosec.exchange/@OpenSecurityTraining2/114301939737793181

Infosec Exchange

I am thrilled to be back and offer the in-person training once again at Hexacon, the fabulous conf. in Paris

https://hexacon.fr/trainer/tanda/

Get hands-on experience with virtualization and learn real-world applications and bugs of them!

The tickets will be available for purchase soon.

Hexacon - Conference – Speakers

Discover the accepted talks for this edition!

Hexacon

The new blog post on supervisor shadow stack restrictions / supervisor shadow-stack control

https://tandasat.github.io/blog/2025/04/02/sss.html

What keeps kernel shadow stack effective against kernel exploits?

This post introduces one of the virtualization features needed to keep kernel-mode shadow stack functional against kernel exploits: supervisor shadow stack restrictions / supervisor shadow-stack control.

Satoshi’s notes

and check out BigInt and Template literals if you write Windbg extensions. They make JavaScript programming a little more bearable.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals

BigInt - JavaScript | MDN

BigInt values represent integer values which are too high or too low to be represented by the number primitive.

MDN Web Docs

Added AMD support to hvext, the windbg extension for reversing Hyper-V!
https://github.com/tandasat/hvext

You can check what SVM features are enabled, which MSRs and IO ports are accessible, and how nested page table looks like, for NT, SK and regular VMs.

The new microphone setup for my next remote class!

Not that you pay for my clear voice :D but this will improve the learning experience

Btw, more than 1/3 of the seats were sold, so do not wait too long. Remote classes become full well before early-bird ends