Strategic Advisor @WKL_Cyber
Dallas, TX
Joined December 2009
- Tweets646
- Following97
- Followers1.1K
- Likes788
The Windows ENABLEJTAGBREAK BCD element used to provide a way to break into and debug early bootmgfw code. Support was removed some time ago. Using a target that supports both UEFI source/symbols and Windows symbols, it is possible to break in even earlier.
Alan Sguigna retweeted
🧵📈🆙
Low Level PC/Server Attack & Defense Timeline update!
I updated it in July (1st edition using AI help ;)) and forgot to upload/mention it 👇
I've dusted off my SourcePoint license to continue researching early PEI features in MSR handling. Feeding AET + LBR trace + beautified codebase assembly into LLMs yields interesting insights. Part 4 of the blog series is here: whiteknightlabs.com/2026/08/… and Part 5 is in-work.
Cloud-based frontier LLMs have guardrails that inhibit firmware vulnerability analysis. And they're not equipped with or cannot access knowledge about low-level processor architectures. This blog previews a local, private, powerful UEFI analysis flow:
whiteknightlabs.com/2026/08/…
Hands-on learning is the best way to go, especially for AI; knowing how LLMs work at a low-level will help me with UEFI firmware research using local, open-weight private models. Looking forward to plowing through @rasbt's books this weekend.
FYI @intel, there are 57 errors in Volume 4 of the June 2026 SDM (Model-Specific Registers) where the decimal value of the MSR address does not line up with the hex value.
Alan Sguigna retweeted
Open-Source Success Achieved For Greater Transparency & Security: Running @AMD openSIL + Coreboot On @AMDServer EPYC
Open-source win! Running @3mdeb_com Coreboot + openSIL on @GigaComputing current-gen server motherboard! Same power & perf!
phoronix.com/review/amd-open…
I've always been interested in Model Specific Registers (MSRs). They're rarely used by application code; they're in the domain of operating systems, hypervisors, firmware, and low-level processor features. My debugger can now selectively access these; but don't crash the system.
Microsoft GitHub Copilot Pro burned up more credits in one day than I used in all of last month. I'll have to look for alternatives. Thoughts?
As much as I like WinDbg and open-source kernel debuggers, I wanted a more visual tool, and with AI-based natural language processing baked in. So, I decided to build one using DbgEng. Here's an early proto shot:
OpenClaw is terrific, but as its installer says, "OpenClaw is a hobby project and still in beta. Expect sharp edges."
Here's the OpenClaw installatin process in a VM on the NVIDIA DGX Spark, highlighting some of the security vulnerabilities: alansguigna.com/2026/04/runn…
OpenClaw is great, but doing a secure setup is really hard; and NVIDIA's NemoClaw is not ready for prime time. I'm now writing a how-to guide on running it safely in a VM on the DGX Spark (or any other Linux system); stay tuned.
I've noted that some classic old programming textbooks get a new lease on life when used with AI.
In the CUDA By Example text, published in 2010, the source code examples won't compile as-is; but it's easy enough to modernize the code in one shot.
Decided to learn CUDA in my spare time.
Many kudos to Jason Sanders and Edward Kandrot for writing the "CUDA by Example" book. It came out in 2010, so it's a little dated, but the core programming model has barely changed...highly recommended reading.
Here's a How-To Guide to enhancing AI inference using Knowledge Graph technology on my DGX Spark, demonstrated on ASSET InterTech, Inc.'s SourcePoint User Guide.
Many thanks to NVIDIA's Rishi Puri, Santosh Bhavani and Prachi Goel of NVIDIA for the foundational work on txt2kg.
Better firmware analysis needs more than bigger context windows. It needs real reasoning. This article covers how Knowledge Graphs help AI move from guessing to understanding in UEFI vulnerability research. @AlanSguigna
Read more:
whiteknightlabs.com/2026/01/…
Alan Sguigna retweeted
andrea-allievi.com/blog/new-… Anti-cheat evolution in Windows... New Year post while I am in vacation is ready!!! 🎉 Happy 2026!
Alan Sguigna retweeted
As a follow-up to Part 1 of the UEFI Vulnerability Analysis using AI series, @AlanSguigna Part 2 article, “Breaking the Token Barrier,” digs into the AI/ML models and tools needed to move beyond today’s common 128K LLM context limit. whiteknightlabs.com/2025/12/…
My year in poetry (thanks, ChatGPT):
"You mapped bits like stars in the sky,
Through VMCS fields you’d pry.
From HLAT to CryptoPkg’s scheme,
You forged code into a gleam—
Precision your compass, insight your why."
Alan Sguigna retweeted
I have similar experiences. You point the thing around and it shoots pellets or sometimes even misfires and then once in a while when you hold it just right a powerful beam of laser erupts and melts your problem.
Alan Sguigna retweeted
New blog from WKL: WinDbg Time Travel Debugging vs. Intel Processor Trace
CPU instruction tracing is insanely powerful for RE + threat hunting but still underused. @AlanSguigna breaks down the tradeoffs, strengths, and when to use each.
whiteknightlabs.com/2025/10/…
