kvc.pl :: principal software engineer·MASM x64 & armasm64·C++23/C11 freestanding·reverse engineering·applied mathematics

Marek Wesołowski (WESMAR)

Principal Software Engineer — MASM x64 & armasm64 · C++23 · Systems & Application Development · Reverse Engineering & Binary Analysis · Ring-0 Kernel Drivers · NT Internals · DSE & SecureBoot Bypass · PP/PPL Manipulation · Forensic Tooling · Applied Mathematics & Optimisation · Windows · Linux · OSX · Android

ASMCC++ NT KernelEFI/UEFIPPLDSEBYOVDHVCI IRP FilteringSyscallsTrampoline HooksBoot Integrity REForensicsSteganographyCryptography UndervoltingPlundervoltFirmware Math Optimization LinuxAndroid + KernelPatch

I build systems and application software in modern C++ (C++23), C, and Assembly — from reverse engineering and binary analysis, through kernel-mode development, down to the firmware layer beneath the operating system. The same craft covers applied mathematics and algorithm optimisation, among them a chess engine.

The work follows a problem across the whole privilege stack rather than staying at one layer. At the firmware level, before the operating system loads: UEFI undervolting driven through model-specific registers, BIOS setting and NVRAM variable manipulation, a read/write NTFS driver, and a UEFI application that patches the SYSTEM hive in RAM at ExitBootServices. In the kernel (Ring 0): DSE and HVCI control, KASLR-aware offset resolution, and signed-driver I/O routed beneath the Filter Manager. In user space (Ring 3): TrustedInstaller token chains, Windows Defender control over WMI, and hardware management down to Lenovo battery charge thresholds through the platform driver. Much of it is hand-written assembly — x86, x64 and AArch64 — where a compiler’s output is not good enough and the instructions have to be placed by hand.

Core Capabilities

Selected Engineering Work

ImpersonateSystem PROC            ; CmdT · native ARM64 (A64)
    MOV  w0, #3                   ; SeDebugPrivilege
    BL   EnablePrivilege
    BL   GetProcessIdByName       ; winlogon.exe
    MOV  w1, #TOKEN_DUP_QUERY
    BL   OpenProcessToken
    MOV  w4, #TOKEN_TYPE_IMPERSONATION
    MOV  w1, #MAXIMUM_ALLOWED
    BL   DuplicateTokenEx
    MOV  x0, x21
    BL   ImpersonateLoggedOnUser
ImpersonateSystem ENDP

Low-level engineering, Windows internals, and kernel-mode development sit at the centre of the work, and it extends into the firmware layer: a complete read/write NTFS driver and a dual-panel file manager that run inside the UEFI environment, where there is no operating system to fall back on and every on-disk structure has to be handled correctly by hand.

I am the author of a range of system-level tools published as open source, among them KVC (Kernel Vulnerability Capabilities), KernelResearchKit, KvcKiller, CmdT, and the NTFS driver for UEFI. The work spans NT internals, process protection models including PPL, driver loading mechanics, DSE behaviour, token manipulation, BYOVD kernel-mode process termination, and IFEO offline hive editing. KernelResearchKit resolves kernel offsets against a KASLR-randomised ntoskrnl base and stays resilient across Windows updates and changing PDB versions, patching the SYSTEM hive directly on the raw disk to control HVCI and DSE state across a reboot.

The research side is mitigation assessment through controlled proof-of-concept: driver signature enforcement logic, protected-process semantics, and early-boot trust-chain behaviour, measured rather than assumed, in both Windows and UEFI.

The same approach carries across Windows, Linux/Unix, macOS and Android: correct on-disk and in-memory structures, measured performance, and reproducible results.

Work runs from vulnerability discovery to a functional, validated proof-of-concept, under formally authorised research mandates.