Snapshot fuzzing direct composition with WTF
Summary: Cisco Talos researchers built a custom snapshot fuzzer for Windows Direct Composition by extending Axel Souchet's WTF fuzzer, injecting an interpreter DLL into dwm.exe and patching the Bochscpu backend to continue emulation across CR3 context switches instead of restoring the snapshot. The work builds on prior Direct Composition research from Qihoo 360's Vulcan Team and a 2023 HITB talk by Hillstone Networks researchers who used a modified syzkaller and found vulnerabilities in DWM.
Bottom line: Direct Composition exposes kernel objects that can be created and manipulated directly through system calls, and the serialized data is processed in userland by dwm.exe - a target the researchers note syzkaller's earlier approach did not collect coverage on.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026