Up until recently, I’d never tried the bug hunting part of vulnerability research. I’ve been reverse engineering Windows malware for over a decade, and I’d done the occasional patch analysis, but I never saw a point in bug hunting on a major OS. After all, there are teams of vulnerability researchers with decades of experience auditing every inch of code, so what’s the chance someone new like me finds anything at all? The odds seemed impossible, so I never bothered trying. It wasn’t until I started reversing the BlueKeep patch that my views on bug hunting started to change.

Up until recently, I’d never tried the bug hunting part of vulnerability research. I’ve been reverse engineering Windows malware for over a decade, and I’d done the occasional patch analysis, but I never saw a point in bug hunting on a major OS. After all, there are teams of vulnerability researchers with decades of experience auditing every inch of code, so what’s the chance someone new like me finds anything at all? The odds seemed impossible, so I never bothered trying. It wasn’t until I started reversing the BlueKeep patch that my views on bug hunting started to change.