Uninformed

Uninformed was a technical research journal hosted at uninformed.org that published in-depth papers on "security technologies, reverse engineering, and low-level programming," per its own mission statement. Unlike general-audience security zines, its articles were dense, code-heavy treatments of exploitation primitives and operating-system internals, mostly focused on Windows.

Origins

The uninformed.org domain had an earlier life before the journal existed: Wayback Machine captures show it briefly hosting an EFF placeholder page (2002), then material associated with the "nologin.org" research community (2003), and by early 2005 it was the personal research page of Richard Johnson, listing papers such as "Buffer Overflow Prevention" and linking to nologin.org and the Metasploit Project. The multi-author journal format first appears in an archived snapshot from May 2005, presenting itself as "Volume 1."

Editors and contributors

An archived 2006 About page names the journal's editors as "skape," "rjohnson," and "trew." skape is Matt Miller, a well-known Windows exploitation researcher; rjohnson is Richard Johnson, the prior owner of the domain. The community centered on an IRC channel on the Compsec/SILC network tied to nologin.org. Frequent contributing authors included Skywing (Ken Johnson), bugcheck, Peter Silberman, H D Moore, and Johnny Cache, among others.

Scope and structure

Articles were grouped under recurring section headings including Engineering in Reverse, Exploitation Technology, Fuzzing, Rootkit Technology, Static Analysis, Machine Speak, and Wireless Technology. The journal described itself as publishing "roughly three times a year."

Notable papers

Uninformed is best remembered for a sustained series on Windows PatchGuard (Kernel Patch Protection), including "Bypassing PatchGuard on Windows x64" (skape and Skywing), "Subverting PatchGuard Version 2," and "PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3" (Skywing), which Wikipedia's Kernel Patch Protection article cites as primary documentation of how successive PatchGuard bypasses were found. Other notable articles include "Bypassing Windows Hardware-enforced Data Execution Prevention" (skape and Skywing), "Preventing the Exploitation of SEH Overwrites" (skape), "Windows Kernel-mode Payload Fundamentals" (bugcheck and skape), the FUTo rootkit paper (Peter Silberman and C.H.A.O.S.), "Reducing the Effective Entropy of GS Cookies" (skape), and a wireless driver exploitation paper co-authored by Johnny Cache, H D Moore, and skape.

End of publication and legacy

The final Volume 10, dated October 2008, included papers such as "Using dual-mappings to evade automated unpackers" (skape), "Analyzing local privilege escalations in win32k" (mxatone), and "Exploiting Tomorrow's Internet Today: Penetration testing with IPv6" (H D Moore). No new volume followed. As of recent checks, uninformed.org remains reachable over plain HTTP and still serves its final, unchanged Volume 10 index, effectively frozen since 2008 rather than formally taken down.

Timeline

• 2003Domain uninformed.org is associated with material from the nologin.org research community (per Wayback Machine captures), prior to becoming the journal.
• 2005-03uninformed.org is Richard Johnson's personal research page, listing papers and linking to nologin.org and the Metasploit Project.
• 2005-05First archived snapshot of the multi-author journal appears, presented as "Volume 1" with 7 articles.
• 2006-09Volume 5 published, including skape's "Preventing the Exploitation of SEH Overwrites."
• 2007-05Volume 7 published, including skape's "Reducing the Effective Entropy of GS Cookies."
• 2007-09Skywing's "PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3" is published (per citation in Wikipedia's Kernel Patch Protection article).
• 2008-10Final Volume 10 published (47 articles across 10 volumes total); no further volumes appear afterward.