Deep-dive research on reverse engineering, Windows internals, kernel development and offensive security.
Index
Static and dynamic analysis, unpacking, decompiler archaeology.
1 articleUndocumented structures, syscalls, loader and process mechanics.
1 articleRing 0: drivers, callbacks, PatchGuard, and the objects beneath.
nothing published yetMemory corruption, primitives, mitigations and how they bend.
nothing published yetSample teardowns, C2 protocols, evasion and detection surface.
nothing published yetCTF solutions and research notes worth keeping.
nothing published yetRecent
TBMKE defends two integers with a game process, a watchdog and a self-signed kernel driver. A handle taken before the driver arms, a record with no authenticator and a hash that turns itself off are enough to take both.
PivotGate turns a hidden discontinuity in ntdll's syscall layout into an SSN resolver, then crosses the boundary through the genuine Windows wrapper—without decoding the requested stub, generating executable code or inventing a stack.
Topics