Deep-dive research on reverse engineering, Windows internals, kernel development and offensive security.
Index
Static and dynamic analysis, unpacking, decompiler archaeology.
1 articleUndocumented structures, syscalls, loader and process mechanics.
nothing published yetRing 0: drivers, callbacks, PatchGuard, and the objects beneath.
nothing published yetMemory corruption, primitives, mitigations and how they bend.
nothing published yetSample teardowns, C2 protocols, evasion and detection surface.
nothing published yetCTF solutions and research notes worth keeping.
nothing published yetRecent
TBMKE defends two integers with a game process, a watchdog and a signed kernel driver. A handle taken before the driver arms, a record with no authenticator and a hash that turns itself off are enough to take both.
Topics