Yiğit Aydemir·Oct 30Teach the Stack to Lie: .pdata Unwinding and Call Stack Spoofing on x64 — Yiğit AydemirThe last article in this series ended on an honest admission. I had bypassed an EDR-style inline hook with an indirect syscall, and the…
Yiğit Aydemir·Oct 28Be the EDR, Then Bypass It: Halo’s Gate and Indirect Syscalls — Yiğit AydemirIn my previous article, I ended with a loader that maps a DLL into memory without calling LoadLibrary or GetProcAddress. But it still had a…
Yiğit Aydemir·Oct 23From Syscall to Reflective Loader: Windows Module Loading, Rebuilt from First PrinciplesEvery Windows process carries a list of the modules loaded into it — main.exe, ntdll.dll, kernel32.dll — chained together in a structure…
Higor Diego·Oct 22From PowerPC file to flag: taking apart chimera, the binary that wraps another binary (Malware…How to tackle an exotic, nested target: recon on an architecture you can’t run, extraction of an embedded second layer, and offline…
Mr_MalMan·Sep 29HOUSE OF MALWARES | S1 | E1 From Transistors to Logic Gates, How a CPU’s Brain Is Actually BuiltIn the high-level realm, developers play with abstractions. But when your payload enters the battlefield, only the brutal physics of…
Muhammad Sameer·Sep 29Understanding Windows Offensive Development: From WinAPI to EDR EvasionWindows is one of the most interesting platforms to study from an offensive security perspective.
Agha Asfandyar Khan·Sep 28How attackers hide their malicious library files (.dll)In the era of too much secure systems and evolving Artificial Intelligence it’s difficult to build a Malware for Windows which will never…
Jay Tiwari·Sep 26DDE Callback Hijacking -A Process Injection TechniqueI’m Jay, a student exploring the offensive security space with a focus on red teaming and malware development. I spend my time studying…
Ialle Teixeira·Sep 25The new Windows composable sandbox: CreateProcessInSandbox, FlatBuffers and the death of classic…Context: why Microsoft is building a sandbox into the operating system itself
