Mahmoud·2d agoWindows Internals for Malware Analysis: From Architecture to API Calls to PE FilesBefore We Dive In… ☕
Piyusha Akash·3d agoHunting Call-Preceded Gadgets for Call Stack Spoofing Research on WindowsA step-by-step walkthrough from zero to a verified, clean trampoline gadget
Aadilvarshani·4d agoRace Windows: Why My Process Events Had No NameThe IRQL post ended on race windows, the gap between something happening on a machine and a sensor getting round to looking at it, and I…
Yiğit Aydemir·Oct 30Teach the Stack to Lie: .pdata Unwinding and Call Stack Spoofing on x64 — Yiğit AydemirThe last article in this series ended on an honest admission. I had bypassed an EDR-style inline hook with an indirect syscall, and the…
Yiğit Aydemir·Oct 28Be the EDR, Then Bypass It: Halo’s Gate and Indirect Syscalls — Yiğit AydemirIn my previous article, I ended with a loader that maps a DLL into memory without calling LoadLibrary or GetProcAddress. But it still had a…
