Mahmoud·2d agoWindows Internals for Malware Analysis: From Architecture to API Calls to PE FilesBefore We Dive In… ☕
Piyusha Akash·3d agoHunting Call-Preceded Gadgets for Call Stack Spoofing Research on WindowsA step-by-step walkthrough from zero to a verified, clean trampoline gadget
Aadilvarshani·4d agoRace Windows: Why My Process Events Had No NameThe IRQL post ended on race windows, the gap between something happening on a machine and a sensor getting round to looking at it, and I…
Yiğit Aydemir·Oct 30Teach the Stack to Lie: .pdata Unwinding and Call Stack Spoofing on x64 — Yiğit AydemirThe last article in this series ended on an honest admission. I had bypassed an EDR-style inline hook with an indirect syscall, and the…
Yiğit Aydemir·Oct 28Be the EDR, Then Bypass It: Halo’s Gate and Indirect Syscalls — Yiğit AydemirIn my previous article, I ended with a loader that maps a DLL into memory without calling LoadLibrary or GetProcAddress. But it still had a…
Yiğit Aydemir·Oct 23From Syscall to Reflective Loader: Windows Module Loading, Rebuilt from First PrinciplesEvery Windows process carries a list of the modules loaded into it — main.exe, ntdll.dll, kernel32.dll — chained together in a structure…
rahul.0xkr·Oct 18Windows Process Injection: From Classic DLL Injection to Abusing SetWinEventHookMost people learn process injection by reading a single technique, copying the code, and moving on. That’s how you get code that works…
Reyadjr0x1·Sep 26Windows Memory Forensics Series — Part 03: Process Creation InternalsParts 01 and 02 covered how to find processes and validate what’s loaded inside them. This part goes one level deeper: how a process…
