Yiğit Aydemir·6d agoTeach the Stack to Lie: .pdata Unwinding and Call Stack Spoofing on x64 — Yiğit AydemirThe last article in this series ended on an honest admission. I had bypassed an EDR-style inline hook with an indirect syscall, and the…
Yiğit Aydemir·Oct 28Be the EDR, Then Bypass It: Halo’s Gate and Indirect Syscalls — Yiğit AydemirIn my previous article, I ended with a loader that maps a DLL into memory without calling LoadLibrary or GetProcAddress. But it still had a…
Yiğit Aydemir·Oct 23From Syscall to Reflective Loader: Windows Module Loading, Rebuilt from First PrinciplesEvery Windows process carries a list of the modules loaded into it — main.exe, ntdll.dll, kernel32.dll — chained together in a structure…
rahul.0xkr·Oct 18Windows Process Injection: From Classic DLL Injection to Abusing SetWinEventHookMost people learn process injection by reading a single technique, copying the code, and moving on. That’s how you get code that works…
