Yiğit Aydemir·Oct 30Teach the Stack to Lie: .pdata Unwinding and Call Stack Spoofing on x64 — Yiğit AydemirThe last article in this series ended on an honest admission. I had bypassed an EDR-style inline hook with an indirect syscall, and the…
Yiğit Aydemir·Oct 28Be the EDR, Then Bypass It: Halo’s Gate and Indirect Syscalls — Yiğit AydemirIn my previous article, I ended with a loader that maps a DLL into memory without calling LoadLibrary or GetProcAddress. But it still had a…
Yiğit Aydemir·Oct 23From Syscall to Reflective Loader: Windows Module Loading, Rebuilt from First PrinciplesEvery Windows process carries a list of the modules loaded into it — main.exe, ntdll.dll, kernel32.dll — chained together in a structure…
rahul.0xkr·Oct 18Windows Process Injection: From Classic DLL Injection to Abusing SetWinEventHookMost people learn process injection by reading a single technique, copying the code, and moving on. That’s how you get code that works…
Reyadjr0x1·Sep 26Windows Memory Forensics Series — Part 03: Process Creation InternalsParts 01 and 02 covered how to find processes and validate what’s loaded inside them. This part goes one level deeper: how a process…
Whitedavid23·Sep 23Advanced Offensive Tools Development & Red Team Engineering: Understanding the Engineering Behind…Offensive security is often associated with frameworks, scanners and established tools.
rahul.0xkr·Sep 20Swimming in the Modern Windows Kernel Pool: From ExAllocatePool2() to UAFs, grooming, and the…When I first started learning Windows kernel exploitation, I had a fairly simple mental model of the kernel pool.
Anushit Satapathy·Sep 16Windows Process Enumeration Using Dynamic API ResolutionI recently built a small C project to better understand Windows internals and how Windows APIs can be resolved dynamically at runtime.
