About

Emil. Security researcher. Windows kernel is the main area.

The day job is threat research and detection engineering, the occasional CVE. Employer stays off personal platforms.

I got into security through game hacking, and I started early. Not because the games mattered — the technical angle was the whole point. Anticheat turned out to be some of the most interesting kernel-mode code around to argue with. Spend long enough on that, and you start understanding how to build it.

Topics that end up here: kernel internals, driver analysis and reversing, hypervisors (VT-x, EPT, Hyper-V), process injection, hooking primitives, EDR and anticheat mechanisms, the occasional malware analysis. Projects pile up faster than they get finished. The ones worth writing about make it here.

Contact

• GitHub: github.com/floppywiggler

DKOM — Direct Kernel Object Manipulation. Manipulating kernel data structures directly to make things disappear from anything that reads them. Felt like an appropriate name for a blog about what the kernel exposes, and what it doesn’t.