Evasion

2025.10.13 DSE bypass: why CiValidateImageHeader is the right target
Driver Signature Enforcement is enforced by CiValidateImageHeader in CI.dll, not by g_CiOptions alone. Patching the function directly with a physical write or PTE flip …
windows kernel drivers dse evasion
2025.09.01 [Hypervisor Part 3] Making Your Kernel Hook Invisible with EPT Shadow Pages
EPT shadow page hooks split a physical page into two views: one seen by reads (original bytes), one executed (hooked bytes). Integrity scanners see clean code. The CPU …
windows kernel hypervisor evasion hooking
2025.07.28 [Hypervisor Part 2] Hijacking Hyper-V's VM-Exit Handler from Inside the Guest
How the hypervisor detours Hyper-V’s VM-exit handler, the CPUID-based hypercall ABI including the bitfield bug that burned me, and how we resolve arbitrary process …
windows kernel hypervisor internals evasion
2025.05.12 Kernel UDP socket server via WSK: covert comms with no IOCTL surface
WSK lets a kernel driver bind a UDP socket and communicate with user mode without a device object, symbolic link, or IOCTL dispatch table. EnumDeviceObjects and …
windows kernel drivers evasion internals
2025.02.24 Self-deleting executables: NTFS alternate data streams and POSIX semantics
How a running process can erase its own executable from disk using NTFS ADS renaming and FILE_DISPOSITION_FLAG_POSIX_SEMANTICS, and what forensic traces survive.
windows internals evasion malware
2025.01.20 Anti-debug techniques and the telemetry each one generates
Ten anti-debug checks paired with the exact ETW providers, Sysmon event IDs, and forensic artifacts each one leaves behind – a reference for both sides of the …
windows internals malware evasion
2024.08.19 Thread start address inspection: how EDR kernel drivers catch shellcode
PsSetCreateThreadNotifyRoutine fires for every new thread. This post shows how an EDR kernel driver turns that callback into a start-address inspection pipeline, what the …
windows kernel drivers internals evasion
2024.03.25 Threadless injection: process execution without creating a thread
Every classic injection technique creates a thread. Threadless injection installs a 5-byte CALL trampoline on an existing function and hijacks the next thread that calls …
windows internals injection evasion malware
2024.01.08 MapViewOfFile2: process injection without WriteProcessMemory
MapViewOfFile2 maps a section object directly into a foreign process without ever calling WriteProcessMemory, removing the cross-process write primitive that most EDR …
windows internals injection evasion malware
2023.10.16 Function stomping: injecting into DLL text instead of heap memory
Classic shellcode injection allocates a private RWX page that every VAD-walking scanner flags. Function stomping overwrites an existing DLL export and executes from …
windows internals injection evasion malware
2023.07.31 Process Injection Without the Obvious Thread: Early Bird APC and Beyond
Why CreateRemoteThread+LoadLibraryA is immediately detectable, how Early Bird APC avoids the worst of the telemetry, and the injection techniques that push further into …
windows malware injection evasion internals
2021.11.22 Code caves in signed kernel drivers
Unsigned executable memory in the kernel is an immediate red flag. Shellcode placed in the padding bytes of a legitimate signed Microsoft driver executes inside that …
windows kernel drivers evasion internals
2020.09.14 NtLoadDriver vs SCM: what each leaves behind
Creating a service through SCM and calling NtLoadDriver directly leave different artifacts. Knowing exactly what each approach leaves – event log entries, registry …
windows kernel drivers internals evasion