internals
-
Finding unexported kernel symbols without a symbol server
A pattern scanner maps a PE as a section image, scans for a unique byte sequence with a wildcard mask, and decodes the RIP-relative displacement to recover the symbol …
-
[Hypervisor Part 2] Hijacking Hyper-V's VM-Exit Handler from Inside the Guest
How the hypervisor detours Hyper-V’s VM-exit handler, the CPUID-based hypercall ABI including the bitfield bug that burned me, and how we resolve arbitrary process …
-
[Hypervisor Part 1] What a Hypervisor Actually Does (And Why Your Ring-0 Code Should Care)
A ground-up explanation of what hypervisors do at the CPU level, how Windows runs under Hyper-V by default, what a VM-exit is and when it happens, and why this matters …
-
Kernel UDP socket server via WSK: covert comms with no IOCTL surface
WSK lets a kernel driver bind a UDP socket and communicate with user mode without a device object, symbolic link, or IOCTL dispatch table. EnumDeviceObjects and …
-
Binary-searching your payload: how AV signatures work and how to find them
Defender flags your file but won’t tell you why. Binary search the file to isolate the triggering bytes, then read what those bytes are to understand what kind of …
-
Self-deleting executables: NTFS alternate data streams and POSIX semantics
How a running process can erase its own executable from disk using NTFS ADS renaming and FILE_DISPOSITION_FLAG_POSIX_SEMANTICS, and what forensic traces survive.
-
Anti-debug techniques and the telemetry each one generates
Ten anti-debug checks paired with the exact ETW providers, Sysmon event IDs, and forensic artifacts each one leaves behind – a reference for both sides of the …
-
Finding EPROCESS from the GS register
Most kernel code that needs a process structure starts from PsInitialSystemProcess or PsActiveProcessHead – both exported symbols. If the export table is …
-
The four callbacks an EDR kernel driver uses
PsSetCreateProcessNotifyRoutineEx, PsSetCreateThreadNotifyRoutine, PsSetLoadImageNotifyRoutine, and ObRegisterCallbacks: what each one gives you, what it misses, and how …
-
Thread start address inspection: how EDR kernel drivers catch shellcode
PsSetCreateThreadNotifyRoutine fires for every new thread. This post shows how an EDR kernel driver turns that callback into a start-address inspection pipeline, what the …
-
Handle stripping: how EDR kernel drivers protect their own process
ObRegisterCallbacks lets a kernel driver intercept every handle open before it completes. EDRs use this to strip dangerous access bits from any handle targeting their own …
-
Threadless injection: process execution without creating a thread
Every classic injection technique creates a thread. Threadless injection installs a 5-byte CALL trampoline on an existing function and hijacks the next thread that calls …
-
MapViewOfFile2: process injection without WriteProcessMemory
MapViewOfFile2 maps a section object directly into a foreign process without ever calling WriteProcessMemory, removing the cross-process write primitive that most EDR …
-
Function stomping: injecting into DLL text instead of heap memory
Classic shellcode injection allocates a private RWX page that every VAD-walking scanner flags. Function stomping overwrites an existing DLL export and executes from …
-
Process Injection Without the Obvious Thread: Early Bird APC and Beyond
Why CreateRemoteThread+LoadLibraryA is immediately detectable, how Early Bird APC avoids the worst of the telemetry, and the injection techniques that push further into …
-
Fingerprinting anti-cheat by its pool allocation pattern
BattleEye resolves ExAllocatePool at runtime via MmGetSystemRoutineAddress. Intercept that resolution and you can gate every pool allocation BE makes – returning …
-
Intercepting BattleEye's ObRegisterCallbacks at registration time
Removing BattleEye’s object callbacks is detectable. Intercepting the registration itself lets you subvert the callback’s effect while leaving it fully …
-
Code caves in signed kernel drivers
Unsigned executable memory in the kernel is an immediate red flag. Shellcode placed in the padding bytes of a legitimate signed Microsoft driver executes inside that …
-
MmCopyVirtualMemory: used everywhere, documented nowhere
MmCopyVirtualMemory is the undocumented kernel export behind nearly every kernel cheat and rootkit doing cross-process memory reads, but its actual behaviour – …
-
Writing an x64 Inline Hook by Hand (Without Reaching for MinHook)
How x64 inline hooks actually work, when to use a 5-byte relative jump versus a 14-byte absolute trampoline, why displaced instructions break when you copy them naively, …
-
NtLoadDriver vs SCM: what each leaves behind
Creating a service through SCM and calling NtLoadDriver directly leave different artifacts. Knowing exactly what each approach leaves – event log entries, registry …