malware
-
Binary-searching your payload: how AV signatures work and how to find them
Defender flags your file but won’t tell you why. Binary search the file to isolate the triggering bytes, then read what those bytes are to understand what kind of …
-
Self-deleting executables: NTFS alternate data streams and POSIX semantics
How a running process can erase its own executable from disk using NTFS ADS renaming and FILE_DISPOSITION_FLAG_POSIX_SEMANTICS, and what forensic traces survive.
-
Anti-debug techniques and the telemetry each one generates
Ten anti-debug checks paired with the exact ETW providers, Sysmon event IDs, and forensic artifacts each one leaves behind – a reference for both sides of the …
-
Threadless injection: process execution without creating a thread
Every classic injection technique creates a thread. Threadless injection installs a 5-byte CALL trampoline on an existing function and hijacks the next thread that calls …
-
MapViewOfFile2: process injection without WriteProcessMemory
MapViewOfFile2 maps a section object directly into a foreign process without ever calling WriteProcessMemory, removing the cross-process write primitive that most EDR …
-
Function stomping: injecting into DLL text instead of heap memory
Classic shellcode injection allocates a private RWX page that every VAD-walking scanner flags. Function stomping overwrites an existing DLL export and executes from …
-
Process Injection Without the Obvious Thread: Early Bird APC and Beyond
Why CreateRemoteThread+LoadLibraryA is immediately detectable, how Early Bird APC avoids the worst of the telemetry, and the injection techniques that push further into …
-
Writing an x64 Inline Hook by Hand (Without Reaching for MinHook)
How x64 inline hooks actually work, when to use a 5-byte relative jump versus a 14-byte absolute trampoline, why displaced instructions break when you copy them naively, …