reversing
-
Finding unexported kernel symbols without a symbol server
A pattern scanner maps a PE as a section image, scans for a unique byte sequence with a wildcard mask, and decodes the RIP-relative displacement to recover the symbol …
-
Binary-searching your payload: how AV signatures work and how to find them
Defender flags your file but won’t tell you why. Binary search the file to isolate the triggering bytes, then read what those bytes are to understand what kind of …
-
BattleEye's Handle Protection: Code Caves, IAT Tricks, and the Callback You Can't Just Yank
How BattleEye’s kernel driver uses ObRegisterCallbacks to strip process handles, how it intercepts registration via an IAT hook on MmGetSystemRoutineAddress, and a …
-
Writing an x64 Inline Hook by Hand (Without Reaching for MinHook)
How x64 inline hooks actually work, when to use a 5-byte relative jump versus a 14-byte absolute trampoline, why displaced instructions break when you copy them naively, …
-
Walking a Driver's IOCTL Dispatch by Hand
Finding the IOCTL dispatch table in a stripped kernel driver, decoding CTL_CODEs from first principles, and the triage methodology for prioritising attack surface before …