Posts

2026-08-20 — Hunting Prompt Malware by Lifting Natural Language

2026-05-07 — Writing a Naive LLVM-based Devirtualizer

2025-11-21 — Driver Reverse Engineering 101 - Part II: Unpacking a VMProtected Kernel Driver

2025-08-15 — Driver Reverse Engineering 101 - Part I: Static Analysis

2025-02-16 — (Anti-)Anti-Rootkit Techniques - Part III: Hijacking Pointers

2024-09-19 — (Anti-)Anti-Rootkit Techniques - Part II: Stomped Drivers and Hidden Threads

2024-03-23 — (Anti-)Anti-Rootkit Techniques - Part I: UnKovering mapped rootkits

2024-03-11 — Automating Deobfuscation of XorStringsNet

2024-02-25 — Keylogging in the Windows kernel with undocumented data structures

2023-03-18 — Abusing the GPU for Malware with OpenCL

2023-01-10 — .NET Assembly Obfuscation for Memory Scanner Evasion

2022-11-25 — Windows Access Tokens: Getting SYSTEM and demystifying Potato Exploits

2022-08-30 — Avoiding direct syscall instructions by using trampolines