Welcome! This blog is a collection of experiments, PoCs, writeups, and tools focused on Windows internals, red teaming, evasion techniques, and low-level exploration. Whether you're into user-mode/kernel-mode malware techniques, offensive tradecraft, and some light reverse engineering — you're in the right place.
Foreword This is the third and final installment in a series of posts on stack spoofing research that I presented at Black Hat Europe 2025. The first two posts covered Stack Moonwalking++ and Call...
Foreword Once upon a time, my friend Athanasios Tserpelis, aka trickster0, decided to give me a call with a great problem on his hands: I’m using TpAllocWork + TpPostWork to execute an arbitr...
TL;DR As detection strategies increasingly emphasize call stack telemetry and validation, adversaries are adapting with more sophisticated evasion techniques. Building on our prior work with Stac...
Welcome! As of July 31, 2025, I’ve completely restyled this blog to make it more accessible, more readable, and hopefully more useful to anyone diving into the weird and wonderful corners of cyber...
TL;DR With the evolution of cyber defence products, we’ve seen in the Red Teaming and Malware Development community a rise in advanced memory evasion techniques, which aim to bypass the detection...
TL;DR Process injection is a widespread defense evasion technique often used in malware development, and consist into writing (injecting) code within the address space of a remote process. Altho...
Recently, @zyn3rgy released LdapRelayScan, a tool to check for LDAP protections regarding the relay of NTLM authentication. The tool can tell you whether an LDAP server enforces certain kind of pr...
TL;DR As already explained in my previous post “The path to code execution in the era of EDR, Next-Gen AVs, and AMSI”, various security products, such as AVs and EDRs, place hooks in user-mode API...
Recently, I developed a PoC AV/EDR Framework, called Inceptor. More information about the tool can be found in the repository itself, and in the accompanying blog post. What is important to know, ...
As most offensive tool developers knows well, .NET provides a mechanism called Platform Invoke (aka P/Invoke) that allows to call unmanaged APIs directly from .NET applications. This technique ha...
