A technical deep dive into NTDLL unhooking techniques using KnownDlls section mapping, Virtual Address Descriptors, and RWX page detection to bypass EDR hooks—covering Windows memory internals, kernel behavior, and practical code examples.
oxfemale
August 7, 2026
8 min read
107 
Browser Security178 CVE-2026-40369 is an unprivileged twelve-byte arbitrary kernel write in nt!ExpGetProcessInformation, reachable via NtQuerySystemInformation from browser renderer sandboxes. Root-cause analysis and a full…
Exploit Development141 GhostLock (CVE-2026-43499) is a 15-year-old use-after-free in the Linux kernel's rtmutex/futex requeue-PI code. When a proxy lock hits a deadlock and rolls…
Browser Security169 CVE-2026-10702 is a miscompilation bug in Firefox's SpiderMonkey Ion/Warp JIT. The MObjectToIterator instruction produced by scalar-replacing Object.keys() declares a load-only alias set,…
Threat Intelligence178 CVE-2026-50522 is a critical (CVSS 9.8) unauthenticated, pre-auth deserialization RCE in on-premises Microsoft SharePoint Server. A single crafted WS-Federation POST to /_trust/default.aspx…
Browser Security216 CVE-2026-6307 is a single V8 vulnerability that pierces two security boundaries at once. A missing signature comparison lets TurboFan's global value numbering…
Malware1k A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via…
Application Security283 A deep tour of HTTP parser inconsistencies: how trim/fold/header disagreements between Nginx, WAFs, caches and frameworks (Node.js, Flask, Spring Boot, PHP) enable…
Uncategorized369 Technical analysis of CVE-2026-2291, a critical heap buffer overflow vulnerability in dnsmasq that enables remote code execution through malicious DNS responses. Includes…
Privilege Escalation354 A comprehensive technical analysis of CVE-2026-57239, a privilege escalation vulnerability in Foxit PDF Reader that allows unprivileged users to escalate to NT…
Uncategorized302 Deep dive into KernelCallbackTable process injection, a technique that abuses the PEB's callback table to intercept and redirect Windows message handling, achieving…
RCE305 Technical breakdown of OnlyShells — a five-vulnerability chain in ONLYOFFICE Desktop Editors combining zero-click XSS, a Chromium V8 RCE, and an update-service…
windows799 Deep technical analysis of Windows Global Device Identifier (GDID), a persistent 64-bit device identifier stored in HKCU and used by Microsoft for…
