Android133 Debugging the Pixel 8 Kernel via KGDB
A complete walkthrough of attaching GDB to a running Android kernel on a physical Pixel 8 via KGDB: USB-Cereal UART wiring, custom…
oxfemale·
Jul 9·
17 min
·133
// Debug
17 postsAndroid133 
Debug105 HDD Firmware Hacking Part 1
A first-principles deep-dive into dumping, analyzing, and patching hard drive firmware: Western Digital custom LZHUF decompression, Samsung SSD deobfuscation, JTAG debugging of…
oxfemale·
Jul 2·
20 min
·105
Debug58 Sleeping Beauty II: CFG, CET, and Stack Spoofing
This post tackles CFG and CET/Shadow Stack bypasses for sleep obfuscation. It registers ROP gadgets via NtSetInformationVirtualMemory, swaps TIB stack bounds instead…
oxfemale·
Jun 28·
19 min
·58
Debug25 HWMonitor Trojanized to Deliver Multi-Stage STX RAT via DLL Sideloading
A trojanized HWMonitor archive abuses DLL sideloading with malicious CRYPTBASE.dll to launch multi-stage in-memory loaders and deploy STX RAT.
oxfemale·
May 14·
7 min
·25
Debug50 Inside the Payload: Manual Shellcode Analysis with Ghidra
The article demonstrates how to analyze Windows shellcode in Ghidra by identifying API-hashing routines, resolving hidden Windows API calls, and extracting C2…
oxfemale·
Mar 31·
13 min
·50
Debug47 Breaking the Shield: Unpacking a VMProtected Windows Kernel Driver
A technical walkthrough showing how to unpack a VMProtected Windows kernel driver using WinDbg and dynamic analysis. The guide demonstrates restoring the…
oxfemale·
Mar 25·
9 min
·47
Debug33 Debugging – WinDBG & WinDBGX Fundamentals
A beginner-friendly guide to debugging Windows programs using WinDbg and WinDbgX. It explains debugger basics, breakpoints, symbols, memory inspection, and execution control—key…
oxfemale·
Mar 23·
97 min
·33
Debug44 0x00 – Introduction to Windows Kernel Exploitation
The article introduces Windows kernel exploitation and explains how to build a research lab using tools like WinDbg and the HackSys Extreme…
oxfemale·
Mar 17·
28 min
·44
BSoD20 Won’t Fix: Kernel DoS in clfs.sys via NULL FastMutex Dereference
The article examines a Windows kernel bug in clfs.sys where a NULL pointer is dereferenced during fast mutex acquisition, causing a kernel…
oxfemale·
Mar 17·
12 min
·20
Debug944 Ghost in the PPL – LSASS Memory Dump
The article explains a technique for dumping memory from the protected LSASS process (PPL). It analyzes limitations of PPL protection and demonstrates…
oxfemale·
Mar 15·
15 min
·944
Debug36 How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection
The article explains how modern kernel-level anti-cheat systems work, describing their driver architecture, callbacks, memory monitoring, and detection methods used to identify…
oxfemale·
Mar 14·
56 min
·36
APC26 Reversing BEDaisy.sys: Static Analysis of BattlEye’s Kernel Anti-Cheat Driver
The article analyzes the Windows kernel driver BEDaisy.sys, used by BattlEye anti-cheat. Through static reverse engineering, it explores driver architecture, APC usage,…
oxfemale·
Mar 9·
28 min
·26