AI Security Research104 A walkthrough of how an LLM, wrapped in a tiered build-and-test harness, can take a Mythic C2 agent from a one-paragraph spec…
Debug58 This post tackles CFG and CET/Shadow Stack bypasses for sleep obfuscation. It registers ROP gadgets via NtSetInformationVirtualMemory, swaps TIB stack bounds instead…
Malware89 This post details the journey of hardening Adaptix C2's default agent DLL using Crystal Palace's Reflective DLL loader. It implements IAT hooking,…
Deep dive into Windows PE file format—headers, sections, and loader mechanics. Explains how security products (AV/EDR) detect malware via static analysis: entropy,…
EDR Evasion65 Two Python shellcode stagers from g3tsyst3m that hit 0/63 on VirusTotal — Variant #1 uses string-reversed NT APIs (NtAllocateVirtualMemory, NtCreateThreadEx) plus RWX…
Exploit Development52 Synacktiv’s open-source DCOMIllusionist takes James Forshaw’s .NET DCOM deserialization primitive — the same one that seeded the “Potato” family — and turns…
EDR Evasion52 cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…
EDR Evasion32 Praetorian’s Centurion is a virtualized loader built around a custom x86-64-inspired ISA and freestanding C runtime, where the PE loader, TLS stack…
APC28 The 2017 Windows research demo that flipped page protections so a shellcode region was non-executable at scan time and executable only during…
Exploit Development36 A long-form tutorial on Windows malware development for offensive operators. It walks from dynamic API resolution and IAT hooking through process hollowing,…
