TCP/IP – core-jmp

The 49-Day macOS Time Bomb: How a TCP Timer Overflow Breaks the Network Stack

A bug in macOS’s TCP stack causes networking to fail after about 49.7 days of uptime. A 32-bit timer overflow freezes the…

oxfemale· Apr 9· 14 min ·225

NT AFD.SYS HTTP Downloader: From First Syscall to bypass the majority of usermode EDR hooks

Bypassing135

Bypassing cpp

NT AFD.SYS HTTP Downloader: From First Syscall to bypass the majority of usermode EDR hooks

The article demonstrates how to bypass the Winsock layer by communicating directly with the Windows AFD driver using Native API calls. It…

oxfemale· Mar 18· 16 min ·135

Peeling Back the Socket Layer: Reverse Engineering Windows AFD.sys

cpp233

cpp IOCTL

Peeling Back the Socket Layer: Reverse Engineering Windows AFD.sys

The research reverse-engineers Windows AFD.sys, showing how TCP sockets can be created, connected, and used by sending handcrafted IOCTL requests directly to…

oxfemale· Mar 16· 61 min ·233

// TCP/IP

The 49-Day macOS Time Bomb: How a TCP Timer Overflow Breaks the Network Stack

NT AFD.SYS HTTP Downloader: From First Syscall to bypass the majority of usermode EDR hooks

Peeling Back the Socket Layer: Reverse Engineering Windows AFD.sys