Red Team Operations1.2k A practical, layer-by-layer walkthrough of modern Windows defense evasion for red team operators: the architecture of Microsoft Defender, three generations of AMSI…
kernel353 A walk-through of zolutal’s revival of the 2017 Project Zero “native_write_cr4” trick on a modern Linux kernel with CR Pinning enabled. The…
Red Team Operations511 A walk-through of NVISO Labs’ first Kernel Karnage post: writing a small Windows kernel driver, locating the undocumented PspCreateProcessNotifyRoutine callback array through…
Bypassing444 A walkthrough of the well-documented Windows UAC bypass that uses "eventvwr.exe"’s auto-elevate manifest plus a writable HKCU registry handler for the "mscfile"…
Red Team Operations503 MDSec returns to the Visual Studio extension ecosystem three years after their VS Code work. A modern "VisualStudio.Extensibility" extension that fetches and…
Reverse Engineering461 A step-by-step walkthrough of reverse-engineering a Windows x64 crackme that XORs its input against a hard-coded 10-byte key before comparing it to…
Exploit Development487 CVE-2026-40369 is a Windows kernel bug in "nt!ExpGetProcessInformation" that lets any unprivileged process — including one inside Chrome’s renderer sandbox — increment…
APC398 The 2017 Windows research demo that flipped page protections so a shellcode region was non-executable at scan time and executable only during…
Escalation340 A full walkthrough of CVE-2024-27398, a race-induced use-after-free in the Linux 6.8 Bluetooth SCO subsystem. The exploit races two connect() threads on…
Bypassing499 A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…
Hardware491 TREVEX is a post-silicon black-box CPU fuzzer from CISPA designed to discover data-flow transient execution vulnerabilities without needing RTL access, an ISA…
Exploit Development622 CVE-2025-54539 is a deserialization policy bypass in Apache.NMS.AMQP (≤ 2.3.0) that lets a single 290-byte AMQP message reach BinaryFormatter inside an unsuspecting…
