ASM331 mov ax, bx drama story – for fun and fasm
A tiny funny FASM program for Windows where BX generously shares its value with AX using mov ax, bx, turning a simple…
oxfemale·
May 23·
1 min
·331
// windows
198 postsASM331 
EDR1.3k APC Tandem: A Primitive-Chaining Process Injection That Slips Past Common EDR Triggers
A walkthrough of "APC Tandem", a stealth Windows process-injection technique that replaces WriteProcessMemory, CreateRemoteThread and VirtualAllocEx with a chain of less-watched primitives…
oxfemale·
May 23·
26 min
·1.3k
AMSI238 Weaponized abuse of SYLK file format
SYLK is an ancient spreadsheet format, but Excel still supports it. GhostWolf Lab shows how .slk files can carry XLM macros, masquerade…
oxfemale·
May 21·
7 min
·238
GhostTree: The NTFS Trick That Can Make Malware Disappear from EDR Scans
GhostTree abuses NTFS junctions to create recursive, near-endless valid paths. Recursive scanners and EDRs can hang in the maze while malware in…
oxfemale·
May 21·
10 min
·321
RPC522 Automating MS-RPC vulnerability research
Automating MS-RPC research shows how NtObjectManager, dynamic RPC clients, fuzzing, canary tracing, ProcMon and Neo4j can map interfaces, test procedures, find crashes…
oxfemale·
May 17·
40 min
·522
Debug263 HWMonitor Trojanized to Deliver Multi-Stage STX RAT via DLL Sideloading
A trojanized HWMonitor archive abuses DLL sideloading with malicious CRYPTBASE.dll to launch multi-stage in-memory loaders and deploy STX RAT.
oxfemale·
May 14·
7 min
·263
Malware352 DLL Sideloading & Proxying for Advance Red Team Engagements
A practical look at DLL sideloading and proxying: how attackers abuse trusted Windows executables to load malicious DLLs while keeping the app…
oxfemale·
May 14·
14 min
·352
kernel281 No More Hardcoded Kernel Offsets: Turning Microsoft PDB Symbols into a Runtime BYOVD Superpower
A Windows kernel research technique that uses Microsoft PDB symbols to resolve offsets dynamically, avoiding hardcoded values and manual WinDBG work across…
oxfemale·
May 13·
21 min
·281
Bypassing412 Building a DIY EDR from Scratch: Windows Kernel Callbacks, User-Mode Hooks, and Shellcode Injection Detection
A hands-on guide to building a basic Windows EDR with a kernel driver, callbacks, static analysis, DLL injection, and hooks to detect…
oxfemale·
May 13·
46 min
·412
kernel308 Shadow SSDT Hijacking: Achieving Kernel Code Execution via Read-Write Primitives
The article shows how Shadow SSDT hijacking can turn kernel read/write primitives into transient kernel code execution by redirecting a GUI syscall…
oxfemale·
May 7·
23 min
·308
AMSI383 Patchless AMSI Bypass via Page Guard Exceptions
The article shows a patchless AMSI bypass using Page Guard exceptions and VEH to intercept AmsiScanBuffer, force an early clean return, and…
oxfemale·
May 5·
14 min
·383
ALPC403 Recursively fuzzing MS-RPC structures and monitoring using ETW
The article updates MS-RPC-Fuzzer with recursive structure fuzzing, union support, ETW-based syscall monitoring, canary tracking, crash replay, and a Spooler case where…
oxfemale·
May 5·
17 min
·403