Page-Granular Dynamic Decryption and Lazy Re-encryption in a Windows Packer
Page-granular dynamic decryption and lazy re-encryption in a Windows packer, explaining how it hides code until the moment of execution, so you can reproduce it yourself.
Tag: Windows
Reversing the Windows Photos AI Eraser Models
Reversing the Windows Photos AI eraser models, digging into the on-device machine learning model files to understand how the feature works, including the pitfalls and the fix.
A General Approach to Defeating VMProtect-Style Code Virtualization - JIT Tracing, Equivalence Rewriting, and Handler Matching
A general approach to defeating VMProtect-style code virtualization: JIT tracing, equivalence rewriting, and handler matching, with the commands and code included.
Debugging the Windows 11 Boot Process
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Understanding the x64 Windows SEH Mechanism
Understanding the x64 Windows SEH mechanism, explaining how structured exception handling works at the binary level on modern 64-bit Windows, for anyone reversing similar targets.
A Windows 7 Loader Bug Caused by Static DLL Dependency Order - Debugging a Packed Application Crash
A Windows 7 loader bug from static DLL dependency order, debugging a packed application crash down to the loader's resolution sequence, with every step broken down clearly.
Reverse Engineering a Malicious Kernel Driver: Callback Injection, APC, and Remote Thread Injection
Reverse engineering a malicious kernel driver, analyzing its dispatch routines and hooks to understand the rootkit's capabilities and intent, with the tools and offsets documented.
Tracing How the Disk Model and Serial Number Get Written into ClipSp.sys
Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.
Tracing a WMI Query to the Kernel: How Get-PhysicalDisk Reads Serial Number and UID
Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.
How Windows DTrace Works Under the Hood: bcdedit → winload.efi → ntoskrnl → dtrace.sys
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Decrypting CR3 via MMPFN: Reading the Real Directory Base on Windows 7, 10, and 11
Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.
Analyzing Windows Boot: bootmgfw.efi and the Early UEFI Boot Flow
Analyzing Windows boot: bootmgfw.efi and the early UEFI boot flow, tracing how the boot manager hands off to the Windows loader, for anyone reversing similar targets.
The Office 2000 50-Launch Limit: Finding the Confirmation ID in Memory
The Office 2000 50-launch limit: finding the confirmation ID in memory, reversing the classic activation check to lift the trial cap, and the internals laid out in detail.
FreeFileSync: Connection Limits and the Tamper Check
FreeFileSync's connection limits and tamper check, reversing the license gating and integrity verification behind the open-source tool's builds, with the algorithm recovered in detail.
Hooking Every Kernel Export to Analyze a Driver's Logic
Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.
WeChat 4.0 Anti-Revoke with Reminder: Symbol Recovery and String Decryption
WeChat 4.0 anti-revoke with a reminder, recovering symbols and decrypting strings to hook the message-revoke path and keep deleted messages, and the internals laid out in detail.
Reading EPROCESS and CR3 from MmPfnDatabase
Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.
Reverse Engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks
Reverse engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks, explaining how kernel drivers subscribe to object events, with the commands and code included.
MFC Under the Hood: RTTI, Message Routing, and Class Hierarchy Recovery
MFC under the hood: RTTI, message routing, and class hierarchy recovery, decoding the framework's internals to reconstruct C++ classes, with every step broken down clearly.
Reconstructing RtlCreateHeap: Assembly Optimization Patterns in Windows NTDLL
Reconstructing RtlCreateHeap from Windows NTDLL, decoding the assembly optimization patterns that make the original source hard to follow, with the setup and commands all covered.
Speaking DCERPC to Windows: Creating Services Without CreateService
Speaking DCERPC to Windows directly, creating services without CreateService by hand-crafting the RPC calls to the Service Control Manager, with the result and caveats spelled out.
Breaking VMProtect's Local License Lock: RSA, Big-Number Encryption, and a Working Keygen
Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.
InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.
Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock
A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.