research
Browse long-form research, lab observations, and implementation notes across malware development, EDR evasion, Windows internals, and Zig tooling.
edr-evasion / hooking / reverse-engineering
zig / malware-dev / tooling
windows-internals / research
red-team / offensive-security
featured research
Introducing COMegon — a sleep primitive that dispatches arbitrary API calls through the COM runtime's RPC machinery.
complete archive
entry 02
A walk through on how implant sleep-obfuscation evolved from naive Sleep() through Ekko and friends, why call-stack hunters forced stack spoofing, and how ETW Threat Intelligence plans to catch them all.
entry 03
Multi-gadget pool proxy system in Zig — route arbitrary Win32 API calls through the thread pool with gadget-based return address masking. No implant code on the stack, ever.