Unlocking the Power of MemProcFS: A Memory Forensics Case Study
Mount a memory image with MemProcFS and inspect processes, segments, and artifacts. Drafted over two years, then published.
All Writeups
Showing 8 writeups
No writeups found matching your search.
Chaos-Rootkit: Internals Explained
Internals of a Ring-0 Windows rootkit: process hiding, token swapping, protection, and driver swapping.
CVE-2025-68921: Local Privilege Escalation Affecting Millions of Gaming Laptops
A Nahimic audio bug, reported to Lenovo PSIRT, that lets a standard user reach NT AUTHORITY\SYSTEM.
Hacking Games for Fun and Profit
Finding and rewriting the height value in Chained Together, from Cheat Engine to a small external.
CVE-2025-26125: Turning DoS into Privilege Escalation
An arbitrary file delete in IObit Malware Fighter, turned into SYSTEM through the MSI rollback trick.
The Story Behind Blackout: Abusing Gmer Driver to Terminate Protected Processes
A driver pulled from a ransomware case, and how GMER’s driver can terminate protected processes.
ALPHV Malware Analysis Report
Static notes on a BlackCat / ALPHV sample: packing, propagation, encryption modes, and IOCs.
Inside PLAY’s Game Cobalt Strike Beacon as the Gateway to Ransomware Havoc
A Cobalt Strike beacon and the ransomware that followed it in a PLAY intrusion.