June 30, 2026 20 min read
Nirvana v2: Electric Boogaloo
A kernel-grounded detector for raw and gadgeted direct syscalls using process instrumentation callbacks, runtime syscall catalogs, ThreadLastSystemCall, and return-provenance matching.
Back to all posts
Tag archive
#c++
Everything currently published under the c++ tag.
May 3, 2026 9 min read
The Binary Stayed the Same: Mutex Handle Manipulation with HueSyncPatch
A Windows Object Manager case study in bypassing named-mutex single-instance checks by enumerating, duplicating, and closing remote handles, with EDR hunting caveats.
May 3, 2026 9 min read
The Shape of an Operation Is a Signature: Inside ObfTypes
How compile-time equivalence classes, seeded operator variants, SIMD backends, and Z3 proofs can shift brittle static signatures without pretending behavior disappears.