Technical writeups and independent research notes focused on implementation details, security boundaries, and practical findings in offensive and defensive security.
A complete code walkthrough of a classic CreateRemoteThread process injector in C — process enumeration with Toolhelp32, VirtualAllocEx, WriteProcessMemory, shellcode generation, and remote thread execution.
SSN extraction for NtDCompositionCommitChannel & NtDCompositionCreateChannel, full Ghidra trace of the dcomp.dll commit pipeline, and kernel-side analysis of win32kbase.sys batch dispatch logic. No CVE — full analysis.
A systematic walkthrough of hardening a Windows 11 endpoint — BitLocker XTS-AES 256, LAPS, WDAC, killing LLMNR/NetBIOS, and PowerShell CLM configurations that hold against modern threats.
Research into redirecting SetupAPI callback execution as an alternative code execution surface, with analysis of Windows internals and endpoint telemetry implications.
Foundational notes covering Linux x64 exploitation — memory layout, assembly concepts, shellcode construction, and the mechanics of classic exploitation techniques.