cybersecurity & programminghttps://winternl.com/https://winternl.com/aad-broker-cache/https://winternl.com/aad-broker-cache/tl;dr: Source: https://github.com/jackullrich/AADBrokerDecryptTue, 30 Sep 2025 00:00:00 GMThttps://winternl.com/full-fat-shellcode/https://winternl.com/full-fat-shellcode/GLP-1s need not apply.Thu, 10 Apr 2025 00:00:00 GMThttps://winternl.com/loader-lock-ownership-semantics/https://winternl.com/loader-lock-ownership-semantics/If your career as a programmer has led you here, fear not, there is still time to turn back.Sat, 23 Nov 2024 00:00:00 GMThttps://winternl.com/fixing-a-bug-in-donut/https://winternl.com/fixing-a-bug-in-donut/A client used donut to generate a reflective loader for a 64-bit PE file. The shellcode was then embedded and run from a .NET assembly. Strangely, it was not…Wed, 09 Oct 2024 00:00:00 GMThttps://winternl.com/why-is-there-a-debug-directory-in-my-release-build/https://winternl.com/why-is-there-a-debug-directory-in-my-release-build/(And other difficult conversations to have with your kids)Sun, 29 Sep 2024 00:00:00 GMThttps://winternl.com/cve-2022-43997/https://winternl.com/cve-2022-43997/Aternity is software developed by Riverbed used to monitor the performance of applications and devices from the end user perspective. Software such as…Mon, 23 Jan 2023 00:00:00 GMThttps://winternl.com/dealing-with-failure/https://winternl.com/dealing-with-failure/Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of the red teaming…Tue, 10 May 2022 00:00:00 GMThttps://winternl.com/detecting-manual-syscalls-from-user-mode/https://winternl.com/detecting-manual-syscalls-from-user-mode/By now direct system calls are ubiquitous in offensive tooling. Manual system calls remain effective for evading userland based EDRs. From within userland…Wed, 10 Feb 2021 00:00:00 GMThttps://winternl.com/designing-emulation-resistant-control-flow/https://winternl.com/designing-emulation-resistant-control-flow/Antimalware emulators have the Sisyphean task of implementing a complete and accurate clone of the Windows environment. My previous research focused on a…Thu, 17 Dec 2020 00:00:00 GMThttps://winternl.com/memfuck/https://winternl.com/memfuck/Dynamic malware analysis is the preferred way to determine the legitimacy of an application for many AVs/EDRs/MDSs. Unlike static analysis, dynamic analysis…Tue, 08 Sep 2020 00:00:00 GMThttps://winternl.com/static-detection-of-portable-executable-files/https://winternl.com/static-detection-of-portable-executable-files/The cat and mouse game of the AV industry lives on into another decade. All AVs, operate on essentially three modes of detection.Tue, 01 Sep 2020 00:00:00 GMThttps://winternl.com/fuzzing-the-windows-api-for-av-evasion/https://winternl.com/fuzzing-the-windows-api-for-av-evasion/Malware Detection Systems (MDSs) use a technique called emulation as perhaps their most effective weapon against novel malware threats. Emulation does not…Tue, 07 Jul 2020 00:00:00 GMThttps://winternl.com/trunpe/https://winternl.com/trunpe/is a modified process hollowing technique capable of injecting entire PE files.Thu, 26 Sep 2019 00:00:00 GMThttps://winternl.com/shellcodestdio/https://winternl.com/shellcodestdio/is an extensible framework for easily writing debuggable, compiler optimized, position-independent, x86 and x64 shellcode for windows platforms.Mon, 02 May 2016 00:00:00 GMT