Search Criteria
Search Results
Found 26 blog topic(s) in 1ms. The latest articles will appear on top:
Page 1 of 2
Reverse Engineering - Resolving Confusion Over PsGetCurrentProcess, PsGetCurrentProcessId and PsGetProcessIdUsing WinDbg to understand dependency between KPCR, KPRCB, K/ETHREAD, K/EPROCESS and KAPC_STATE structures.June 1, 2026- Reverse Engineering - SHStrDup* FunctionReverse engineering the SHStrDupW function with WinDbgX to prevent a potential memory leak.March 15, 2026
Trusted Platform Module in Windows - Part 1How to use TPM to encrypt and decrypt small blobs of data programmatically.August 28, 2023
Reverse Engineering - Stepping Into a System CallHow to step into a SYSCALL with a debugger using kernel binary patch.August 25, 2023
Native Functions To The Rescue - Part 1How to make a critical process that can crash Windows if it is closed.August 22, 2023
Shaky Windows All The WayHow to perform "title bar window shake" programmatically in Windows.August 21, 2023
Critical Section vs Kernel ObjectsSpinning in user-mode versus entering kernel - the cost of a SYSCALL in Windows.August 19, 2023- Things You Find While Reverse Engineering - AlertByThreadIdHow to put a thread into a kernel wait state and how to wake it up by a thread ID.August 18, 2023
Nuances of a Process Harakiri in WindowsWhat is the shutdown-in-progress state of a process?August 16, 2023
Reverse Engineering & Binary Augmentation - Snipping ToolScreencasts of the reverse engineering process to make binary patches to modify discontinued Microsoft Snipping Tool.August 8, 2023
Things You Thought You Knew - Getting Windows VersionHow to tell the "real" version of Windows your app is running on?October 20, 2022
Crazy APIs & Silly Documentation - Part 1Microsoft's MSDN faux pas & weird sh*t you can find while reverse engineering Windows.July 31, 2022- Incorrect COM initialization and sporadic crashesThe perilous results of incorrect sequence of calls to CoInitialize and CoUninitialize functions.July 29, 2022
- When Developers Give Up - DeleteSecurityPackage FunctionWhy it pays off to look into some Win32 functions with a disassembler.October 13, 2021
Coding Windows Kernel Driver - InjectAllMaking the Visual Studio solution for DLL injection into all running processes.May 29, 2021
