I/O Multiplexing, Explained Visually: select, poll, and epoll
How one thread can wait on thousands of sockets at once — animated diagrams, a working epoll server, and the pitfalls that bite in production.
Databases, Operating Systems & Security
Hi, I’m Irfan.
I write about databases, operating systems, distributed systems, and security — practical notes from things I learn, build, and break.
Writing
16 postsMalware Analysis — Part-2 Basic Dynamic Analysis
Run a malware sample in a controlled lab and trace its behavior with Wireshark, Procmon, and INetSim.
Malware Analysis — Part-1 Basic Static Analysis
Inspect a suspicious binary without executing it using hashes, strings, FLOSS, PEview, and PEStudio.
Windows Privilege escalation through SeBackup / SeRestore
Abuse SeBackup and SeRestore to dump the SAM and SYSTEM hives and escalate to Administrator.
Intel Processor Execution Modes
A tour of x86 execution modes, from real-address and protected mode to SMM and long mode.
Bypassing UAC through msconfig
Use msconfig's auto-elevation to get a high-integrity shell without triggering a UAC prompt.
Executing Shellcode in Remote Process
A walkthrough of classic shellcode injection with OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
Windows persistence through backdoor services
Create and disguise a malicious Windows service to keep access across reboots.
Windows Persistence through shortcut files
Hijack a shortcut file so a user's click quietly launches a backdoor first.
Function Call Obfuscation
Hide Windows API calls behind dynamically resolved function pointers to frustrate static analysis.
SSH Port Forwarding
Local, remote, and dynamic SSH tunnels explained with practical pivoting examples.
Kerberoasting
Request service tickets for accounts with SPNs and crack their passwords offline — a classic Active Directory attack.
Obfuscate payloads with xor Encryption.
Encrypt shellcode with a simple XOR routine, then decrypt it at runtime to frustrate signature-based detection.
Embedding Shellcode in .text and .data section.
Place a shellcode byte array in the .text or .data section of a PE, then load and execute it from a small C++ harness.
Intel vs AT&T Syntax
A side-by-side look at Intel and AT&T assembly syntax, and how to read the same instructions in both.
GDB cheatsheet
A practical collection of GDB commands for breakpoints, stepping, memory inspection, and debugging.