Writing about databases, operating systems, distributed systems, and security.http://localhost:4321/en-ushttp://localhost:4321/posts/io-multiplexing-explained/http://localhost:4321/posts/io-multiplexing-explained/How one thread can wait on thousands of sockets at once — animated diagrams, a working epoll server, and the pitfalls that bite in production.Mon, 26 Oct 2026 09:00:00 GMTOperating SystemsNetworkingLinuxConcurrencyepollhttp://localhost:4321/posts/malware-analysis-part-2-basic-dynamic-analysis/http://localhost:4321/posts/malware-analysis-part-2-basic-dynamic-analysis/Run a malware sample in a controlled lab and trace its behavior with Wireshark, Procmon, and INetSim.Mon, 05 Feb 2024 04:58:07 GMTWindowsBlue TeamMalwareDynamic AnalysisMalware Analysishttp://localhost:4321/posts/malware-analysis-part-1-basic-static-analysis/http://localhost:4321/posts/malware-analysis-part-1-basic-static-analysis/Inspect a suspicious binary without executing it using hashes, strings, FLOSS, PEview, and PEStudio.Tue, 16 Jan 2024 04:52:14 GMTBlue TeamStatic AnalysisMalwareWindowsMalware Analysishttp://localhost:4321/posts/windows-privilege-escalation-through-sebackup-serestore/http://localhost:4321/posts/windows-privilege-escalation-through-sebackup-serestore/Abuse SeBackup and SeRestore to dump the SAM and SYSTEM hives and escalate to Administrator.Sun, 31 Dec 2023 04:24:24 GMTWindows Privilege EscalationRed TeamingEthical HackingWindowsActive Directoryhttp://localhost:4321/posts/intel-processor-execution-modes/http://localhost:4321/posts/intel-processor-execution-modes/A tour of x86 execution modes, from real-address and protected mode to SMM and long mode.Sun, 24 Dec 2023 03:51:26 GMTIntelLow-Level ProgrammingProcessorsLow-Level Designx86-64http://localhost:4321/posts/bypassing-uac-by-gui-based-bypasses/http://localhost:4321/posts/bypassing-uac-by-gui-based-bypasses/Use msconfig's auto-elevation to get a high-integrity shell without triggering a UAC prompt.Sun, 10 Dec 2023 03:32:48 GMTPenetration TestingEthical HackingUACWindowsRed Teaminghttp://localhost:4321/posts/executing-shellcode-in-remote-process/http://localhost:4321/posts/executing-shellcode-in-remote-process/A walkthrough of classic shellcode injection with OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.Sun, 03 Dec 2023 03:43:43 GMTRed TeamingPenetration TestingMalwareMalware DevelopmentEthical Hackinghttp://localhost:4321/posts/windows-persistence-through-backdoor-services/http://localhost:4321/posts/windows-persistence-through-backdoor-services/Create and disguise a malicious Windows service to keep access across reboots.Sun, 26 Nov 2023 03:26:06 GMTPersistenceWindowsPenetration TestingRed TeamingMalwarehttp://localhost:4321/posts/windows-persistence-through-shortcut-files/http://localhost:4321/posts/windows-persistence-through-shortcut-files/Hijack a shortcut file so a user's click quietly launches a backdoor first.Sun, 19 Nov 2023 02:57:04 GMTRed Team ExercisesPersistenceMalwareWindows PersistencePenetration Testinghttp://localhost:4321/posts/function-call-obfuscation/http://localhost:4321/posts/function-call-obfuscation/Hide Windows API calls behind dynamically resolved function pointers to frustrate static analysis.Sun, 24 Sep 2023 09:23:54 GMTRed TeamingAV EvasionObfuscationMalware DevelopmentWindows APIhttp://localhost:4321/posts/ssh-port-forwarding/http://localhost:4321/posts/ssh-port-forwarding/Local, remote, and dynamic SSH tunnels explained with practical pivoting examples.Sun, 17 Sep 2023 13:02:17 GMTSSH TunnelPivotingRed TeamingPenetration TestingPort Forwardinghttp://localhost:4321/posts/kerberoasting/http://localhost:4321/posts/kerberoasting/Request service tickets for accounts with SPNs and crack their passwords offline — a classic Active Directory attack.Sun, 17 Sep 2023 12:59:53 GMTActive DirectoryPost ExploitationPenetration TestingKerberoastingActive Directory Attackhttp://localhost:4321/posts/obfuscate-payloads-with-xor-encryption/http://localhost:4321/posts/obfuscate-payloads-with-xor-encryption/Encrypt shellcode with a simple XOR routine, then decrypt it at runtime to frustrate signature-based detection.Sun, 03 Sep 2023 05:10:19 GMTMalware DevelopmentPayload ObfuscationRed TeamAV EvasionXORhttp://localhost:4321/posts/embedding-shellcode-in-text-and-data-section/http://localhost:4321/posts/embedding-shellcode-in-text-and-data-section/Place a shellcode byte array in the .text or .data section of a PE, then load and execute it from a small C++ harness.Sun, 27 Aug 2023 08:30:01 GMTMalware DevelopmentRed TeamingShellcodeWindows APIMetasploithttp://localhost:4321/posts/intel-vs-at-t-syntax/http://localhost:4321/posts/intel-vs-at-t-syntax/A side-by-side look at Intel and AT&T assembly syntax, and how to read the same instructions in both.Sun, 20 Aug 2023 04:10:24 GMTReverse EngineeringAssemblyx86 AssemblyIntel Syntaxhttp://localhost:4321/posts/gdb-cheatsheet/http://localhost:4321/posts/gdb-cheatsheet/A practical collection of GDB commands for breakpoints, stepping, memory inspection, and debugging.Sun, 13 Aug 2023 07:21:08 GMTGDBReverse EngineeringBinary ExploitationCheatsheet