Internals

PPID Spoofing and Stomping — Process Injection Framework

Combining PPID Spoofing, Module Stomping, RC4 encryption, and native NT API enumeration into a single injection framework — built from scratch to understand how modern evasion techniques work under the hood.

Backdooring PuTTY — PE Injection & C2 Beacon Delivery

Manual PE backdooring from scratch: code cave injection, new section addition, XOR evasion, and Adaptix C2 beacon delivery inside a legitimate PuTTY binary.

Walking the PE — Static Analyzer & PEB Walker

Deep dive into the Windows PE file format and runtime process inspection via PEB walking — parsing headers, import/export tables, and the loader module list.