patchi/sec
Offensive security, anti-cheat internals, game hacking, Windows kernel programming.
Written by an LLM. Code by a human. Sources verified.
Enumerating loaded drivers against a blacklist, scanning ObCallback registrations, and checking system integrity from Ring-0.
Using a Windows minifilter driver to protect anti-cheat files from tampering. Covers write, delete, and rename interception with rate-limiting.
Elevating to Protected Process Light via kernel EPROCESS manipulation, then consuming ETW Threat Intelligence events for remote operation monitoring.
A Python CLI tool that crawls websites, runs DuckDuckGo dorks, or processes URL lists to download every document and image, then extracts all EXIF and file metadata using exiftool. Surfaces authors, software, GPS coordinates, and more.
Enumerating process threads and checking whether their instruction pointer and start address fall within known module ranges. Threads outside the map are shellcode.
Traversing a PE's Import Address Table and Export Address Table to detect function pointer redirections outside known module ranges.
Comparing a module's .text section on disk versus in memory with SHA-256, accounting for relocations to avoid false positives.
Inside Peregrine's injected DLL: inline hooking of ReadProcessMemory, WriteProcessMemory, and friends via MinHook, with IPC event reporting.
How Peregrine's kernel driver autonomously injects a monitoring DLL into target processes using kernel APCs, timed at kernel32.dll load.
How Peregrine's kernel driver uses ObRegisterCallbacks to intercept and neuter process handle requests with dangerous access flags.
A walkthrough of Peregrine's three-layer architecture: kernel driver, injected DLL, and Tauri GUI, and how they communicate.
How Kassandra clones itself with a spoofed parent PID via NtQuerySystemInformation, restricts process access with SDDL security descriptors, and deletes its own binary from disk.
How Kassandra executes COFF Beacon Object Files, .NET assemblies, and Python scripts in isolated subprocesses with crash-safe stdin/stdout IPC.
A proof-of-concept Windows kernel driver written in Rust that enables arbitrary read/write access to any process memory via MmCopyVirtualMemory.
How Kassandra uses S3 object storage as a covert C2 transport, implementing AWS SigV4 request signing from scratch and bootstrapping per-execution IAM credentials.
How Kassandra resolves NT syscall numbers and instruction addresses from ntdll at runtime, detecting EDR hooks and extracting SSNs from neighboring functions.
An architecture walkthrough of Kassandra, a Mythic C2 agent written in Rust with three transport mechanisms, subprocess isolation, and 22 commands.
A walkthrough of a game cheat base written in C++, covering DLL injection, handle hijacking via NtQuerySystemInformation, native API memory manipulation, and ImGui overlay rendering with DirectX 11.