Rrxnveerainrxnveera.blog·4d ago · 17 min read Born With a Stolen Soul — Spawning Processes With Swapped Identities via NtSetInformationProcessHow we create a legitimate Windows process, replace its identity before it executes a single instruction, and wake it up as SYSTEM — invisible to most EDR process creation hooks. Introduction — What E00
Rrxnveerainrxnveera.blog·Jul 29 · 8 min readThe Silent Recon - Why Malware Authors Choose RID CyclingWhen an attacker lands a foothold on a Windows machine, their absolute first priority is discovery. They need to answer one crucial question: Who else is on this box? Finding local accounts—especially21N
Rrxnveerainrxnveera.blog·Jul 21 · 4 min readUnderstanding Process Isolation in WindowsLet's break down how two processes communicate in Windows, what process isolation means, and how APIs like WriteProcessMemory and VirtualAllocEx manage to access another process's memory — without bre00
Rrxnveerainrxnveera.blog·Jul 21 · 1 min readLoader Lockwhat is loader lock ? Loader Lock is a special internal lock , windows holds while loading or unloading DLLs So Windows restricts these operations inside DllMain to avoid deadlocks or hangs. So DLL Si00
Rrxnveeraincryptography-basics-part1.hashnode.dev·Jan 29 · 5 min readCryptography - Part 1Every time you log into a website, send a WhatsApp message, or open an HTTPS link, cryptography is silently working in the background to protect you. But for most people, cryptography sounds scary — full of math, formulas, and confusing jargon. In re...00
