Ido Veltzman :: Security Research

Event Tracing for Windows is one of Windows' richest telemetry systems.

Hey there, it has been a "little" while since I published my last post.

In the last blog post, we learned about two common hooking methods (IRP Hooking and SSDT Hooking) and two different injection techniques from the kernel to the user mode for both shellcode and DLL (APC and CreateThread) with code snippets and examples from

In the last blog post, we learned about the different types of kernel callbacks and created our registry protector driver.

In the last blog post, we learned some debugging concepts, understood what is IOCTL how to handle it and started to learn how to validate the data that we get from the user mode - data that cannot be trusted and a handling mistake can cause a blue screen…

Cronos is a new sleep obfuscation technique co-authored by idov31 and yxel.

In the last blog post we understood what it is a callback routine, how to get basic information from user mode and for the finale created a driver that can block access to a certain process.

In the last blog post, we had an introduction to kernel development and what are the difficulties when trying to load a driver and how to bypass it.

This blog post series isn't a thing I normally do, this will be more like a journey that I document during the development of my project Nidhogg.

When I first heard about Rust, my first reaction was "Why?".

When I first heard about ModuleStomping I was charmed since it wasn't like any other known injection method.

Many times I've wondered how comes that there are no tools to get active UDP connections.