Aftermath Labs

Prerequisite Material https://k0mkc.hatenablog.com/entry/2026/07/29/042406 https://arxiv.org/abs/2603.18355 https://arxiv.org/abs/1909.01752 Legal Disclaimer This work constitutes reverse engineering, decompilation, and de-virtualization performed solely…

Introduction Before reading this article I highly recommend studying the following community research on binary deobfuscation.

Download All Files Here Introduction The integrity of online video games is locked in a perpetual cat-and-mouse battle between anti-cheat developers and cheat engineers.

Exploiting a Computer Program 1.

KrakenSvm Project Table of Contents Preamble Purpose & Intentions Support Terminology Overview - KrakenSvm Hypervisor Virtual Machine Control Block (VMCB) - Parts Control Area Save State Area Secure Virtual Machine (SVM) - Semantics Checking Lock/Support…

Repository: https://git.back.engineering/_xeroxz/Theodosius/ Doxygen: https://docs.back.engineering/theo/ Table Of Contents Credits Introduction and Preamble LLVM IR Level Obfuscation Bin2Bin Obfuscation Linker Level Obfuscation Brief Overview Of Theodosi…

Source PERSES’ source code can be found here.

Table Of Contents Introduction Hardware Details Notable Components SoC - Hi3520DV300 TDE - Two Dimensional Engine UART - Universal asynchronous receiver-transmitter JTAG - Hardware Debugging Hisilicon Source Code Which can be found here, rehosted on my se…

Disclaimer Please note that all the code posted from here on is simply heavily beautified pseudo-code.

Source Link Disclaimer This is not an attack on EasyAntiCheat Oy.

VMProtect 2 Project: github.com/backengineering/vmp2 Table Of Contents Purpose Intentions Definitions VMProtect 2 - Project’s Overview VMHook - Overview VMHook - Example, um-hook VMProfiler - Overview VMProfiler - Virtual Machine Handler Profiling VMProfi…

Download link: VMProtect 2 Reverse Engineering Table Of Contents Credit - Links to Existing Work Preamble - Intentions and Purpose Purpose Intentions Terminology Introduction Obfuscation - Deadstore, Opaque Branching Opaque Branching Obfuscation Example D…

Download link: Voyager Table Of Contents Keywords Abstract Credit Introduction bootmgfw.efi winload.efi BlLdrLoadImage BlImgAllocateImageBuffer Hyper-V Intel - vm exit handler location and hooking Locating Vmexit Handler Hyper-V AMD - vm exit handler loca…

Download link: Hyperspace Table Of Contents Introduction - Address Spaces Thread Scheduler - Trap Frames and Control Registers DKOM - Direct Kernel Object Manipulation Windows Memory Manager - MiStealPage Example - printf, malloc, etc Limitations - Crashes

Download link: Reverse Injector Table Of Contents Introduction - Virtual Memory & Page Tables TLB - Translation Lookaside Buffer Four Level Page Table Graph Reverse Injector - Merging Address Spaces Remapping PML4 Entries 32bit Processes - Support, Limita…

Download link: MSREXEC Table Of Contents Introduction MSREXEC Starter Code WRMSR - Write Model Specific Register MSR - Model Specific Registers KVA Shadowing & KiSystemCall64 IA32_LSTAR With KVA Shadowing Disabled (KiSystemCall64) IA32_LSTAR With KVA Shad…

Download PDF Version (Best Version) can be downloaded here: PDF Download.

Download PDF Version (Best Version) can be downloaded here: PDF Download.

Download link: PSKP (Process-Context Specific Kernel Patch) Introduction Applying knowledge obtained from the prior write up of paging tables, one can easily follow along with this write up, if you have not acquainted yourself with paging tables this write

Download link: PTM Introduction Virtual memory is probably one of the most interesting topics of modern computer science.

Download link: physmeme Introduction Physmeme is a driver mapper that works with any form of read and write to physical memory.