Artem Baranov
Introduction Hello Last year, I published a white paper called “Windows Rootkits and Bootkits Guide”. The idea behind this document was to summarize kernel-mode techniques used by malware (rootkits and bootkits) to hide their presence in a compromised system. The guide also contains information...
alansguigna
In prior articles and in a recent webinar, I’ve covered the use of AI for UEFI and OS kernel trace analysis. This is a groundbreaking and novel approach for code coverage research, with many applications and potential use cases: at-scale bug triaging, codebase vulnerability scans, firmware/OS...
Artem Baranov
Introduction As we know, Windows has a proprietary hybrid kernel, written in C, C++, and Asm, called ntoskrnl.exe (also ntkrnlpa.exe, ntkrnlnmp.exe, depending on the installed version). It consists of various subsystems, each containing numerous functions. The term “subsystem” might suggest the...