OS Internals
Syscalls, kernel behavior, process memory, and the boundaries between user mode and the kernel.
- •7 min read•elfreverse-engineering
Symbol Tables: What Function Names Actually Are
Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.
- •12 min read•elfreverse-engineering
Building a Custom ELF Loader from Scratch, in C
You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.
- •8 min read•elfreverse-engineering
Parsing ELF Binaries in C
The first step to actually understanding what runs on your machine: read an ELF file yourself. No libelf, no readelf — just mmap and pointer casts. I walk the header and section table of a real binary, and diff my output against the tools that already exist.
- •11 min read•reverse-engineeringos-internals
Syscall-Level Reversing, Part 2: Unhooking and Direct Syscalls
Edr and AV products hook ntdll to sit between a program and the kernel. Here is how that hooking works, how it gets spotted, and how direct syscalls are used to slip past it.
- •9 min read•reverse-engineeringos-internals
Syscall-Level Reversing, Part 1: Why the Kernel Boundary Matters
What actually happens when a program asks the kernel for something, how to recognise a syscall in a disassembly, and why malware unhooks this layer first.
- •9 min read•os-internalsvulnerability-research
Copy Fail: CVE-2026-31431 (TryHackMe)
Exploit copy-fail, a kernel LPE that corrupts any file's page cache to gain root in seconds.
- •4 min read•systems-programmingassembly
Building My First Multiboot Toy Kernel (x86, C + Assembly)
How I built a 32-bit freestanding toy kernel that boots through GRUB, enters C cleanly, and now handles CPU exceptions through GDT+IDT setup.
- •9 min read•reverse-engineeringmalware-analysis
x86 Architecture for Malware Analysis - TryHackMe Writeup
A comprehensive guide to x86 CPU architecture fundamentals essential for malware reverse engineering. Learn about registers, memory layout, and stack operations that form the foundation of system exploitation.
Exploit copy-fail, a kernel LPE that corrupts any file's page cache to gain root in seconds.
CVSS: 7.85/10/2026