Technical writeups, reverse engineering notes, and vulnerability research. Each article documents a self-contained investigation — sources, methodology, findings, and reproducible artifacts.
Every investigation here starts at the binary, not the documentation. The target — a system DLL, a signed driver, a firmware image — is taken apart statically in IDA Pro, then watched live under CDB: memory differentials across a state change, single functions disassembled in place, the bytes that matter separated from the ones that do not.
The goal each time is one precise mechanism. The single flag that holds Real-Time Protection state (0x180602F18 in MpSvc.dll). The IOCTL field a signed driver checks before it acts. The non-zero success code a Secure Kernel routine returns (0x12C from SkciValidateDynamicCodePages). The VK cell in a registry hive that decides which shell SYSTEM launches. Once it is located it is stated exactly, with offsets, so the finding can be checked rather than taken on trust.
A finding is only finished when it is reproducible. Most articles ship a small, dependency-free tool that does exactly the thing described and nothing else — WinDefCtl, ForceIO, EfiTool — built with the same discipline as the rest of the work: no C runtime, locale-neutral, signed Authenticode, verified across real Windows builds from Windows 10 22H2 to Windows 11 26H1, and byte-exact against the system's own behaviour wherever that can be measured.
Analysis and exploitation are kept apart. Where a writeup only documents a protected mechanism it says so and stops there — the skci.dll study carries no bypass and no exploit chain. The work is done under authorized research, and the line between understanding a protection and defeating it is drawn on purpose.