---
title: Research
url: 'https://kvc.pl/research'
markdown: 'https://kvc.pl/research.md'
date: '2026-09-07'
description: 'Security research articles by Marek Wesołowski (WESMAR): Windows kernel internals, reverse engineering, vulnerability analysis, malware research, and offensive security writeups.'
---

# Research

Technical writeups, reverse engineering notes, and vulnerability research. Each article documents a self-contained investigation — sources, methodology, findings, and reproducible artifacts.

## Method

Every investigation here starts at the binary, not the documentation. The target — a system DLL, a signed driver, a firmware image — is taken apart statically in IDA Pro, then watched live under CDB: memory differentials across a state change, single functions disassembled in place, the bytes that matter separated from the ones that do not.

The goal each time is one precise mechanism. The single flag that holds Real-Time Protection state (`0x180602F18` in MpSvc.dll). The IOCTL field a signed driver checks before it acts. The non-zero success code a Secure Kernel routine returns (`0x12C` from `SkciValidateDynamicCodePages`). The VK cell in a registry hive that decides which shell SYSTEM launches. Once it is located it is stated exactly, with offsets, so the finding can be checked rather than taken on trust.

A finding is only finished when it is reproducible. Most articles ship a small, dependency-free tool that does exactly the thing described and nothing else — WinDefCtl, ForceIO, EfiTool — built with the same discipline as the rest of the work: no C runtime, locale-neutral, signed Authenticode, verified across real Windows builds from Windows 10 22H2 to Windows 11 26H1, and byte-exact against the system's own behaviour wherever that can be measured.

Analysis and exploitation are kept apart. Where a writeup only documents a protected mechanism it says so and stops there — the skci.dll study carries no bypass and no exploit chain. The work is done under authorized research, and the line between understanding a protection and defeating it is drawn on purpose.

## Articles

- [Analyze Defender — Reverse Engineering the Windows Defender TP/RTP State Mechanism](https://kvc.pl/research/./analyze-defender)
- [ForceIO — Reverse Engineering IObitUnlocker.sys for Minifilter-Bypass File Operations](https://kvc.pl/research/./forceio-minifilter-bypass)
- [Static analysis of skci.dll — the Secure Kernel Code Integrity module](https://kvc.pl/research/./skci-code-integrity)
- [EfiTool — UEFI Bootkit Achieving NT AUTHORITY\\SYSTEM via In-RAM Registry Patching](https://kvc.pl/research/./efitool-uefi-registry-patch)
- [KnownDlls Kernel Injection — Bypassing Windows Object Security via KTHREAD.PreviousMode on Windows 11 26H1](https://kvc.pl/research/./knowndlls-kernel-injection)

---

## Navigation

- Previous: [Downloads](https://kvc.pl/downloads.md)
- Next: [Analizy techniczne (PL)](https://kvc.pl/analizy-techniczne-pl.md)
- Children:
  - [Analyze Defender — Reverse Engineering Windows Defender RTP State](https://kvc.pl/research/analyze-defender.md)
  - [ForceIO — Reverse Engineering IObitUnlocker.sys for Minifilter-Bypass File Operations](https://kvc.pl/research/forceio-minifilter-bypass.md)
  - [skci.dll Internals — Reverse Engineering the Secure Kernel Code Integrity Module on Windows 11 26H1](https://kvc.pl/research/skci-code-integrity.md)
  - [EfiTool — UEFI Bootkit Achieving NT AUTHORITY\SYSTEM via In-RAM Registry Patching](https://kvc.pl/research/efitool-uefi-registry-patch.md)
  - [From smss.exe Early Boot to KnownDlls Kernel Injection — Investigating Windows Object Namespace Security on Windows 11 26H1](https://kvc.pl/research/knowndlls-kernel-injection.md)