User-Mode Development

New Topic

117 topics

Topics

Replies

Views

Last post

Assembler Disassembler Engines

Last post by tangptr « Mon Mar 20, 2017 11:53 am
Replies: 16
by Dreg » Mon Mar 15, 2010 9:17 am
1

2
16 Replies

56118 Views

Last post by tangptr
Mon Mar 20, 2017 11:53 am
NtQueryInformationFile() FileProcessIdsUsingFileInformation: How prevent repeatition of same(s) process(es)?

Last post by Li Yong « Thu Apr 12, 2018 7:45 pm
Replies: 1
by Li Yong » Mon Apr 09, 2018 11:16 pm

1 Replies

267 Views

Last post by Li Yong
Thu Apr 12, 2018 7:45 pm
Process Doppelganging

Last post by EP_X0FF « Wed Dec 13, 2017 2:31 pm

by EP_X0FF » Wed Dec 13, 2017 2:31 pm

0 Replies

6886 Views

Last post by EP_X0FF
Wed Dec 13, 2017 2:31 pm
ETW discussion

Last post by Orkblutt « Thu May 18, 2017 10:26 am

by Orkblutt » Thu May 18, 2017 10:26 am

0 Replies

10041 Views

Last post by Orkblutt
Thu May 18, 2017 10:26 am
How I FUDed a meterpreter payload!!

Last post by EP_X0FF « Sun Feb 26, 2017 4:54 pm
Replies: 1
by kd77 » Sun Feb 26, 2017 2:23 pm

1 Replies

6587 Views

Last post by EP_X0FF
Sun Feb 26, 2017 4:54 pm
WMI persistence in C++

Last post by geoffreyvdb « Fri Aug 19, 2016 2:12 pm

by geoffreyvdb » Fri Aug 19, 2016 2:12 pm

0 Replies

16404 Views

Last post by geoffreyvdb
Fri Aug 19, 2016 2:12 pm
Monitoring Processes on Windows NT from Usermode (x86 & x64)

Last post by EP_X0FF « Thu Jul 21, 2016 5:34 am
Replies: 19
by Mut4nt » Sat Nov 10, 2012 6:01 pm
1

2
19 Replies

31135 Views

Last post by EP_X0FF
Thu Jul 21, 2016 5:34 am
EnumDisplayMonitors

Last post by EP_X0FF « Sat Jul 02, 2016 9:06 am
Replies: 2
by EP_X0FF » Sat Jul 02, 2016 6:27 am

2 Replies

7091 Views

Last post by EP_X0FF
Sat Jul 02, 2016 9:06 am
EntryPoint in LDR_DATA_TABLE_ENTRY

Last post by EP_X0FF « Wed Dec 30, 2015 4:06 am
Replies: 1
by evelyette » Tue Dec 29, 2015 10:40 am

1 Replies

6936 Views

Last post by EP_X0FF
Wed Dec 30, 2015 4:06 am
Hooking usage of DLL function

Last post by evelyette « Fri Dec 18, 2015 10:24 am
Replies: 17
by evelyette » Wed Nov 18, 2015 7:09 pm
1

2
17 Replies

18596 Views

Last post by evelyette
Fri Dec 18, 2015 10:24 am
Proxy DLL with Exported Structure

Last post by Brock « Wed Dec 16, 2015 10:47 pm
Replies: 11
by evelyette » Mon Dec 14, 2015 8:20 pm
1

2
11 Replies

12774 Views

Last post by Brock
Wed Dec 16, 2015 10:47 pm
Application Verifier Custom Providers

Last post by billbudsocket « Wed Nov 04, 2015 6:13 pm
Replies: 12
by EP_X0FF » Fri Aug 08, 2014 5:31 pm
1

2
12 Replies

30656 Views

Last post by billbudsocket
Wed Nov 04, 2015 6:13 pm
AV SP Discussion & Bypass

Last post by EP_X0FF « Wed Nov 04, 2015 4:47 am
Replies: 121
by R00tKit » Tue Feb 21, 2012 7:58 am
1

…

9

10

11

12

13
121 Replies

142012 Views

Last post by EP_X0FF
Wed Nov 04, 2015 4:47 am
Cannot call any API within hook?

Last post by puzzlex « Wed Oct 21, 2015 9:26 am
Replies: 2
by puzzlex » Tue Oct 20, 2015 12:33 pm

2 Replies

5447 Views

Last post by puzzlex
Wed Oct 21, 2015 9:26 am
Module (PEB/LDR) Hiding (4 Methods)

Last post by kerpow1 « Fri Oct 16, 2015 3:34 pm
Replies: 13
by kerpow1 » Sun Oct 11, 2015 10:50 am
1

2
13 Replies

14787 Views

Last post by kerpow1
Fri Oct 16, 2015 3:34 pm
create rdp session on new desktop

Last post by kobip « Tue Sep 29, 2015 9:38 am
Replies: 7
by kobip » Sun Sep 06, 2015 12:44 pm

7 Replies

9342 Views

Last post by kobip
Tue Sep 29, 2015 9:38 am
[PoC] Bypassing UM Hooks By Bruteforcing Intel Syscalls

Last post by Brock « Sun Aug 30, 2015 5:59 am
Replies: 9
by Microwave89 » Thu Aug 20, 2015 4:23 pm

9 Replies

12062 Views

Last post by Brock
Sun Aug 30, 2015 5:59 am
How to get structure info via PDB file?

Last post by myid « Mon Aug 10, 2015 7:12 am
Replies: 2
by myid » Mon Aug 10, 2015 12:36 am

2 Replies

6159 Views

Last post by myid
Mon Aug 10, 2015 7:12 am
SEH Address

Last post by nothern « Mon Jul 27, 2015 11:32 am

by nothern » Mon Jul 27, 2015 11:32 am

0 Replies

5333 Views

Last post by nothern
Mon Jul 27, 2015 11:32 am
[Delphi] 640bit Ring3 Rootkit keeps crashing

Last post by Brock « Tue Jul 14, 2015 9:16 pm
Replies: 7
by SysVolt » Sun Jun 14, 2015 11:40 pm

7 Replies

10852 Views

Last post by Brock
Tue Jul 14, 2015 9:16 pm
[Question] Relocated modules

Last post by cziter15 « Wed Jun 03, 2015 12:46 pm
Replies: 1
by Stylo » Thu Feb 05, 2015 9:51 am

1 Replies

6817 Views

Last post by cziter15
Wed Jun 03, 2015 12:46 pm
Process hollowing issues

Last post by ring0star « Tue May 19, 2015 6:22 am
Replies: 2
by ring0star » Sun May 17, 2015 5:59 pm

2 Replies

6914 Views

Last post by ring0star
Tue May 19, 2015 6:22 am
IPC inquiry

Last post by Brock « Tue Feb 24, 2015 7:43 am
Replies: 6
by Brock » Sat Feb 21, 2015 12:58 am

6 Replies

10009 Views

Last post by Brock
Tue Feb 24, 2015 7:43 am
ATA pass through read

Last post by EP_X0FF « Mon Jan 19, 2015 12:13 pm
Replies: 8
by Tigzy » Fri Jan 09, 2015 7:45 am

8 Replies

12494 Views

Last post by EP_X0FF
Mon Jan 19, 2015 12:13 pm
delaying startup programs?

Last post by EP_X0FF « Sun Jan 04, 2015 7:09 pm
Replies: 1
by BrianKress » Sun Jan 04, 2015 6:53 pm

1 Replies

6808 Views

Last post by EP_X0FF
Sun Jan 04, 2015 7:09 pm

New Topic

117 topics

Return to Board Index

Forum permissions

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum