
RC4Decryption
Abuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…

Abuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…

The PoC of information disclosure in Microsoft Desktop Windows Management.

"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…

Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI…

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

Microsoft HEIF Extension (msheif_store.dll) OOB-read

A scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.