Signal Labs

Important Information

High-Level Overview

Windows Internals & x86-64 Primer

Public Code Analysis & Operational Concerns

Initial Development Environment Setup

Rust Notes

First Challenge: Our Own GetProcAddress Implementation

First Challenge Solution Pt.1: Exploring GetProcAddress

First Challenge Solution Pt.2: Exploring GetModuleHandle & the PEB

First Challenge Solution Pt.3: Finalizing our Custom Module Finder

First Challenge Solution Pt.4: Thread Safety & Cleanup

First Challenge Solution Pt.3: Notes & Current Code

First Challenge Solution Pt.5: Defining the PE32+ Format

First Challenge Solution Pt.6: Parsing In-Mem Modules

First Challenge Solution Pt.7: Continuing Parser Development

First Challenge Solution Pt.8: Forwarder Checks & Export Tables

First Challenge Solution Pt.9: Finalization

Creating our Custom COFF Loader: Design

Custom COFF Loader: Initial Files

COFF Loader Challenge Description: Symbols

Note: Windows APIs & Rust

COFF Loader Challenge: Notes

COFF Loader Solution

COFF Loader Solution Files

Process Injection Purpose, Methods & Code

Process Injection (Duplicate Object + Sections) Sample w/ Rust

C2 Comm Concepts, Management & Notes + VT Hash Challenge

VT Hash Solution

VT Hash Solution Files

Server & Implant Comms Over HTTP/2 w/ Protobuf & Serde

Server & Implant Files

Overview of EDR & AV Internals

Target Analysis, Technique Discovery & Bypass Theory + Challenge

Avoiding All Hooks & Unhooking via In-Mem Disassembly + Solution

In-Mem Disassembly + Unhooking Source

Developing a Custom Rust MiniDumper (MiniDump Format Specification & Avoiding Hooks)

Custom Rust MiniDumper Solution (Tokens, Getting System, PssWalk* APIs + More)

Custom Rust MiniDumper Source Code

Stack Trace Obfuscation

Stack Trace Obfuscation Solution

Stack Trace Obfuscation Solution Files

Intro to Kernel Rootkits

Kernel Debugging Environment Setup

Analysis of our Custom Protection Kernel Driver

Custom Protection Kernel Rootkit Source

Initial Hypervisor Theory

Creating the HyperCore & HyperWin Projects

Deploying & Testing our Initial Code

Detecting VMX & Existing Hypervisors

VMXON Requirements

Custom Spinlocks & Global Allocators

Creating a VP

Executing on all Logical Processors

VMCS Fields & Initialization

VMCS Fields & Initialization pt.2

VMCS Fields & Initialization pt.3

VMCS Fields & Initialization pt.4

VMCS Fields & Initialization pt.5

VMCS, DPCs & Kernel Debugging

Code Cleanup & VMLAUNCH

Hypervisor Code (So Far)

Hypervisor Code (Working)