leapmotion ยท writingNotes on Windows internals, reverse engineering, networking and the occasional photo.https://leapmotion.io/The copy constructor is the struct layouthttps://leapmotion.io/writing/the-copy-constructor-is-the-struct-layout/https://leapmotion.io/writing/the-copy-constructor-is-the-struct-layout/How to diff a struct across two builds in seconds by aligning their copy constructors, and the two mistakes that produced fake fields while building the tool.Tue, 28 Apr 2026 00:00:00 GMTreverse engineeringwindowstoolingA readable pointer is not datahttps://leapmotion.io/writing/a-readable-pointer-is-not-data/https://leapmotion.io/writing/a-readable-pointer-is-not-data/Six rules for reading another process's memory, each one paid for with a wrong answer I was confident about at the time.Fri, 13 Mar 2026 00:00:00 GMTreverse engineeringmemorymethodologyMail only when it breakshttps://leapmotion.io/writing/mail-only-when-it-breaks/https://leapmotion.io/writing/mail-only-when-it-breaks/I tore down a nine-container monitoring stack and replaced it with three rules. The lab is better watched now than it was with dashboards.Tue, 17 Feb 2026 00:00:00 GMThomelabmonitoringbackupsEmulate the decrypt, don't reverse ithttps://leapmotion.io/writing/emulate-the-decrypt/https://leapmotion.io/writing/emulate-the-decrypt/When a decryption routine is inlined a thousand times and wrapped in mutation junk, stop parsing it. Run it, and follow the value.Tue, 27 Jan 2026 00:00:00 GMTreverse engineeringemulationobfuscationReading process memory through a driver, honestlyhttps://leapmotion.io/writing/reading-memory-through-a-driver-honestly/https://leapmotion.io/writing/reading-memory-through-a-driver-honestly/A kernel read primitive that returns success and zeros is worse than one that fails. Three bugs it caused, and what the API looks like now.Wed, 03 Dec 2025 00:00:00 GMTwindowskernelmemoryreverse engineeringSignatures are dead on mutating binarieshttps://leapmotion.io/writing/signatures-are-dead-on-mutating-binaries/https://leapmotion.io/writing/signatures-are-dead-on-mutating-binaries/A 24-byte code signature from the old build had zero hits in the new one. What survives a per-build mutation engine is the data side, and it survives well.Tue, 11 Nov 2025 00:00:00 GMTreverse engineeringwindowsmemoryFour runners, one $HOMEhttps://leapmotion.io/writing/four-runners-one-home/https://leapmotion.io/writing/four-runners-one-home/Scaling a self-hosted Windows build runner from one instance to four, and the three things that only break once you do.Tue, 21 Oct 2025 00:00:00 GMThomelabciwindowsWelcome to my Bloghttps://leapmotion.io/writing/welcome/https://leapmotion.io/writing/welcome/First post on the new site. A quick overview of what to expect here.Fri, 12 Sep 2025 00:00:00 GMTmetaintroduction