writing Writing
8 posts · rss
2026-04-28 The copy constructor is the struct layout 4 min How to diff a struct across two builds in seconds by aligning their copy constructors, and the two mistakes that produced fake fields while building the tool. reverse engineering · windows · tooling 2026-03-13 A readable pointer is not data 7 min Six rules for reading another process's memory, each one paid for with a wrong answer I was confident about at the time. reverse engineering · memory · methodology 2026-02-17 Mail only when it breaks 4 min I tore down a nine-container monitoring stack and replaced it with three rules. The lab is better watched now than it was with dashboards. homelab · monitoring · backups 2026-01-27 Emulate the decrypt, don't reverse it 6 min When a decryption routine is inlined a thousand times and wrapped in mutation junk, stop parsing it. Run it, and follow the value. reverse engineering · emulation · obfuscation 2025-12-03 Reading process memory through a driver, honestly 5 min A kernel read primitive that returns success and zeros is worse than one that fails. Three bugs it caused, and what the API looks like now. windows · kernel · memory · reverse engineering 2025-11-11 Signatures are dead on mutating binaries 4 min A 24-byte code signature from the old build had zero hits in the new one. What survives a per-build mutation engine is the data side, and it survives well. reverse engineering · windows · memory 2025-10-21 Four runners, one $HOME 4 min Scaling a self-hosted Windows build runner from one instance to four, and the three things that only break once you do. homelab · ci · windows 2025-09-12 Welcome to my Blog 1 min First post on the new site. A quick overview of what to expect here. meta · introduction No posts match.