00000000 7f 6c 61 6e 64 68 62 01 00 00 00 00 00 00 00 00 |.landhb.........| 00000010 02 00 3e 00 01 00 00 00 c5 48 40 00 00 00 00 00 |..>......H@.....|

Blog Posts:

• Dec. 17, 2018, 6:45 p.m. - LKM Development Concepts & Considerations
• April 7, 2018, 9:31 p.m. - SPA with Netfilter Kernel Modules
• May 14, 2017, 10:13 a.m. - A Basic Windows DKOM Rootkit

Side Projects:

• MemScan-1.0
  Scan and edit memory using WinAPI functions such as ReadProcessMemory and WriteProcessMemory


• DrawBridge
  Layer 4 Single Packet Authentication Linux kernel module utilizing Netfilter hooks and kernel supported Berkeley Packet Filters (BPF)


• OpenMPI
  Various parallel programming programs written in C++ using the OpenMPI library.


• synacor-vm
  Synacor VM implementation written in C, demonstrating use of the Snow testing library


• HideProcess
  A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager


• USBGuard
  Cross Platform Personal Computer USB Port Management. Disable, Re-Enable, and Whitelist your USB Ports.


• Invoke-CertWebClient
  A functional way to utilize System.Net.WebClient with X509 Smart Card certificates in PSv2.