Ocean · BlogDetection engineering &
Detection engineering &
research
Technical breakdowns, internals, and updates across modern security and system-level engineering.
Blog Posts
notsnakesilent
Defeating Stack Spoofing with Kernel Trap Frames (AMD64)
Stack spoofing, widely used by advanced cheats, manipulates the call stack to hide the true origin of function calls and evade security monitors.
5989 viewsRead
The Power Behind HVCI and VBS
A simple breakdown of how Hypervisor-Enforced Code Integrity (HVCI) and Virtualization-Based Security (VBS) actually work.
4525 viewsRead
Anatomy of Process Hollowing: Hiding Code in Plain Sight
Process hollowing replaces a legitimate process's memory with malicious code, allowing the payload to run disguised as a trusted application to bypass process-based firewalls and antivirus.
3723 viewsRead
Driver Mapping: Injecting Code into Kernel Mode
Driver mapping, used by tools like KDMapper, loads unsigned drivers into kernel mode to run code with high privileges, bypassing system protections.
12471 viewsRead