My Journey to RE

A good read about PEB. Also crow's youtube video titled "Malware's LAST Stand: SELF-DELETION" is talking about TEB/PEB. You downloaded the video, it's on your drive. Also read about what are FS/GS registers about in the context of TEB/PEB. Malware's LAST Stand: SELF-DELETION youtube.com Digging into Windows PEB | Red Teaming's Dojo web.archive.org https://www.travismathison.com/posts/PEB_TEB_TIB-Structure-Offsets/ https://bowtiedcrawfish.substack.com/p/understanding-the-peb-and-teb https://en.wikipedia.org/wiki/Win32_Thread_Information_Block

This might be useful later. AdamOron/PatchGuardBypass: Bypassing PatchGuard on modern x64 systems github.com

Uninformed - vol 3 article 3 web.archive.org

Detours is a software package for monitoring and instrumenting API calls on Windows. Detours has been used by many ISVs and is also used by product teams at Microsoft. microsoft/Detours: Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form. github.com

dir /r hello.txt:stream_name:$DATA hello.txt and hello.txt:stream_name have different contents!  to view on console type dir /r https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3

 I have always liked reverse engineering since long time but I haven't taken time to really learn it. I'm starting to teach myself now.