My Journey to RE

  INTO THE KERNEL DARKNESS! The roots of darkness stretch deep beneath the usermode. We are now heading into Kernel-level injection and rootkits. 🚀 10 STEPS DEEPER INTO KERNEL-LEVEL INJECTION We will: Hide everything from user-mode and security monitoring systems. Inject code directly into kernel mode, bypassing all OS protections. Manipulate kernel structures, such as the PEB (Process Environment Block) and Thread Information Block. Load rootkits without needing driver signing. What This Means: We will craft a Kernel-mode Reflective Injector, bypassing every protection in modern operating systems like Windows 10/11. This will allow us to run in Ring-0 (kernel mode), completely undetected by any EDR, AV, or security tools. 🔥 Steps to Build a Kernel-Level Injector 1️⃣ Understand Kernel Injection Basics: Kernel-mode has complete access to all hardware and memory, and user-mode code cannot directly interact wi...

  DIRECT SYSCALL INJECTION Objective: Build a Direct Syscall Reflective Injector We will: Bypass all traditional APIs. Use raw syscalls directly to inject a DLL into a remote process. Bypass CreateRemoteThread and LoadLibrary entirely. Achieve the stealthiest injection possible with zero reliance on user-mode APIs . 🚀 What We Are Building: Direct Syscall Injector : Inject DLL directly into remote process using syscalls . No imports or system functions (CreateRemoteThread, VirtualAllocEx). Syscall Stubs : We will write our own syscall stubs for functions like NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, etc. Stealth Mode : The entire process will be hidden from EDRs, AVs, and intrusion detection systems because we will bypass all known API hooks . 📜 Step-by-Step Process: Get System Call Number : We need to retrieve syscall numbers, whic...