All writings

Evasion April 2026

Kagami: The Three Layers of Full Sleep Obfuscation

Theoretical deep dive into full sleep obfuscation: code encryption via dual-mapping, thread stack spoofing with targeted UNWIND_INFO resolution, heap encryption through signed-DLL primitives. Three layers, three surfaces closed. Tested against CrowdStrike Falcon, Elastic Security, MDE.

Read article →
Evasion April 2026

Kagura-StackWalker: The Stack Is a Dance, and the EDR Knows Every Step

Deep dive into Windows call stack internals, .pdata, UNWIND_INFO, and how to build fake stack frames that bypass CrowdStrike's RtlVirtualUnwind validation. Covers both indirect syscall spoofing and Win32 API callstack spoofing.

Read article →
Evasion March 2026

Shinkiro: A Matched-Gadget Indirect Syscall Technique With APC Execution

A technique addressing all four EDR detection layers: userland hooks, call stack symbol analysis, stack walking validation, and behavioral injection patterns. Tested against CrowdStrike Falcon Policy Prevention 3.

Read article →