Blackstorm Security publishes its research openly. Two series — Exploiting Reversing (ERS) on vulnerability research and exploit development, and the Malware Analysis Series (MAS) on reverse engineering real threats — together run to more than 1,600 pages, all released free of charge. Every article is written by Alexandre Borges and also published on exploitreversing.com.
In Print
Gray Hat Hacking, Seventh Edition. Alongside the free articles below, Alexandre Borges is one of the co-authors of the seventh edition, to be published by McGraw-Hill Education in mid-2027.
Exploiting Reversing (ERS)
In progressA step-by-step vulnerability research and exploitation series on Windows, macOS/iOS, hypervisors and browsers.
Exploitation Techniques | CVE-2024-30085 (part 03)
Closes the CVE-2024-30085 exploitation arc with two editions that move beyond token stealing and I/O Ring. The PreviousMode edition flips a single byte in _KTHREAD.PreviousMode using a read-modify-write that preserves the adjacent scheduler fields, then escalates through the standard Nt API surface rather than a direct token write, explaining why impersonation alone is insufficient. The PPL Bypass edition additionally zeroes the _PS_PROTECTION byte in the LSASS _EPROCESS, stripping Protected Process Light so LSASS memory can be dumped — a path from regular user to SYSTEM to credential dump without administrator privileges.
Contents
- PreviousMode exploit edition
- _KTHREAD layout on Windows 11 23H2
- KALPC_RESERVE / KALPC_MESSAGE fake structures
- ProbeForRead / ProbeForWrite bypass
- PPL bypass edition
- _PS_PROTECTION bitfield
- LSASS credential dumping after PPL strip
Tools IDA Pro, WinDbg, kdnet, Visual Studio, Windows SDK/WDK, Vergilius Project
Exploitation Techniques | CVE-2024-30085 (part 02)
Focuses exclusively on two further I/O Ring exploit variations against the same cldflt.sys vulnerability. Technique 02 uses I/O Ring for both read and write, eliminating the pipe-attribute read primitive and the second overflow used in part 01, reducing the exploit from 24 stages to 15. Technique 03 removes ALPC entirely: a single WNF out-of-bounds write corrupts an adjacent IORING_OBJECT.RegBuffers array to obtain arbitrary kernel read and write, discovering _EPROCESS through PsInitialSystemProcess.
Contents
- I/O Ring read/write single-overflow exploit
- Named pipes as I/O Ring data transport
- Single ALPC bootstrap of RegBuffers
- I/O Ring exploit without ALPC
- Segment Heap VS subsegment grooming
- Token steal via _EPROCESS.Token (_EX_FAST_REF)
Tools IDA Pro 8.4/9.x, WinDbg, kdnet, Visual Studio, Windows SDK/WDK
Exploitation Techniques | CVE-2024-30085 (part 01)
Continues the cldflt.sys minifilter analysis begun in ERS 06, reusing the same n-day as a reference platform for new exploitation techniques rather than introducing a new bug. It presents a token-stealing variant that repurposes the ALPC write primitive to flip _KTHREAD.PreviousMode from UserMode to KernelMode, converting a one-shot write into unlimited arbitrary kernel write via NtWriteVirtualMemory — which also allows a clean restore of the corrupted pipe-attribute linked list, avoiding the crash present in the earlier approach. The second half introduces the Windows I/O Ring mechanism and a first I/O Ring based exploit.
Contents
- Token stealing via the ALPC write primitive
- WNF_STATE_DATA / ALPC_PORT pool spraying
- Pipe attribute Flink corruption as read primitive
- _KTHREAD.PreviousMode flip
- Arbitrary kernel write via NtWriteVirtualMemory
- I/O Ring core concepts and first exploit
Tools IDA Pro, WinDbg, kdnet, bcdedit, Visual Studio, Windows SDK/WDK
A Deep Dive Into Exploiting a Minifilter Driver (N-day)
A fully practical, end-to-end exploitation of a real Windows minifilter driver: CVE-2024-30085, a heap buffer overflow in cldflt.sys fixed by KB5039212. It covers binary diffing of patched versus vulnerable versions, extensive reverse engineering across Windows 11 23H2/22H2 and Windows 10 22H2, reparse point and data structure analysis, and kernel memory management and mitigation considerations. The exploit is then built in stages — pool overflow, pool corruption and fake pool construction via Event objects, kernel pointer and structure leaks — ending in two complete variants that escalate to SYSTEM.
Contents
- IDA Pro / WinDbg synchronization with ret-sync
- Binary diffing vulnerable vs patched cldflt.sys
- Minifilter driver review
- Reparse point analysis (HSM_FILE_MAGIC)
- Kernel mitigations and memory management
- Pool overflow and fake pool via Event objects
- Exploit: ALPC Write Primitive Edition
- Exploit: Parent Spoofing Edition
Tools IDA Pro, BinDiff, Diaphora, WinDbg, ret-sync, Winbindex, VMware Workstation, Windows SDK/WDK
Hyper-V (part 01)
The first installment of a multi-part series on hypervisors, establishing a working understanding of hypervisor concepts using Microsoft Hyper-V as the reference platform. It builds a functional debugging lab — kernel debugging over the network with KDNET, simultaneous kernel and hypervisor (hvix64) debugging in a nested setup, and an alternative approach using VMware’s built-in GDB stub — then covers virtualization concepts (VMX operations, VMCS, SLAT/EPT) and Hyper-V architecture. It closes with static analysis of the core hypervisor binaries, which ship without public symbols, and an enumeration of candidate attack surfaces.
Contents
- Nested lab infrastructure (L0/L1/L2)
- Kernel debugging via KDNET and bcdedit
- Hypervisor debugging (hvix64) and VMware GDB stub
- VMX root/non-root, VMCS, SLAT/EPT
- Hyper-V architecture: partitions, VMBus, VSP/VSC, IOMMU
- Static analysis of hvix64.exe without symbols
- Candidate hypervisor attack surfaces
Tools WinDbg, KDNET, IDA Pro, BinDiff, Diaphora, VMware Workstation Pro, hvext, Windows SDK/WDK
macOS/iOS (part 01)
An introductory review of macOS and iOS internals aimed at vulnerability research. It covers acquiring and unpacking IPSW firmware, extracting and parsing the dyld_shared_cache and kernelcache — including listing and extracting kernel extensions — and loading those artifacts into IDA Pro for static analysis. It then walks through XNU kernel debugging using LLDB, via the VMware GDB stub and via KDP, before reviewing operating system foundations and Apple’s layered security protections.
Contents
- IPSW firmware, dyld_shared_cache and kernelcache extraction
- Mach-O parsing and kext extraction
- XNU kernel debugging with LLDB (GDB stub and KDP)
- XNU kernel debugging using IDA Pro
- PAC, CoreTrust, AMFI, APRR, JITBox
- PPL, KPP, KTRR/RoRgn, SPTM/TXM, PGZ
- kalloc_type, kalloc_ro, Lockdown mode
Tools IDA Pro (Hex-Rays, Lumina), LLDB, ipsw toolkit, VMware GDB stub, KDP, Xcode, jtool2, 010 Editor
Chrome (part 01)
An introductory, step-by-step study of Google Chrome and in particular its V8 JavaScript and WebAssembly engine. It covers building V8 and the d8 shell from source on Windows and Linux, then reviews Chrome’s multi-process security architecture and the V8 execution pipeline through Ignition, Sparkplug, Maglev and Turbofan. The second half examines V8 internals relevant to vulnerability research — pointer tagging and compression, Maps and hidden classes, properties versus elements, and inline caches — and shows how out-of-bounds read/write primitives lead to type confusion and to the addrof and fakeobj primitives.
Contents
- Compiling V8 and d8 on Windows and Linux
- Chrome process model, sandboxing and IPC
- V8 pipeline: Ignition, Sparkplug, Maglev, Turbofan
- Smi, pointer tagging and pointer compression
- Maps, hidden classes, properties vs elements
- Type confusion and OOB read/write
- addrof and fakeobj primitives
- Inline caches: monomorphic to megamorphic
Tools V8 d8 shell, WinDbg, GDB with GEF, depot_tools, gn/ninja, Turbolizer, Visual Studio
Windows Kernel Drivers — part 02
A step-by-step patch-diffing walkthrough built around CVE-2022-35804, the SMB Client and Server remote code execution vulnerability. It documents the full workflow: identifying the SMB binaries potentially involved, downloading and unpacking the Microsoft cumulative update KB5016629 including its Patch Storage File, and retrieving the vulnerable and patched builds of srv2.sys via Winbindex. It then compares the two driver versions with BinDiff and Diaphora inside IDA Pro, interpreting the similarity and confidence columns, and closes with analysis of the changed code. A full lab setup section covers kernel debugging over the network and IDA Pro type library creation.
Contents
- Lab setup: two Windows 11 VMs, kernel debugging
- CVE-2022-35804 and the SMB client/server binaries
- .msu / .cab / .psf patch extraction
- Forward and reverse differentials
- Binary diffing with BinDiff
- Binary diffing with Diaphora
- Analysis of binary differences
Tools IDA Pro (tilib, Local Types), BinDiff, Diaphora, WinDbg, Winbindex, PSFExtractor, PatchExtract, WDK
Windows Kernel Drivers — part 01
Opens the Exploiting Reversing series and establishes the Windows kernel driver foundations required for vulnerability research and driver reverse engineering. It reviews driver types and driver models, then walks through the core kernel structures and routines a researcher meets when reversing a driver — _DRIVER_OBJECT, _DEVICE_OBJECT, _IRP, DriverEntry, dispatch routines and the IRP_MJ_* major function codes. It also covers I/O manager request flow, kernel pool allocation and pool tags, and IRQL levels, before extending into filter drivers, the Windows Driver Frameworks, kernel callbacks and the Windows Filtering Platform.
Contents
- Driver types and driver models (WDM, KMDF, UMDF)
- _DRIVER_OBJECT, _DEVICE_OBJECT and _IRP
- DriverEntry, dispatch routines, IRP_MJ_* codes
- I/O manager request flow
- Kernel pool allocation and pool tags
- IRQL levels and their effect on driver code
- Filter drivers and Windows Driver Frameworks
- Kernel callbacks and Windows Filtering Platform
Tools IDA Pro, WinDbg, Volatility, poolmon, fltmc, Vergilius Project, OSR loader, WDK
Malware Analysis Series (MAS)
Complete · 10 articles · 606 pagesA complete series on malware analysis and reverse engineering, built entirely around real samples. Each article takes a live threat from triage through unpacking and reverse engineering to a working configuration extractor, and the series progresses from Windows PE binaries to .NET, shellcode, macOS/iOS and Linux.
Article 10 | Linux
The final article of the series, an introduction to ELF malware analysis on Linux. It examines a stripped 64-bit ELF sample identified as Sodinokibi/REvil ransomware, walking through ELF headers, program headers, the dynamic section and symbol tables with readelf, objdump and strings, including extraction of the embedded JSON configuration and the base64-encoded ransom note. The reversing section uses IDA Pro with FLARE Capa Explorer to locate the cryptographic routines, identifying Salsa20, AES, RC4, Base64 and curve25519-donna implementations, and notes the strings showing the malware kills VMware ESXi virtual machines through esxcli.
Contents
- Retrieving Linux samples with Malwoverview
- ELF64 headers, program headers, dynamic section
- readelf, objdump and strings triage
- Extracting the JSON configuration
- Base64 ransom note decoding
- FLARE Capa Explorer for crypto discovery
- Salsa20, AES, RC4 and curve25519-donna routines
Tools IDA Pro 8.4, FLARE Capa Explorer, Malwoverview, readelf, objdump, jq, Yara, radare2, Detect It Easy
Article 09 | Shellcode
An introduction to shellcode analysis on Windows — how to work with raw byte blobs that have no PE loader and no processor module. It loads raw 32-bit shellcode in IDA Pro in binary mode, resolves API hashes with HashDB, and imports the Windows structures needed to follow PEB module walking and API resolution. A second example covers a PE binary with TLS callbacks that allocates an RWX region via VirtualProtect, locating and extracting an encoded embedded shellcode and writing a Python decryptor. A final section emulates extracted shellcode with scdbg and speakeasy, including a Cobalt Strike beacon.
Contents
- Loading raw shellcode in IDA Pro binary mode
- API hash resolution with HashDB
- _TEB, _PEB, _PEB_LDR_DATA structure import
- PEB module walking and API resolution
- TLS callbacks and RWX allocation via VirtualProtect
- Extracting and decrypting embedded shellcode
- Emulation with scdbg and speakeasy
Tools IDA Pro, HashDB, HxD, Hiew, Detect It Easy, Malwoverview, scdbg, speakeasy, Python
Article 08 | macOS/iOS
An introduction to malware analysis and reverse engineering on macOS and iOS. It explains the Mach-O and fat binary formats, segments, sections and load commands, then applies command-line tooling — otool, lipo, dyld_info, jtool2, class-dump, ldid, codesign — to two real samples: a macOS Mach-O trojan and an iOS IPA container, covering Info.plist, provisioning profiles, code signatures, entitlements and notarization. The second half reviews ARM64 registers, instructions and calling convention, then reverses Objective-C code in IDA Pro (objc_msgSend, selectors, ARC) and sets up remote macOS/ARM debugging with the IDA debug server.
Contents
- Mach-O format, load commands and fat binaries
- Retrieving macOS and iOS samples
- arm64 vs arm64e and PAC
- iOS IPA: Info.plist, provisioning profile, entitlements
- ARM64 registers, instructions and calling convention
- Objective-C reversing: objc_msgSend and selectors
- Remote ARM macOS debugging with the IDA debug server
Tools IDA Pro 8.4, Radare2, otool, lipo, dyld_info, jtool2, class-dump, ldid, codesign, Malwoverview, Xcode
Article 07
Analysis of malicious Windows PE binaries, using a Dridex banking trojan loader as the case study. It covers triage on public sandbox services, unpacking the protected DLL, profiling it with capa, and then a long static reversing session in IDA Pro against anti-debugging and anti-analysis tricks — INT 3 traps, obfuscated control flow, API hash resolution, Heaven’s Gate 64-bit execution, and RC4 and XOR encoding. It closes by locating the encoded configuration in the .data section and writing a Python script that extracts the botnet ID and the four C2 address pairs.
Contents
- Entry-point selection among fake exports
- capa profiling of the unpacked DLL
- Anti-debugging via INT 3 / __debugbreak traps
- API hash resolving
- Heaven's Gate 64-bit execution
- Type libraries and FLIRT signatures
- Encoded C2 record layout in .data
- Python configuration extractor
Tools IDA Pro 8.2, x64dbg with ScyllaHide, PE-bear, Detect It Easy, System Informer, capa, hollows_hunter, pe-sieve, Python/pefile
Article 06
Analysis of an Ave Maria (Warzone RAT) sample, a 32-bit Delphi-packed PE binary. It covers information gathering from public sandbox services, unpacking the sample and collecting dropped artifacts, and reversing the payload, with lab preparation including PowerShell logging, ASLR disabling and IDA Pro rebasing. The core of the article documents a customised RC4 variant: the author transcribes and comments the KSA and PRGA assembly, translates it instruction by instruction into Python, and builds a C2 configuration extractor that decrypts the C2 value from the .bss section.
Contents
- Unpacking via WriteProcessMemory and NtResumeThread breakpoints
- PowerShell logging configuration
- Disabling ASLR and rebasing in IDA Pro
- Customised RC4: KSA and PRGA transcription
- Translating assembly to Python (movsx/movzx sign extension)
- C2 configuration extractor
Tools IDA Pro, x32dbg/x64dbg, System Informer, PE-bear, Detect It Easy, CFF Explorer, HxD, Malwoverview, capa, FLOSS, Python/pefile
Article 05
Analysis of a 64-bit Bumblebee loader distributed through an .img container holding a .lnk file, a .bat script and a malicious DLL. It walks through triage and sample profiling, unpacking the DLL from memory with a debugger, reviewing x64 assembly and COM concepts, and reversing the payload’s routines. It closes by identifying a customised RC4 implementation, writing a Python C2 configuration extractor that recovers the address list and botnet identifier, and carving two embedded DLL payloads out of the unpacked binary.
Contents
- Decoding .lnk and .bat artifacts from an .img container
- Unpacking the DLL from memory
- x64 assembly review
- Component Object Model (COM) concepts
- Difficulties during analysis: static libraries and optimisation
- Customised RC4 and KSA
- C2 configuration extraction and payload carving
Tools IDA Pro 8.x, x64dbg, PE-bear, Detect It Easy, CFF Explorer, HxD, Malwoverview, FLOSS, capa, LnkParse3, Binary Refinery, Python
Article 04
An introduction to .NET managed-code malware analysis, applied to an AgentTesla sample. It reviews the .NET internals relevant to reversing — CLR header, metadata heaps and named streams, metadata tables, Reflection and dynamic assemblies — and shows how to collect information about a managed binary using PowerShell and System.Reflection, dumpbin and Mono’s monodis. The practical part unpacks the .NET Reactor-protected sample stage by stage in dnSpy, then uses de4dot with a generated list of string-decrypter method tokens to deobfuscate the final stage, exposing Run-key persistence, an external download URL and hooking and keylogging APIs.
Contents
- MSIL, managed code and obfuscator detection
- CLR header, metadata heaps and tables
- Reflection and dynamic assemblies
- Collecting .NET information with PowerShell and monodis
- Multi-stage unpacking of .NET Reactor in dnSpy
- de4dot string decryption via method tokens
- ImplMap table and native API review
Tools dnSpy, dnSpyEx, de4dot, dnlib, ILSpy, Mono/monodis, dumpbin, Detect It Easy, pestudio, Malwoverview, IDA Pro, PowerShell
Article 03
A full analysis of a 32-bit Emotet DLL, starting with triage data from VirusTotal, Triage and capa, then unpacking the binary and repairing its corrupted PE section headers. It covers a static reverse engineering session in IDA Pro focused on renaming functions, decrypting strings, resolving hashed API names and reconstructing the malware’s configuration. The article closes with a standalone Python script that extracts, XOR-decrypts and formats the encrypted C2 address list stored at the start of the .data section, matching the addresses reported by the sandbox.
Contents
- Packer detection and dumping from memory
- Fixing corrupted PE section headers
- Renaming variables and functions in IDA Pro
- String decryption and hashed API resolution
- Extracting public keys and fixing calling conventions
- Reconstructing C++ structures
- Python C2 address list extractor
Tools IDA Pro 7.7, x32dbg, Detect It Easy, PE-Bear, Resource Hacker, hollows_hunter, pe-sieve, Process Hacker, capa, HashDB, Malwoverview, Python/pefile
Article 02
Analysis of a Qakbot/Qbot sample, beginning with a reference list of Windows memory-allocation APIs and the breakpoints useful for unpacking, then triage and manual unpacking with x32dbg including dumping and repairing the extracted PE. The bulk of the article is a detailed reverse engineering walkthrough covering string decryption, string tables, API resolving, C++ structure reconstruction and C2 configuration extraction, supported by Python scripts, closing with observations on the malware’s cryptographic, anti-analysis and persistence routines.
Contents
- Memory allocation API chains and unpacking breakpoints
- Manual unpacking with x32dbg, dumping and PE fixing
- Encrypted strings and string tables
- Hashed API resolution
- C++ structure reconstruction
- Encrypted C2 configuration and obfuscated network protocol
- Defender exclusion keys and schtasks/regsvr32 persistence
Tools IDA Pro with decompiler and IDAPython, x32dbg/x64dbg, capa, YARA, PE-bear, HxD, Detect It Easy, pestudio, pe_unmapper, Flare VM, REMnux, Python
Article 01
The opening article of the series. It sets up the lab environment and tooling, then reviews the theory behind packing and unpacking — indicators of a packed binary, anti-debugging and anti-VM obstacles, and PE, IAT and OEP repair after dumping — followed by the main Windows code injection techniques. The practical portion analyses a Hancitor sample, unpacks it under a debugger, reverses its configuration decryption routine, and ends with a Python script that extracts and decrypts the malware’s C2 configuration data.
Contents
- Lab setup and malware analysis goals
- Packer indicators, protectors and anti-analysis
- PE, OEP and IAT repair after dumping
- Code injection: DLL, reflective, APC, hollowing, AtomBombing, Doppelgänging
- Unpacking methods and practice
- Reversing the decryption code
- Writing a configuration extractor
Tools x64dbg/x32dbg with ScyllaHide, Labeless and DbgChild, IDA Pro, PE-bear, pestudio, CFF Explorer, Scylla, HxD, Malwoverview, CyberChef, REMnux, Python 3