AboutWriteupsTradecraftContact

Tradecraft

Custom tools, scripts, and automation built for offensive and defensive security work.

Prism Bleed
3 parts

Prism Bleed

How the Windows loader classifies a PE image across its map / fixup / snap / init pipeline, and why that pipeline is really a classifier for pure x64, pure ARM64, ARM64EC, and ARM64X.

#windows#pe#loader#arm64#arm64x#prism#malware-research
Playing with PYD

Playing with PYD

Experimenting with Python extension modules (.pyd files) — PE structure inspection, module enumeration via PEB traversal, AMSI surface differences, and blending in through minimal imports and dynamic API resolution.

#python#windows#pe#peb#amsi#evasion#malware-research