Posts on 0xGently

Custom GetProcAddress

Tue, 27 Oct 2026 00:00:00 +0000

Introduction

When developing with C or C++ on Windows systems, we generally use GetProcAddress to call a function inside a DLL. The process is fundamentally simple: the DLL is loaded into memory with LoadLibrary, and then the DLL’s handle value and the name of the searched function are passed to GetProcAddress. But how exactly does this process work in the background? How does the operating system find the string value we provided inside a massive memory block and return its address to us? In this post, instead of using standard Windows APIs, we are writing our own GetProcAddress function by parsing the memory structure of a PE file.

Custom GetModuleHandle

Sun, 25 Oct 2026 00:00:00 +0000

Introduction

Analyzing exactly how Windows APIs work under the hood gives us many new techniques and tactics when writing malware. In this post, we will explore how to implement one of the most frequently used APIs, GetModuleHandle, from scratch without calling a single Windows API. Of course, one of the main reasons for doing this is to hide this heavily used function from the IAT (Import Address Table).

As you know, GetModuleHandle returns the base memory address of a loaded module given its DLL name. What it actually does is quite straightforward: it scans a list of loaded modules maintained by the OS loader for each process. This list resides inside the Process Environment Block (PEB) structure. The focus of this post will be to show, step by step, how to manually access the PEB and parse this list.

Local APC Injection

Wed, 21 Oct 2026 00:00:00 +0000

Apc Injection

Today, there are many techniques we use to execute our payload when writing certain malware. In this post, we will focus on the APC Injection technique, which is one of the most fundamental and effective methods where we use the natural operation of the operating system to our advantage. Without wasting time on standard parts that are repeated in every injection, like memory allocation, we will focus directly on the technique.

Process Enumeration-1

Sat, 17 Oct 2026 00:00:00 +0000

In this article, I will explain how to gather information about processes or threads using the CreateToolhelp32Snapshot function.

If we want to interact with a target process in the tools we develop or the malware we write, we first need to pinpoint exactly where that process resides in the system.

We will divide our operation into two main stages. First, starting with plain text (such as a process name like notepad.exe), we will scan all the processes on the system and extract our target’s unique identification number, namely its PID. In the second stage, using this PID we obtained, we will dive into the target process and capture a valid thread that we can manipulate or hijack.

Thread Hijacking

Fri, 09 Oct 2026 00:00:00 +0000

Remote_Thread_Creation

In this article, I will talk about a technique in which we suspend a legitimate process, inject shellcode into its memory region, and then manipulate the RIP/EIP registers of its existing thread.

In the cybersecurity world, APIs such as CreateRemoteThread are generally the preferred choice for executing code inside a target process. However, these functions are monitored very tightly by security mechanisms (AV/EDR) and blocked instantly. Thread Hijacking, on the other hand, instead of creating a brand-new and suspicious thread from scratch, aims to “steal” the route of an already existing legitimate thread.

Process Enumeration-2

Thu, 08 Oct 2026 00:00:00 +0000

Process Enumeration

Finding the Target’s PID Value (EnumProcesses)

When developing malware, we often need a legitimate running process (e.g., notepad.exe or explorer.exe) on the system to execute techniques like hiding or running our payload. We need to speak Windows’ language and find the PID (Process ID) value of that process.

This process of listing the active processes on the system to find our target’s PID or gather similar information about processes is generally called Process Enumeration. In this article, we will look step-by-step at how to do this from scratch using the standard Windows EnumProcesses API.

Process Enumeration-3

Mon, 05 Oct 2026 00:00:00 +0000

Process Enumeration

Finding the Target’s PID Value (NtQuerySystemInformation)

During malware development ,we generally need a legitimate process that already exists on the system (such as notepad.exe, explorer.exe, or svchost.exe) to hide our payload in memory or to execute various techniques in a stable manner.

This is exactly where we refer to the practice of listing the currently active processes on the system to extract our target’s PID value or to collect telemetry about processes, generally known as Process Enumeration. In our previous article, we looked step-by-step at how to perform this operation from scratch using Windows’ standard EnumProcesses API. However, in the cybersecurity world, there are always more complex and harder-to-learn ways…

What are Prologue and Epilogue in Assembly?

Thu, 21 May 2026 00:00:00 +0000

When writing programs in high-level languages, there are many operations handled automatically in the background that we must manage manually in low-level languages (especially Assembly). Among the most critical of these are the prologue and epilogue sequences.

Before diving into this topic, let’s touch upon a few fundamental concepts:

Register: The fastest data storage area within the CPU; data to be processed is held here.
Stack: A memory area operating on a LIFO (Last In, First Out) basis, holding temporary data during function calls.
Stack Frame: A block of memory allocated on the stack each time a function is called, containing arguments and local variables.
ESP/RSP: The stack pointer; it points to the top of the stack. It is called ESP in x86 and RSP in x64 architecture.
EBP/RBP: The base pointer; it holds the base address of the stack frame and serves as a reference point for accessing variables.
Calling Convention: A set of rules determining how arguments are passed to functions and how return values are retrieved.
Push: Pushes a value onto the stack, moving the stack pointer down.
Pop: Pops the value from the top of the stack, moving the stack pointer up.

All these concepts form the foundation for understanding prologue and epilogue operations. Essentially, these two sequences consist entirely of setting up and tearing down the stack frame.

RC4 Encryption

Mon, 20 Apr 2026 00:00:00 +0000

RC4 Encryption

RC4 is a symmetric stream cipher that encrypts data byte by byte rather than in blocks. Under the hood, it consists of two primary phases: the Key-Scheduling Algorithm (KSA), where the key is initialized and permuted in memory, and the Pseudo-Random Generation Algorithm (PRGA), which generates keystream bytes to be XORed with the data. Thanks to its symmetric architecture, the exact same routine is utilized for both encryption and decryption.

XOR Encryption

Wed, 15 Apr 2026 00:00:00 +0000

XOR Encryption

In the world of malware development, one of the most critical factors determining the lifespan of your payload is how effectively you can conceal it. If you embed shellcode or a PE file into memory in plain text, static analysis tools and antivirus (AV) signatures will flag it within seconds.

This is precisely where payload encryption comes into play. In this post, we will examine the XOR algorithm—one of the most fundamental yet heavily modified encryption techniques in the malware domain. We will start from the basics and progress toward complex, position-dependent rolling structures.

IPv4/IPv6 DeObfuscation

Fri, 10 Apr 2026 00:00:00 +0000

IPv4/v6 DeObfuscation

In this post, we will examine how a network configuration function, which looks completely ordinary from the outside, is transformed into a shellcode decoder. Our goal is to understand the attacker’s mindset and design our defensive systems to catch these types of “normal-looking anomalies.”

Note: You can find the entirety of the code explained in this text at malware-development-library Furthermore, once you establish the logic of this topic and examine the full version of the code, you can also construct DeObfuscation processes applied to other techniques. They are pretty much the same anyway; you only need to make a few modifications, that is all.

Chacha20 Encryption

Wed, 01 Apr 2026 00:00:00 +0000

ChaCha20 Encryption

In this post, I will talk about ChaCha20. Frankly, I thought about how to introduce the topic, but I couldn’t come up with a sensible introductory sentence. Therefore, I prefer to dive straight into the subject.

File size and simplicity are everything. There is only one reason we prefer ChaCha20: it is compact, fast, and eliminates the need to write an extra decryption routine.

So why do we choose ChaCha20? Because it is exceptionally fast, does not rely on dedicated CPU cryptographic hardware extensions (such as AES-NI), and is far less cumbersome to implement from scratch in C/C++. Furthermore, we use the exact same code for both encryption and decryption, which minimizes the overall stub size of the software.

IPv4/IPv6 Obfuscation

Thu, 05 Feb 2026 00:00:00 +0000

IPv4/IPv6 Obfuscation

In the world of cybersecurity, when we want to hide data, we generally have two fundamental paths ahead of us: we either encrypt the data directly (such as AES, RC4, or XOR) or we obfuscate it.

When developing software, obfuscating the code sometimes plays a critical role not only in protecting intellectual property but also in bypassing security mechanisms. For example, suppose we have a shellcode and we want to hide it. Although encryption is the first solution that comes to mind, it might not always be the smartest route. This is because encrypted data causes the entropy (randomness rate) in that specific section of the file to skyrocket, and this situation immediately catches the radar of security analysts or AV/EDR solutions. At this point, obfuscating without drawing attention transforms into a much more logical alternative.

Packet Crafting with Scapy

Wed, 21 May 2025 00:00:00 +0000

In the world of network security and cybersecurity, understanding how a packet is formed, how it can be manipulated, and how to craft custom packets is a crucial skill. The Python programming language and the Scapy library provide an excellent platform for learning these skills. In this post, I will detail step-by-step the fundamentals of creating and analyzing network packets using Scapy.

1. What is Scapy and Why is it Important?

Scapy is a powerful network packet manipulation library written in Python. Essentially, it allows us to: