https://trickster0.github.io/A minimal, portfolio, sidebar, bootstrap Jekyll theme with responsive web design and focuses on text presentation. 2025-06-21T18:44:30+08:00 trickster0 https://trickster0.github.io/ Jekyll © 2025 trickster0 /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2025-06-06T00:00:00+08:00 2025-06-21T18:43:50+08:00 https://trickster0.github.io/posts/Primitive-Injection/ trickster0

It has been a while, this is my research on trying to change the IOCs of a common remote process injection flow and the end result. I presented this in RedTreat in 2024 and I thought it was about time I publish it. As you most likely know, in order to perform remote process injection a few things need to happen: 1) Open the remote process with PROCESS_ALL_ACCESS or PROCESS_VM_OPERATION, PROCESS...

2022-02-13T00:00:00+08:00 2022-02-13T20:32:43+08:00 https://trickster0.github.io/posts/Custom-ReadMemory-API/ trickster0

After the great job and inspiration by x86matthew and his blogpost I decided to play with it as well for x64 bit. The NTAPI function in this method is RtlFirstEntrySList from ntdll.dll. Its definition like Matthew mentioned in his blog is similar like this: DWORD RtlFirstEntrySList(DWORD* Address) In his blog, only the x86 version is referenced and used, so I was curious and took a look mysel...

2021-11-27T00:00:00+08:00 2021-11-28T03:38:13+08:00 https://trickster0.github.io/posts/Halo's-Gate-Evolves-to-Tartarus-Gate/ trickster0

A while ago in my twitter, I have mentioned what a huge fan I am of Hell’s Gate and Halo’s Gate. Hell’s Gate originally is a very creative way to fetch the syscall numbers by parsing the InMemoryOrderModuleLIst from PEB structure. By finding the ntdll.dll address, which is usually the first entry in InMemoryOrderModuleLIst, it is possible to obtain the syscall numbers by parsing its exports for...

2021-11-05T00:00:00+08:00 2021-11-05T17:46:16+08:00 https://trickster0.github.io/posts/Solving-the-BFS-EkoParty/ trickster0

This is a quick write up about how one of our team members, Thanasis, solved the challenge for EkoParty 2019. This was a fun challenge and thanks to Lukas and Nico from Blue Frost Security for making it happen(and for supporting our community). More information about the challenge can be found at: https://labs.bluefrostsecurity.de/blog/2019/09/07/bfs-ekoparty-2019-exploitation-challenge/ The...

2021-08-01T00:00:00+08:00 2021-09-14T22:39:23+08:00 https://trickster0.github.io/posts/earlybird-apc-queue-injection-with-processstatechange-a-twist/ trickster0

Relatively recently, Yarden Shafir made a blog post about a new way to evade the EDRs for process injection. In the blog post, Yarden mentions that there are new added features in the recent Windows 10 build(Insider) and Windows 11 as well. Some of them are NtCreateProcessStateChange/ NtCreateThreadStateChange and NtChangeProcessState/NtChangeThreadState. These WINAPI calls were added to resol...