A modern Windows kernel-assisted threat is rarely a single user-mode module doing all the work. It is a stack: a user-mode controller, a kernel-mode component loaded through a vulnerable-driver cha...

Event Tracing for Windows is the telemetry fabric behind a large part of modern Windows security work. EDRs, anti-cheats, forensic tools, WPR, Sysmon-adjacent pipelines, and many Microsoft componen...

Hiding on Windows is not a single technique. It is the practice of selectively erasing — or lying about — the existence of a process, thread, DLL, driver, callback registration, or executable memor...

External DMA cheats are the hardest game-cheating threat to defend against, because the cheat code does not live on the machine running the game. The “victim” PC sees only a passive-looking PCIe en...

Target audience: Windows kernel security researchers, anti-cheat developers, kernel driver developers Reference environment: Windows 10 19H1 (1903) ~ Windows 11 (x64) Sources: BlackHat USA 20...

Welcome This is the first post on Kernullist’s Blog. I’ll be writing about security research, game engine internals, reverse engineering, and whatever else catches my attention. Stay tuned.