// The posts, in the order I built them
-
01
Malware dev Aug 20, 2026 9 min read →
How a small Rust loader sidestepped Windows Defender
A fileless loader caught on the first try, and the one word in the detection name that explained everything: behavior, not content.
-
02
EDR research Aug 24, 2026 10 min read →
I wrote a RAT in Rust to learn what EDRs actually catch
An enterprise EDR flagged exactly one behavior of my implant. Remove it, and the whole tool walked through clean. The lesson is about chains, not atoms.
-
03
Windows internals Aug 28, 2026 11 min read →
Manual PE mapping: running an EXE like the Windows loader
The ritual Windows performs on every program you start, performed by hand: sections, relocations, imports, and the jump. What it taught me about every alert I triage.