Just a noob with a passion for what runs under the hood.
Foreword This is the third and final installment in a series of posts on stack spoofing research that I presented at Black Hat Europe 2025. The first two posts covered Stack Moonwalking++ and Callback Hell, which explored techniques for spoofing call stacks in pre-CET environments. However, Intel CET (Control-flow Enforcement Technology) fundamentally breaks those approaches. The shadow stack...
Foreword Once upon a time, my friend Athanasios Tserpelis, aka trickster0, decided to give me a call with a great problem on his hands: I’m using TpAllocWork + TpPostWork to execute an arbitrary function, but I’m not fully sure how to recover the return value. Any ideas? That question reminded me of some experiments I was working on previously, but had set aside out of laziness. I deci...
TL;DR As detection strategies increasingly emphasize call stack telemetry and validation, adversaries are adapting with more sophisticated evasion techniques. Building on our prior work with Stack Moonwalk and the Eclipse detection algorithm, this research introduces a new “way” of leveraging moonwalking that extend beyond basic desynchronization. In this article, we’ll present a PoC to ext...
Welcome! As of July 31, 2025, I’ve completely restyled this blog to make it more accessible, more readable, and hopefully more useful to anyone diving into the weird and wonderful corners of cybersecurity. I am Alessandro (aka klezVirus), and I’m a curious mind with a deep love for Windows internals, AI, and distributed systems. I’m not here to pretend I have all the answers — I’m still learn...
TL;DR With the evolution of cyber defence products, we’ve seen in the Red Teaming and Malware Development community a rise in advanced memory evasion techniques, which aim to bypass the detection of malicious code by concealing their presence while they reside in the memory of a target process. Among these techniques, we can find the so-called “Stack Spoofing”, which is a technique that allo...