@loland

A Stealthier Reflective Loading

Reflective Loading is a technique used by attackers on Windows to run code entirely in memory.

The CRTO

I passed the CRTO exam on 8 October 2025. This is a course review, as well as an opportunity to share some blue-team techniques for detection.

Strange Hacking Tool

Simple Powershell Backdoor (.ps1, shellcode)

The Inner Workings of Meterpreter (shellcode)

This blog entry covers personal technical research on the meterpreter staging payload. Meterpreter, as part of the Metasploit framework developed by Rapid7, is a C2 framework used by white and black hats alike.

Embedded Shellcode Obfuscation Part 2 (C++)

A continuation of the previous chapter. We’ll continue to attempt more obfuscation techniques with the same objective of bypassing VirusTotal.

Embedded Shellcode Obfuscation (C++)

In this blog entry, I’ll be playing around with obfuscation techniques to bypass antivirus detection for an embedded meterpreter shellcode. The goal is to run shellcode in the local process, and to minimize VirusTotal flags. Techniques will be incrementally applied to the binary to observe progressive success.

Process Injection Techniques (C++)

In this entry, we will dive into Windows process injection techniques demonstrated by malware. Malware authors deploy process injection to run malicious code under another process.

Analyzing FakeSG Malware Campaign Sample (.hta, .ps1)

FakeSG is an ongoing malware campaign (as of 12 Sep 2023). The campaign aims to compromise websites (most commonly WordPress), which then imitate browser update pages - prompting the user to install and execute a malicious file.

EXTREMELY Unsettling Malware (.exe)

Analyzing Wild PowerShell Malware (.ps1, shellcode)