41554 blogs · [ { "id": "01a08720-beec-71d5-a3f7-d970ef875e70", "title": "Static Devirtualization of Tencent VM", "url": "https://aftermathlabs.net/blog/31/07/2026/", "published_at": "2026-07-31T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970ef97961b", "title": "Static Devirtualization of Themida", "url": "https://aftermathlabs.net/blog/09/05/2026/", "published_at": "2026-05-09T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f0286fdb", "title": "Deobfuscation and Analysis of Ring-1.io", "url": "https://aftermathlabs.net/blog/04/02/2026/", "published_at": "2026-02-04T05:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f036ccdf", "title": "Unauthorized Code Execution in FiveM / GTA V (Pwning the Game Client)", "url": "https://aftermathlabs.net/blog/26/09/2022/", "published_at": "2022-09-26T21:32:04+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f07ac465", "title": "AMD-V Hypervisor Development - A Brief Explanation", "url": "https://aftermathlabs.net/blog/04/08/2022/", "published_at": "2022-08-05T02:44:33+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f1627de2", "title": "Theodosius - Jit linker, Symbol Mapper, and Obfuscator", "url": "https://aftermathlabs.net/blog/06/05/2022/", "published_at": "2022-05-07T01:15:47+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f1f9db48", "title": "Writing a Mutation Engine and breaking Aimware", "url": "https://aftermathlabs.net/blog/13/04/2022/", "published_at": "2022-04-14T02:15:07+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f21bb24b", "title": "EZVIZ BD-2402B1 Reverse Engineering and SNES9X Port", "url": "https://aftermathlabs.net/blog/20/01/2022/", "published_at": "2022-01-21T02:54:47+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f2fb2662", "title": "EQU8 - Kernel Component Analysis", "url": "https://aftermathlabs.net/blog/12/08/2021/", "published_at": "2021-08-12T09:57:50+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f31f9964", "title": "EasyAntiCheat Exploit to inject unsigned code into protected processes", "url": "https://aftermathlabs.net/blog/10/08/2021/", "published_at": "2021-08-11T02:44:35+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f3ac58b7", "title": "VMProtect 2 - Part Two, Complete Static Analysis", "url": "https://aftermathlabs.net/blog/21/06/2021/", "published_at": "2021-06-21T23:16:05+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f448896a", "title": "VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture", "url": "https://aftermathlabs.net/blog/17/05/2021/", "published_at": "2021-05-18T04:26:08+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f4ad2adf", "title": "Voyager - A Hyper-V Hacking Framework", "url": "https://aftermathlabs.net/blog/20/04/2021/", "published_at": "2021-04-20T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f4e9ebd9", "title": "Hyperspace - Hidden Address Spaces", "url": "https://aftermathlabs.net/blog/29/03/2021/", "published_at": "2021-03-29T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f53f6917", "title": "Reverse Injector - Merging Address Spaces", "url": "https://aftermathlabs.net/blog/27/03/2021/", "published_at": "2021-03-27T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f616625e", "title": "MSREXEC - Elevate Arbitrary WRMSR to Kernel Execution", "url": "https://aftermathlabs.net/blog/22/03/2021/", "published_at": "2021-03-22T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f61bacf7", "title": "PTM - Page Table Manipulation From Usermode", "url": "https://aftermathlabs.net/blog/01/12/2020/", "published_at": "2020-12-01T05:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f6eaa47b", "title": "VDM - Vulnerable Driver Manipulation", "url": "https://aftermathlabs.net/blog/01/11/2020/", "published_at": "2020-11-01T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f73c0ad9", "title": "PSKP - Process-Context Specific Kernel Patch", "url": "https://aftermathlabs.net/blog/25/08/2020/", "published_at": "2020-08-25T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f811718f", "title": "Virtual Memory - Intro to Paging Tables", "url": "https://aftermathlabs.net/blog/23/08/2020/", "published_at": "2020-08-23T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f8467a99", "title": "Physmeme - Windows Unsigned Kernel Driver Mapper", "url": "https://aftermathlabs.net/blog/19/04/2020/", "published_at": "2020-04-19T04:00:00+00:00" }, { "id": "01a08720-beec-71d5-a3f7-d970f94392da", "title": "AVX", "url": "https://aftermathlabs.net/authors/avx/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970f9dc5d44", "title": "bright", "url": "https://aftermathlabs.net/authors/bright/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970faaacf88", "title": "CompiledCode", "url": "https://aftermathlabs.net/authors/compilecode/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970faf0a782", "title": "Eggsy", "url": "https://aftermathlabs.net/authors/eggsy/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970fbbcdb73", "title": "federico22598", "url": "https://aftermathlabs.net/authors/federico22598/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970fcb96159", "title": "IDontCode", "url": "https://aftermathlabs.net/authors/idontcode/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970fd4bd39f", "title": "medievalghoul", "url": "https://aftermathlabs.net/authors/medievalghoul/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970fd869a3a", "title": "naci", "url": "https://aftermathlabs.net/authors/naci/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970fe6e5bae", "title": "noahware", "url": "https://aftermathlabs.net/authors/noahware/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970ff1503a1", "title": "VollRagm", "url": "https://aftermathlabs.net/authors/vollragm/", "published_at": null }, { "id": "01a08720-beec-71d5-a3f7-d970ffc69f4b", "title": "x86mike", "url": "https://aftermathlabs.net/authors/x86mike/", "published_at": null } ] posts Claim your blog

Back to aftermathlabs.net

Blog · corpus.blog/blogs/aftermathlabs.net/posts

aftermathlabs.net

aftermathlabs.net

2026

Static Devirtualization of Tencent VM original ↗

31 Jul 2026

Static Devirtualization of Themida original ↗

9 May 2026

Deobfuscation and Analysis of Ring-1.io original ↗

4 Feb 2026

2022

Unauthorized Code Execution in FiveM / GTA V (Pwning the Game Client)original ↗

26 Sept 2022

AMD-V Hypervisor Development - A Brief Explanation original ↗

5 Aug 2022

Theodosius - Jit linker, Symbol Mapper, and Obfuscator original ↗

7 May 2022

Writing a Mutation Engine and breaking Aimware original ↗

14 Apr 2022

EZVIZ BD-2402B1 Reverse Engineering and SNES9X Port original ↗

21 Jan 2022

2021

EQU8 - Kernel Component Analysis original ↗

12 Aug 2021

EasyAntiCheat Exploit to inject unsigned code into protected processes original ↗

11 Aug 2021

VMProtect 2 - Part Two, Complete Static Analysis original ↗

21 Jun 2021

VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture original ↗

18 May 2021

Voyager - A Hyper-V Hacking Framework original ↗

20 Apr 2021

Hyperspace - Hidden Address Spaces original ↗

29 Mar 2021

Reverse Injector - Merging Address Spaces original ↗

27 Mar 2021

MSREXEC - Elevate Arbitrary WRMSR to Kernel Execution original ↗

22 Mar 2021

2020

PTM - Page Table Manipulation From Usermode original ↗

1 Dec 2020

VDM - Vulnerable Driver Manipulation original ↗

1 Nov 2020

PSKP - Process-Context Specific Kernel Patch original ↗

25 Aug 2020

Virtual Memory - Intro to Paging Tables original ↗

23 Aug 2020

Physmeme - Windows Unsigned Kernel Driver Mapper original ↗

19 Apr 2020

Undated

AVX original ↗

—

bright original ↗

—

CompiledCode original ↗

—

Eggsy original ↗

—

federico22598 original ↗

—

IDontCode original ↗

—

medievalghoul original ↗

—

naci original ↗

—

noahware original ↗

—

VollRagm original ↗

—

x86mike original ↗

—