Record · corpus.blog/posts/01a0879c-76f9-700a-924b-0a62cf48cfe6

Gargoyle, a decade later

lospino.so · published 13 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at lospino.so Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 43
Words captured: 5,058

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/JLospinoso/gargoyle

github.com

gargoyle, a memory scanning evasion technique Read at the source ↗

lospino.so

https://github.com/JLospinoso/gargoyle/blob/master/docs/concepts/temporal-memory-state.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/responsible-use.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/architectures/win32-original.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/implementation/build-system.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/implementation/acceptance-harness.md

github.com

https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-setwaitabletimer

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleepex

learn.microsoft.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/concepts/timer-apc-sleepex.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/validation/overview.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/architectures/x64-sibling.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/architectures/arm64-sibling.md

github.com

https://learn.microsoft.com/en-us/windows/arm/arm64ec-abi

learn.microsoft.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/architectures/arm64ec-sibling.md

github.com

https://github.com/WithSecureLabs/dotnet-gargoyle

github.com

https://github.com/waldo-irc/YouMayPasser

github.com

https://github.com/thefLink/DeepSleep

github.com

https://github.com/mgeeky/ShellcodeFluctuation

github.com

https://github.com/Cracked5pider/Ekko

github.com

https://github.com/Idov31/Cronos

github.com

https://www.mdsec.co.uk/2022/07/part-1-how-i-met-your-beacon-overview/

mdsec.co.uk

https://labs.withsecure.com/publications/hunting-for-timer-queue-timers

labs.withsecure.com

https://www.elastic.co/security-labs/hunting-memory

elastic.co

https://volatilityfoundation.org/results-from-the-2018-volatility-contests-are-in/

volatilityfoundation.org

https://github.com/WithSecureLabs/volatility-plugins/blob/master/gargoyle.py

github.com

https://dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-windows_memory_forensics_detecting_unintentionally_hidden_injected_code_by_examining_page_table_entries.pdf

dfrws.org

https://dfrws.org/wp-content/uploads/2020/10/2020_USA_paper-hiding_process_memory_via_anti-forensic_techniques.pdf

dfrws.org

https://i.blackhat.com/Asia-23/AS-23-Uhlmann-You-Can-Run-But-You-Cant-Hide.pdf

i.blackhat.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/research/lineage.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/index.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/quickstart.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/lab-setup.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/validation/limitations.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/architectures/comparison.md

github.com

https://github.com/JLospinoso/gargoyle/blob/master/docs/research/references.md

github.com

https://learn.microsoft.com/en-us/windows/win32/sync/using-a-waitable-timer-with-an-asynchronous-procedure-call

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualprotectex

learn.microsoft.com

C Constructs That Still Don’t Work in C++ — and a Few That Changed Read at the source ↗

lospino.so

The Function Signature Is a Lie Read at the source ↗

lospino.so

C++ Crash Course Read at the source ↗

lospino.so

Common x86 Calling Conventions Read at the source ↗

lospino.so

C Constructs That Don't Work in C++ Read at the source ↗

lospino.so