Chad Everdox appreciation post. Nick ‘Everdox’ Peterson (@nickeverdox) is genuinely one of the most underrated reverse engineers and Windows researchers in the industry. A lot of people know Riot Vanguard. Far fewer know the depth of Windows internals, kernel, anti-debugging, hypervisor and reverse engineering work behind one of the engineers who helped build and advance it. His old blog is an absolute gold mine. Some of this research is more than a decade old and still covers concepts people are learning and rediscovering today. Old but gold: Easy anti-trace with SYSCALL: everdox.blogspot.com/2015/05… Debugger detection with GetProcessIoCounters: everdox.blogspot.com/2013/11… BTF + LBR anti-tracing: everdox.blogspot.com/2013/10… Paged virtual memory as an anti-debug / anti-dumping primitive: everdox.blogspot.com/2013/03… Kernel/user shared page kernel-debugger detection: everdox.blogspot.com/2013/07… RTL_USER_PROCESS_PARAMETERS anti-debugging: everdox.blogspot.com/2013/02… Full archive: everdox.blogspot.com/ Then there is InfinityHook, another Everdox contribution that became a reference point for Windows kernel instrumentation: github.com/everdox/InfinityH… And his own article on revers.engineering: PatchGuard: Detection of Hypervisor Based Introspection [P1] revers.engineering/patchguar… If you are interested in reverse engineering, Windows internals, Windows kernel research, anti-debugging, anti-cheat engineering, hypervisor internals or obscure tricks buried deep inside the OS, his work is invaluable. Also bookmark the wider revers.engineering archive: revers.engineering/ That site is multi-author and contains excellent work from @daaximus , @aidankhoury across reverse engineering, kernel internals, virtualization and EPT. People spend a lot of time chasing the newest research. Sometimes the real gold has been sitting online for 10+ years. #ReverseEngineering #WindowsInternals #Infosec