#reverse-engineering

Back to all writing

  1. After WinTrust, before the JIT: rewriting IL without touching the DLL

    How signature verification made on-disk rewriting impractical and moved the investigation to runtime IL replacement.

    19 min read