Malware Analysis Space

  Though over a decade old, Uroboros reflects a level of technical mastery and creative mindset that still challenges analysts today     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   By Seeker( 李标明 ) China Independent Malware Analyst & Researcher Download the Full Report (PDF) Prologue: The Temple and the Kerne l Recently, I still climbed a mountain and visited the temple again and again. Here, I keep moving to find more. In fact, to be honest, I’m still facing a lot of unknowns to learn, and that means continuing even when I’m confused or overwhelmed . And I like to do internal observation as my daily habit.   Most call it snake and Uroburos. I notice that Kaspersky used Uroburos or Uroboros in 2014 or 2015, but I like the name "Uroboros." Yeah, they are the same thing.   In this report, the first important thing is to do a simple static analysis and grasp their ...

  Uroboros Revisited: Tracing PatchGuard-Evasive Techniques Beyond SSDT Hooking A status-based anti-analysis case study on NtProtectVirtualMemory interception in x64 Windows       “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   By Seeker( 李标明 ) China Independent Malware Analyst & Researcher Download the Full Report (PDF) Poem: It is one way I talk to myself Paper Boat Recalling my childhood, A small paper boat folded on a rainy day, Sinking as it drifted down the ditch. From the little wooden door, it floated Toward the foot of the mountain. Again and again, I folded those paper boats — Just I and the boat. By Seeker( 李标明 ) , 2025.4.1 Prologue: The Temple and the Kernel Recently, I still climbed a mountain and visited the temple again and again, as you know from my last report, the SSDT hooking report mentioned. Here I keep moving to find more.   ...

    SSDT Hooking: A Personal Walkthrough of Kernel-Mode Intrigue (Uroboros Echoes)     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   By Seeker( 李标明 ) China Independent Malware Analyst & Researcher Download the Full Report (PDF) Prologue: The Temple and the Kernel Recently, I still climbed a mountain and visited the temple again and again, as you know from my last report, the IDT hooking report mentioned. Here I didn’t give up but kept moving to SSDT hooking; everything is very subtle and slow.   After discovering the IDT hooking, I got a bad cold, and I moved more slowly on my own kernel research. I couldn’t even think, and I also did not buy medicine but tried to drink a lot of water. And some stuff about driver knowledge I also need to learn. Sometimes I remembered I strongly felt the energy conversion from one place to another in my body. I felt good when I wok...

  From SSDT to IDT: A Personal Walkthrough of Kernel-Mode Intrigue (Uroboros Echoes)     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   By Seeker( 李标明 ) China Independent Malware Analyst & Researcher Download the Full Report (PDF) Prologue: The Temple and the Kernel Recently, I climbed a mountain and visited the temple before sitting down at my machine. The mountain I walked around and stood at a place to watch the trees, flowers, and feel the air flowing, which, by the way, let me get close to nature to clear my mind. And all the things running in my brain to think of the kernel-mode security, I sucked them and shifted from user mode to kernel mode. What is it? How doesn’t it work? What’s the difference between the user mode and kernel mode? And so on, I strongly felt that everything was moving forward slowly and subtly. It seems that something rebuilt my whole mindset, and it too...