Malware Analysis Space

PE-bear: The Art of Intuitive Malware Analysis How Visual Design Turns the ‘First View’ into Actionable Insights for Reverse Engineering     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   Seeker( 李标明 ) · @clibm079     China · Independent Malware Analyst & Researcher  From 2025.11.14 to 2025.11.21 Prologue: document the insights I gained Last time, I published an article titled “Revisiting SubVirt & Blue Pill: From Attacker Proof-of-Concepts to Defensive Foundations.” Somewhere along the way, I noticed my hair turning gray faster than expected—a reminder of the pressure that comes with this path, and something I’ve gradually learned to manage.   In the world of malware research, I sometimes feel like a mountaineer: constantly climbing, constantly adapting, and always facing the next challenging peak. ...

  Revisiting SubVirt & Blue Pill: From Attacker Proof-of-Concepts to Defensive Foundations How early VM-based rootkit research shaped the architecture of modern system defense     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti     Seeker( 李标明 ) · @clibm079     China · Independent Malware Analyst & Researcher  From 2025.10.22 to 2025.10.29 Prologue: Non-VM-Based and VM-Based Rootkits Last time, on 2025.10.14, I published a report about “Regin Static Analysis of Its Lightweight VFS Abstraction Layer” and other rootkit reports the day before, they were old classic or legacy rootkits.   The legacy rootkits were extremely popular; this era is considered to be the golden age of rootkits. For personal record of study, I might define the golden age as something like “Approximately 2005 to 2014 (±1 year).”   So I was very curious about the ...