header class="hero"> NON-COMMERCIAL CYBERSECURITY RESEARCH LABORATORY

Analyzing Frontiers in Runtime Integrity

An independent development collective conducting proactive reverse engineering, kernel-level defense benchmarking, and open-source heuristic anti-cheat framework architectures.

Active Core Research

Dynamic Binary Instrumentation

Building specialized engines to trace thread execution contexts and baseline anomalous user-to-kernel mode switches driven by clandestine injection payloads.

C++20 Asm DBI

Heuristic Memory Analysis

Designing custom memory-scanning heuristics optimized for tracking real-time API hooking (IAT/EAT tampering) without imposing significant processing bottlenecks.

Heuristics Win32 API Memory

Anti-Debugging & Obfuscation

Evaluating state-of-the-art multi-layered code virtualization techniques and dynamic memory integrity checks to establish highly resilient application barriers.

Obfuscation Anti-RE PE Format

Open-Source Tooling

nullptr-trace-cli

A lightweight CLI wrapper utilizing native Windows debugging APIs to detect hidden DLL sideloading anomalies inside untrusted user-mode application runtimes.

MIT License

hook-detector-sdk

An easily shiftable C-style library crafted explicitly for indie development setups to dynamically audit critical memory page tables and trap inline hooks.

Apache 2.0

Defensive Intelligence & Advisories

Internal patch documentations and security review evaluations for proprietary sandboxed modules.

Mitigation of Arbitrary Thread Injection via Thread Context Hijacking

Status: Fixed / Published Framework Patch

NP-ADV-2026-01

Remediation of Kernel-to-User Mode Callback Table Hooking Deficiencies

Status: Validated / Reference Implementation Available

NP-ADV-2026-02

2026 Research Roadmap

Q1 - Q2 2026

Heuristic Hook Engine Finalization

Deploying the initial draft of our open-source user-mode inline verification kit. Integrating Claude Code into the daily workflow for static AST validation.

Q3 - Q4 2026

Kernel-Space Shield Evaluation

Expanding defensive telemetry architectures into driver spaces (x64 Windows Kernels) to proactively isolate DKOM tampering attempts.