Daniel Jary (@JanielDary) header
Daniel Jary (@JanielDary) profile picture

Daniel Jary

@JanielDary

Security researcher

 UK
github.com/JanielDary
Joined August 2021
  • Tweets60
  • Following357
  • Followers138
3Media
Photo by Daniel Jary (@JanielDary)
For anyone that's interested, following my talk 'Immoral Fiber: Unlocking & Discovering New Offensive Capabilities of Fibers' at Black Hat Asia 2024 #BlackHat I have open-sourced my new techniques here: github.com/JanielDary/Immora…
GitHub - JanielDary/ImmoralFiber: Two new offensive techniques using Windows Fibers: PoisonFiber...

GitHub - JanielDary/ImmoralFiber: Two new offensive techniques using Windows Fibers: PoisonFiber...

Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) PhantomThread (An evolved callstack-masking implementati...

github.com
29
1
70
9,321
Daniel Jary retweeted
Rasta Mouse (@_RastaMouse) profile picture
Rasta Mouse@_RastaMouseJun 2
aff-wg.org/2026/06/01/relax-…
Relax and unwind in the Tradecraft Garden

Relax and unwind in the Tradecraft Garden

We’re at the 12th release of Crystal Palace and marking one year in the Tradecraft Garden. This release adds reference relaxation to make global references PIC-friendly. I’ve also added stack unwin…

aff-wg.org
21
1
79
18,383
Daniel Jary retweeted
0xor0ne (@0xor0ne) profile picture
0xor0ne
@0xor0ne25 Jun 2025
PatchGuard internals (KPP, Kernel Patch Protection) r0keb.github.io/posts/PatchG… Credits @r0keb #infosec
Image from 0xor0ne (@0xor0ne)
Image from 0xor0ne (@0xor0ne)
1
57
243
14,780
Daniel Jary retweeted
Smukx.E (@5mukx) profile picture
Smukx.E
@5mukx2 Jul 2025
Tickling VMProtect with LLVM: Part 1 secret.club/2021/09/08/vmpro…
Image from Smukx.E (@5mukx)
Image from Smukx.E (@5mukx)
34
114
8,109
Daniel Jary retweeted
Outflank (@OutflankNL) profile picture
Outflank
@OutflankNL18 Jun 2025
Here's our new blog on hiding your implant in VTL1, where even an EDR's kernel sensor can't see it.🧑‍🦯 Post includes full operational details. Plus our OST offering has been updated with a Cobalt Strike sleep mask exploiting secure enclaves. Full read ➡️ outflank.nl/blog/2025/06/16/…
Secure Enclaves for Offensive Operations (Part II)

Secure Enclaves for Offensive Operations (Part II)

Dig into secure enclave internals and learn about practical techniques used to exploit a read-write primitive in a vulnerable enclave DLL.

outflank.nl
3
82
1
178
15,362
Hypervisors for Memory Introspection and Reverse Engineering by @memn0ps secret.club/2025/06/02/hyper…

Hypervisors for Memory Introspection and Reverse Engineering

Introduction

secret.club
2
123
1
338
36,608
Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code. In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking. Read More : research.checkpoint.com/2025…
Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking - Check Point Research

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking - Check Point Research

Research by: hasherezade Key Points Introduction Process injection is one of the important techniques used by attackers. We can find its variants implemented in almost every malware. It serves...

research.checkpoint.com
2
104
5
260
104,014
Daniel Jary retweeted
T3nb3w (@T3nb3w) profile picture
T3nb3w@T3nb3w2 Mar 2025
🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/r… 💻 Code: github.com/T3nb3w/ComDotNetE…
Abusing IDispatch for Trapped COM Object Access & Injecting into PPL Processes | Red Teaming's Dojo

Abusing IDispatch for Trapped COM Object Access & Injecting into PPL Processes | Red Teaming's Dojo

mohamed-fakroud.gitbook.io
7
164
2
417
52,475
Bypass AMSI in 2025, my newest blog post is published 🥳! A review on what changed over the last years and what's still efficient today. en.r-tec.net/r-tec-blog-bypa…
Image from S3cur3Th1sSh1t (@ShitSecure)
1
276
1
660
36,125
ReSym: Harnessing LLMs to Recover Variable and Data Structure Symbols from Stripped Binaries cs.purdue.edu/homes/lintan/p…
Image from Alex Plaskett (@alexjplaskett)
34
41
2
107
11,955
Daniel Jary retweeted
x86matthew (@x86matthew) profile picture
x86matthew@x86matthew23 Jan 2025
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. elastic.co/security-labs/win… Project: github.com/x86matthew/WinVis…
WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling...

elastic.co
29
337
9
1,261
113,472
Windows Sockets: From Registered I/O to SYSTEM Privileges by Luca Ginex blog.exodusintel.com/2024/12…
Image from Alex Plaskett (@alexjplaskett)
Image from Alex Plaskett (@alexjplaskett)
Image from Alex Plaskett (@alexjplaskett)
Image from Alex Plaskett (@alexjplaskett)
1
31
100
7,290
[BLOG] This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs. rastamouse.me/udrl-sleepmask…
UDRL, SleepMask, and BeaconGate

UDRL, SleepMask, and BeaconGate

I've been looking into Cobalt Strike's UDRL, SleepMask, and BeaconGate features over the last couple of days. It took me some time to understand the relationship between these capabilities, so the...

rastamouse.me
6
102
1
251
25,337
Virus Bulletin (VB) just released my talk & white paper on Shared Object injection & detection on Linux. Pleasure to be invited & attend. Great conference guys! @virusbtn #VB #VirusBulletin #Linux virusbulletin.com/conference… youtube.com/watch?v=x6pHvr9e…
11
26
1,988
Daniel Jary retweeted
Hors (@horsicq) profile picture
Hors
@horsicq11 Nov 2024
obfus.h is the powerfull compile-time obfuscator for C (win32/64). Supports virtualization, anti-debugging, control flow obfuscation and other code mutation techniques to prevent disassembly or decompilation. #CodeSecurity #Obfuscation #infosec github.com/DosX-dev/obfus.h
Image from Hors (@horsicq)
Image from Hors (@horsicq)
Image from Hors (@horsicq)
1
100
2
387
24,354
Daniel Jary retweeted
Zerotistic (@gegrgtezrze) profile picture
Zerotistic@gegrgtezrze12 Nov 2024
Excited to share my latest blog post: "Breaking Control Flow Flattening: A Deep Technical Analysis" I showcase usage of formal proofs and graph theory to automate CFF deobfuscation, among other things ! Might make it a talk...? 👀 zerotistic.blog/posts/cff-re…

Breaking Control Flow Flattening: A Deep Technical Analysis

How a Binary Ninja plugin automatically defeats control flow flattening — dispatcher detection, state variable recovery with Z3, and CFG reconstruction — and the math that makes it work.

zerotistic.blog
4
68
3
227
19,852
Watch the blog for part 2! secret.club/2023/12/24/riscy…

RISC-Y Business: Raging against the reduced machine

Abstract In recent years the interest in obfuscation has increased, mainly because people want to protect their intellectual property. Unfortunately, most of what’s been written is focused on the...

secret.club
Fox-IT (@foxit) profile pictureFox-IT
@foxit25 Sep 2024
Check out our latest blog from our Red Team about EDR evasion through malware virtualisation: blog.fox-it.com/2024/09/25/r…
Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Authors: Boudewijn Meijer && Rick Veldhoven Introduction As defensive security products improve, attackers must refine their craft. Gone are the days of executing malicious binaries from di…

blog.fox-it.com
16
67
7,474
My talk from earlier in the year @BlackHatEvents #BlackHatAsia just got posted. Immoral Fiber: Unlocking & Discovering New Offensive Capabilities of Fibers youtu.be/LdrqX5Nhe94?feature…
1
21
41
4,787
In my new blog for @_CPResearch_ I propose a new injection technique, using the Thread Name API - check it out! 💙
Check Point Research (@_CPResearch_) profile pictureCheck Point Research
@_CPResearch_25 Jul 2024
In this blog we introduce Thread-Name Calling - A new process injection technique using Thread Name. We also discuss various scenarios in which this not widely-known API can be used for offense. research.checkpoint.com/2024…
Thread Name-Calling - using Thread Name for offense - Check Point Research

Thread Name-Calling - using Thread Name for offense - Check Point Research

Research by: hasherezade Highlights: Introduction Process injection is one of the important techniques used by attackers. We can find its variants implemented in almost every malware. It serves...

research.checkpoint.com
19
165
6
627
93,660
At #VB2024 @JanielDary will dig into techniques used to maliciously load Shared Objects & describe ways to detect them. He'll present a tool that identifies SO injection, shellcode injection, process hollowing &entry point manipulation of running processes virusbulletin.com/conference…
Image from Virus Bulletin (@virusbtn)
1
2
1,271
Introducing a new Windows vulnerability class: False File Immutability. 👉 Bonus: a kernel exploit to load unsigned drivers. elastic.co/security-labs/fal…
Introducing a New Vulnerability Class: False File Immutability

Introducing a New Vulnerability Class: False File Immutability

This article introduces a previously-unnamed class of Windows vulnerability that demonstrates the dangers of assumption and describes some unintended security consequences.

elastic.co
10
214
7
547
71,081
Load more