Technical publications on distributed C2 architecture, memory evasion, and hardware telemetry.https://yigitaydemir.com/en-ushttps://yigitaydemir.com/blog/call-stack-spoofing-pdata-unwindinghttps://yigitaydemir.com/blog/call-stack-spoofing-pdata-unwindingEvery syscall from my last article left one artifact an investigator could still trust: the call stack. So I taught it to lie — parsing KernelBase.dll's .pdata unwind metadata to find a jmp gadget whose stack frame I could forge, and letting x64dbg's own unwinder prove the fake is seamless.Fri, 30 Oct 2026 00:00:00 GMThttps://yigitaydemir.com/blog/edr-hooks-halos-gate-indirect-syscallshttps://yigitaydemir.com/blog/edr-hooks-halos-gate-indirect-syscallsI overwrote the first five bytes of NtAllocateVirtualMemory in my own process — exactly what an EDR does — then recovered the destroyed syscall number from a neighboring stub and called the kernel anyway. Direct syscalls, indirect syscalls, and the return address that betrays the difference.Wed, 28 Oct 2026 00:00:00 GMThttps://yigitaydemir.com/blog/from-syscall-to-reflective-loaderhttps://yigitaydemir.com/blog/from-syscall-to-reflective-loaderHow I rebuilt what ntdll's loader does by hand: walking the PEB, parsing the PE format without headers, and writing a reflective loader that maps a DLL into memory without touching a single loader API — a module the OS can't see.Fri, 23 Oct 2026 00:00:00 GMThttps://lnkd.in/p/dgKvw5Mthttps://lnkd.in/p/dgKvw5MtLilyGO T-SIM7600G-H modülünde FB2 ferrite bead hatasının tespiti ve sökülmesi: bekleme akımının 22-30 mA'den 7.7 mA ve 0.5 mA seviyelerine düşürülmesi, 990 uyanışlık deşarj eğrisi analizi.Tue, 01 Sep 2026 00:00:00 GMThttps://medium.com/@st4inl3s5/s%C4%B1f%C4%B1rdan-c2-framework%C3%BC-i%CC%87n%C5%9Fa-etmek-mimariye-derinlemesine-bak%C4%B1%C5%9F-107d1be27ad3https://medium.com/@st4inl3s5/s%C4%B1f%C4%B1rdan-c2-framework%C3%BC-i%CC%87n%C5%9Fa-etmek-mimariye-derinlemesine-bak%C4%B1%C5%9F-107d1be27ad381.727 satır C++17, Go, Kotlin ve TypeScript ile sıfırdan geliştirilen telekinetiC2 frameworkünün mimarisi, decoupled dinleyici topolojisi ve bayt seviyesinde protokol kararları.Mon, 11 May 2026 00:00:00 GMThttps://lnkd.in/p/dwTPDFJYhttps://lnkd.in/p/dwTPDFJY100'den fazla kurumda kullanılan kurumsal yönetim yazılımında keşfedilen kritik SQL Injection zafiyeti, USOM koordinasyonunda sorumlu bildirim ve tescil süreci.Sun, 15 Feb 2026 00:00:00 GMThttps://medium.com/@st4inl3s5/thm-el-bandito-cozumu-writeup-61cd43db18e6https://medium.com/@st4inl3s5/thm-el-bandito-cozumu-writeup-61cd43db18e6HTTP İstek Kaçakçılığı zaafiyetleriyle ilgili bir CTF çözümüyle beraberiz. 1-) Recon&Enumeration(Keşif&Enumerasyon) Makine Adı: El Bandito Makine Açıklaması: Can you help capture El...Sun, 07 Dec 2025 00:10:58 GMThttps://medium.com/@st4inl3s5/thm-whats-your-name-cozumu-writeup-447a5ceebd6dhttps://medium.com/@st4inl3s5/thm-whats-your-name-cozumu-writeup-447a5ceebd6dClient-Side zaafiyetleriyle ilgili bir CTF çözümüyle birlikteyiz. 1-) Recon&Enumeration(Keşif&Enumerasyon) Makine Adı: Whats Your Name? Açıklama: Utilise your client-side exploitation...Mon, 24 Nov 2025 20:34:57 GMThttps://medium.com/@st4inl3s5/thm-include-cozumu-writeup-d7a87fe042d4https://medium.com/@st4inl3s5/thm-include-cozumu-writeup-d7a87fe042d4Vize haftası bitti, düzenimize geri döndük. CTF’lerle devam edeceğiz. 1-) Recon(Keşif) Makine Adı: Include Açıklama: Use your server exploitation skills to take control of a web app. Task...Tue, 18 Nov 2025 23:24:49 GMThttps://medium.com/@st4inl3s5/thm-injectics-cozumu-writeup-e43def36e157https://medium.com/@st4inl3s5/thm-injectics-cozumu-writeup-e43def36e1571-) Recon(Keşif) Makine Adı: Injectics Açıklama: Use your injection skills to take control of a web app. (Enjeksiyon açıklarıyla ilgili bir oda) Açıklama 2: Can you utilise your web...Mon, 27 Oct 2025 21:38:27 GMThttps://medium.com/@st4inl3s5/thm-hammer-cozumu-walkthrough-8b708c8534fdhttps://medium.com/@st4inl3s5/thm-hammer-cozumu-walkthrough-8b708c8534fd1-) Recon(Keşif) 1337:HTTP ve 22:SSH portları açık. Herhangi bir versiyon açığı vs. yok. HTTP’yi keşfetmeye başlıyorum. Giriş sayfasında bir not: Buradan dizin adlandırmasının hmr_DIZIN...Mon, 20 Oct 2025 21:55:50 GMThttps://medium.com/@st4inl3s5/tryhackme-valley-%C3%A7%C3%B6z%C3%BCm%C3%BC-writeup-d6eaaaaf10eahttps://medium.com/@st4inl3s5/tryhackme-valley-%C3%A7%C3%B6z%C3%BCm%C3%BC-writeup-d6eaaaaf10eaTryHackMe 1-) Keşif (Recon) Nmap port taraması ile başlıyorum. Çıktı : PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) |...Mon, 25 Mar 2024 21:02:35 GMT