If you're into malware analysis, Windows internals or reverse engineering, bookmark this. @eversinc33 has built an excellent FREE archive of low-level security research covering: - Windows kernel internals - Driver reverse engineering - VMProtect unpacking - IDA + WinDbg - LLVM-based devirtualization - Symbolic execution - Rootkits + anti-rootkit research - Manual driver mapping + BYOVD - PspCidTable manipulation - Hidden kernel threads - .data pointer hijacking - Kernel keylogging - Windows access tokens + Potato exploits - Syscall trampolines - .NET obfuscation + deobfuscation - GPU malware + OpenCL - Node.js malware tracing - Anti-cheat driver reversing - Prompt malware + agentic AI security - YARA-like detection for malicious prompts Some particularly good rabbit holes include reversing and unpacking a VMProtect-protected anti-cheat kernel driver, building an LLVM devirtualizer, a 3-part anti-anti-rootkit series, GPU-based malware research and the newer NLIR work for hunting malicious prompts. A lot of it includes real code, IDA/WinDbg reversing and PoCs rather than just high-level theory. Start digging: eversinc33.com/ Huge credit to @eversinc33 for keeping all of this research publicly available. #WindowsInternals #ReverseEngineering #MalwareAnalysis