#windows
2 posts
Red Team
RegisterXLL: Testing Excel's XLL Security Boundary
How Excel's RegisterXLL automation method loads native add-in code through a path that did not enforce the MOTW and extension checks observed in the interactive UI.
Red Team
VibeLoader: Loading for Fun and No Profit
An implementation-focused walkthrough of VibeLoader's APC, fiber, module-stomping, payload-encoding, and memory-management experiments.