Skip to content
H4vox
0/12

Havox

I break defenses so they come back stronger.

Adversary simulation from the Windows internals up. I build the tooling, run it in authorized labs and purple-team exercises, and hand every gap I find to the people who close it: as a detection, a rule or a fix.

Open the arsenalPlay Breach Run

Real attackers don't send a calendar invite. I emulate them first, so the first time your stack meets the technique is in my lab, not your incident.

Self-taught from Windows internals and malware analysis, then outward into reverse engineering, loader development and EDR research. Offense is the method. Better detection is the deliverable. Everything stays inside authorized scope.

Read the operator file

Now running

All projects

DynLoader

C++ · Windows · loader research

Modular Windows loader for EDR-evasion research. Indirect syscalls (Hell's Gate / Tartarus Gate style variants with multi-stage SSN resolution), manual PE parsing and section mapping, PEB walking, API hashing with dynamic resolution, and fileless HTTP delivery with optional AES. Core logic is modularized for research reuse.

Writing

Notes from the lab, published as I go.

All writing
  1. The Art of Malware ObfuscationSurvey of obfuscation strategies used in modern samples and what actually raises the cost for analysis.malware-techniques
  2. QuickstartEntry point for the malware techniques series: scope, lab setup, and how the notes are structured.malware-techniques · series intro
  3. XOR Malware ExecutionWalkthrough of XOR-based payload staging and execution patterns commonly seen in real samples.malware-techniques
  4. How to Detect XOR ObfuscationDetection-side companion: signal patterns, YARA constructs, and telemetry angles for spotting XOR-obfuscated payloads.detection · YARA
  5. All writingblog.h4vox.site

The story so far

From reading Windows internals to building the tools on both sides.

Take the road
  1. 01Windows internalsFoundations
  2. 02Malware analysisReverse engineering
  3. 03DynLoaderOffensive tooling
  4. 04PlanqX EDREndpoint defense
  5. 05Detection engineeringYARA, YARA-L, KQL
  6. 06Identity and cloudAzure, AD, Atlas CSPM
  7. NowAgentic SOCNow

Two games. One flag.

Run the kill chain in Breach Run, out-think a threat in a Purple Team battle, and hunt the flag that is split across this site in three pieces.

Enter the arcadeOr just say hello