About

Wed, 22 Jul 2026 00:00:00 +0000

Security researcher, malware developer, pentester.

GitHub: Yenn503
LinkedIn: Lewis Desmond
YouTube: @jyenn3740

Projects

Wed, 22 Jul 2026 00:00:00 +0000

Kage

Shellcode loader with per-build XOR encryption, indirect syscalls, direct call injection, and RecycledGate SSN extraction. Written in Zig.

Valak

Evasion DLL for Sliver C2. Reflective loading, ntdll unhooking, RecycledGate syscall resolution, and indirect syscall dispatch. Zig + Go.

Sophos Intercept X: A Technical Bypass

Wed, 22 Jul 2026 00:00:00 +0000

Why Zig

I got bored again. So I started learning Zig syntax and how it could be beneficial when it comes to writing loaders. I just wanted something new to try, and with Zig being early days still I thought why not. There aren’t many variations out there currently, so in terms of signatures and pattern detection Zig plays a role here although the underlying behaviour is the same.

If you’re new to Windows internals there are some amazing resources and tools out there to help, such as SysWhispers which handles all the syscalls and structs for you. But I was taught to use MSDN for the Win32 functions and NtDoc for the undocumented counterpart. I mention this because it forces you to understand how the structs work and the pointers to such. Both are a goldmine of info :). Also definitely head over to Crr0ww, I can’t recommend his videos enough for explaining these topics. Even better, the homies at Church of Malware are always helpful with anything, I can’t praise them enough, truly inspiring.

JYenn

About

Projects

Kage

Valak

Sophos Intercept X: A Technical Bypass

Why Zig