https://yenn503.github.io/tags/windows/Recent content in Windows on JYennHugoenWed, 22 Jul 2026 00:00:00 +0000https://yenn503.github.io/posts/sophos-intercept-x-bypass/Wed, 22 Jul 2026 00:00:00 +0000https://yenn503.github.io/posts/sophos-intercept-x-bypass/<h2 id="why-zig">Why Zig</h2> <p>I got bored again. So I started learning Zig syntax and how it could be beneficial when it comes to writing loaders. I just wanted something new to try, and with Zig being early days still I thought why not. There aren&rsquo;t many variations out there currently, so in terms of signatures and pattern detection Zig plays a role here although the underlying behaviour is the same.</p> <p>If you&rsquo;re new to Windows internals there are some amazing resources and tools out there to help, such as SysWhispers which handles all the syscalls and structs for you. But I was taught to use <a href="https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess">MSDN</a> for the Win32 functions and <a href="https://ntdoc.m417z.com/ntopenprocess">NtDoc</a> for the undocumented counterpart. I mention this because it forces you to understand how the structs work and the pointers to such. Both are a goldmine of info :). Also definitely head over to <a href="https://www.youtube.com/@crr0ww">Crr0ww</a>, I can&rsquo;t recommend his videos enough for explaining these topics. Even better, the homies at <a href="https://churchofmalware.org/#about">Church of Malware</a> are always helpful with anything, I can&rsquo;t praise them enough, truly inspiring.</p>