# patchi/fyi

> Offensive security, anti-cheat internals, game hacking, and Windows kernel programming. LLM-generated posts from real code, reviewed by a human.

Prefer markdown: send `Accept: text/markdown` or fetch the `.md` twin of any page. Content Signals: search=yes, ai-input=yes, ai-train=yes.

## Site

- [Home](https://patchi.fyi/): Post index
- [Home (markdown)](https://patchi.fyi/index.md): Markdown post index
- [About](https://patchi.fyi/about): How this blog works
- [About (markdown)](https://patchi.fyi/about.md): About page as markdown
- [Sitemap](https://patchi.fyi/sitemap-index.xml): Full URL list
- [Agent skills](https://patchi.fyi/.well-known/agent-skills/index.json): Skills discovery index

## Posts

- [Game vs Sensor: Dual Inject DLLs in Peregrine](https://patchi.fyi/blog/peregrine-multi-dll-game-sensor): How Peregrine split its single monitoring DLL into Game and Sensor roles: separate build outputs, dual kernel inject profiles, auto-protect only on Game inject, and why cheats should not get the same DLL as the protected process.
  - Markdown: https://patchi.fyi/blog/peregrine-multi-dll-game-sensor.md
- [Reflective Loading in Kassandra: BOF and .NET Without Subprocess Workers](https://patchi.fyi/blog/kassandra-reflective-loading): How Kassandra replaced the BOF/.NET subprocess model with staged loader DLLs, XOR-encrypted in-memory cache, a custom PE reflective mapper using CallGhost syscalls, and mem wipe after execution. Python still uses an isolated worker.
  - Markdown: https://patchi.fyi/blog/kassandra-reflective-loading.md
- [BusyWork in Kassandra: Sleep Replacement Without Starving the C2 Loop](https://patchi.fyi/blog/kassandra-busywork-integration): How Kassandra wires the BusyWork crate into its Mythic agent: startup_delay before first check-in, idle between tasking rounds, light churn at feature boundaries, and a hard rule that the HTTP transport path never runs BusyWork.
  - Markdown: https://patchi.fyi/blog/kassandra-busywork-integration.md
- [BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection](https://patchi.fyi/blog/busywork-sleep-replacement): A Rust library that replaces sleep() calls with randomized, genuine work across seven categories: compute, memory, filesystem, registry, Windows API, network, and cryptography. Each invocation executes a different code path with jittered parameters to defeat pattern matching by EDR and anti-cheat systems.
  - Markdown: https://patchi.fyi/blog/busywork-sleep-replacement.md
- [CallGhost: Direct Syscalls from Rust with Four Bypass Methods](https://patchi.fyi/blog/callghost-direct-syscalls): A Rust framework that issues Windows syscalls without touching ntdll stubs, using a proc macro that generates inline assembly at compile time. Supports direct execution, indirect gadget routing, permanent unhooking, and Perun's Fart, all resolved via Halo's Gate at runtime.
  - Markdown: https://patchi.fyi/blog/callghost-direct-syscalls.md
- [MetaTwin Cloning: Duplicating PE Identity onto Proxy DLLs](https://patchi.fyi/blog/dll-proxy-metatwin-cloning): How DLLProxyFramework automatically extracts version info and Authenticode signatures from a source DLL and transplants them onto the generated proxy, making the two visually identical in file properties and signature viewers.
  - Markdown: https://patchi.fyi/blog/dll-proxy-metatwin-cloning.md
- [Call Stack Validation: Detecting API Calls from Unbacked Memory](https://patchi.fyi/blog/peregrine-callstack-validation): How Peregrine's injected DLL validates call stacks on hooked APIs, flagging return addresses that point into unbacked executable memory as indicators of injection or spoofing.
  - Markdown: https://patchi.fyi/blog/peregrine-callstack-validation.md
- [Detecting FakeVEH: Hardware Breakpoints on the VEH Handler List](https://patchi.fyi/blog/peregrine-fakeveh-detection): How Peregrine uses a CPU debug register watchpoint on ntdll's VEH handler list to detect VEH-based cheat injection in real time, with a watchdog thread and NtSetContextThread hook to resist tampering.
  - Markdown: https://patchi.fyi/blog/peregrine-fakeveh-detection.md
- [YARA in Memory: Signature Scanning with yara-x for Cheat Detection](https://patchi.fyi/blog/peregrine-yara-memory-scanning): How Peregrine uses the YARA-X engine to scan process memory region by region, matching cheat signatures with the same rule language used in malware analysis.
  - Markdown: https://patchi.fyi/blog/peregrine-yara-memory-scanning.md
- [Carrot: Unhookable Memory Access on macOS via Raw Mach Traps](https://patchi.fyi/blog/carrot-cheat): A macOS ARM64 game cheating framework that bypasses userland hooks by issuing raw SVC instructions, resolving trap numbers at runtime, and hand-crafting MIG messages through mach_msg2_trap.
  - Markdown: https://patchi.fyi/blog/carrot-cheat.md
- [VAD Scanning: Detecting Manually Mapped DLLs from Kernel Mode](https://patchi.fyi/blog/peregrine-vad-scanning): How Peregrine walks the Virtual Address Descriptor tree from its kernel driver to find executable private memory regions that indicate manually mapped cheat DLLs.
  - Markdown: https://patchi.fyi/blog/peregrine-vad-scanning.md
- [HWID Fingerprinting: Hybrid Hardware Identification from Userland and Kernel](https://patchi.fyi/blog/peregrine-hwid-fingerprinting): How Peregrine collects hardware identifiers from both Rust userland and the kernel driver to build a machine fingerprint for ban enforcement.
  - Markdown: https://patchi.fyi/blog/peregrine-hwid-fingerprinting.md
- [DLL Proxy Loading: Hijacking Legitimate DLLs for Code Execution](https://patchi.fyi/blog/dll-proxy-framework): A code generation framework that analyzes PE export tables, produces assembly trampolines for every export, and outputs ready-to-compile proxy DLL projects for DLL sideloading and hijacking research.
  - Markdown: https://patchi.fyi/blog/dll-proxy-framework.md
- [Scanning the Kernel: Drivers, Callbacks, and System Integrity](https://patchi.fyi/blog/peregrine-kernel-scanning): Enumerating loaded drivers against a blacklist, scanning ObCallback registrations, and checking system integrity from Ring-0.
  - Markdown: https://patchi.fyi/blog/peregrine-kernel-scanning.md
- [A Minifilter for Self-Defense](https://patchi.fyi/blog/peregrine-minifilter-self-defense): Using a Windows minifilter driver to protect anti-cheat files from tampering. Covers write, delete, and rename interception with rate-limiting.
  - Markdown: https://patchi.fyi/blog/peregrine-minifilter-self-defense.md
- [PPL Bootstrap and ETW Threat Intelligence](https://patchi.fyi/blog/peregrine-ppl-etw-threat-intelligence): Elevating to Protected Process Light via kernel EPROCESS manipulation, then consuming ETW Threat Intelligence events for remote operation monitoring.
  - Markdown: https://patchi.fyi/blog/peregrine-ppl-etw-threat-intelligence.md
- [AutoExIf: Automated OSINT Metadata Extraction from Websites](https://patchi.fyi/blog/autoexif-metadata-stripping): A Python CLI tool that crawls websites, runs DuckDuckGo dorks, or processes URL lists to download every document and image, then extracts all EXIF and file metadata using exiftool. Surfaces authors, software, GPS coordinates, and more.
  - Markdown: https://patchi.fyi/blog/autoexif-metadata-stripping.md
- [Threads Outside the Map: Shellcode Detection](https://patchi.fyi/blog/peregrine-shellcode-thread-analysis): Enumerating process threads and checking whether their instruction pointer and start address fall within known module ranges. Threads outside the map are shellcode.
  - Markdown: https://patchi.fyi/blog/peregrine-shellcode-thread-analysis.md
- [Finding the Hooks: IAT and EAT Scanning](https://patchi.fyi/blog/peregrine-iat-eat-scanning): Traversing a PE's Import Address Table and Export Address Table to detect function pointer redirections outside known module ranges.
  - Markdown: https://patchi.fyi/blog/peregrine-iat-eat-scanning.md
- [Relocation-Aware Hashing: Detecting Code Patches](https://patchi.fyi/blog/peregrine-relocation-aware-hashing): Comparing a module's .text section on disk versus in memory with SHA-256, accounting for relocations to avoid false positives.
  - Markdown: https://patchi.fyi/blog/peregrine-relocation-aware-hashing.md
- [Hooking the Cheat: MinHook API Interception](https://patchi.fyi/blog/peregrine-minhook-api-interception): Inside Peregrine's injected DLL: inline hooking of ReadProcessMemory, WriteProcessMemory, and friends via MinHook, with IPC event reporting.
  - Markdown: https://patchi.fyi/blog/peregrine-minhook-api-interception.md
- [Injecting from Ring-0: Kernel APC DLL Injection](https://patchi.fyi/blog/peregrine-kernel-apc-injection): How Peregrine's kernel driver autonomously injects a monitoring DLL into target processes using kernel APCs, timed at kernel32.dll load.
  - Markdown: https://patchi.fyi/blog/peregrine-kernel-apc-injection.md
- [ObCallbacks: Stripping Dangerous Handles](https://patchi.fyi/blog/peregrine-obcallbacks): How Peregrine's kernel driver uses ObRegisterCallbacks to intercept and neuter process handle requests with dangerous access flags.
  - Markdown: https://patchi.fyi/blog/peregrine-obcallbacks.md
- [The Anatomy of an Anti-Cheat](https://patchi.fyi/blog/peregrine-anatomy-of-an-anticheat): A walkthrough of Peregrine's three-layer architecture: kernel driver, injected DLL, and Tauri GUI, and how they communicate.
  - Markdown: https://patchi.fyi/blog/peregrine-anatomy-of-an-anticheat.md
- [Process Hardening: PPID Spoofing, Self-Protection, and Self-Deletion](https://patchi.fyi/blog/kassandra-process-hardening): How Kassandra clones itself with a spoofed parent PID via NtQuerySystemInformation, restricts process access with SDDL security descriptors, and deletes its own binary from disk.
  - Markdown: https://patchi.fyi/blog/kassandra-process-hardening.md
- [In-Memory Execution: BOF Loading, .NET Assemblies, and Python in a C2 Agent](https://patchi.fyi/blog/kassandra-in-memory-execution): How Kassandra executes COFF Beacon Object Files, .NET assemblies, and Python scripts in isolated subprocesses with crash-safe stdin/stdout IPC.
  - Markdown: https://patchi.fyi/blog/kassandra-in-memory-execution.md
- [Medusa: A Rust Kernel Driver for Cross-Process Memory Access](https://patchi.fyi/blog/medusa-kernel-memory-driver): A proof-of-concept Windows kernel driver written in Rust that enables arbitrary read/write access to any process memory via MmCopyVirtualMemory.
  - Markdown: https://patchi.fyi/blog/medusa-kernel-memory-driver.md
- [S3 as a C2 Channel: AWS SigV4 Signing and Encrypted Key Exchange](https://patchi.fyi/blog/kassandra-s3-transport): How Kassandra uses S3 object storage as a covert C2 transport, implementing AWS SigV4 request signing from scratch and bootstrapping per-execution IAM credentials.
  - Markdown: https://patchi.fyi/blog/kassandra-s3-transport.md
- [Hell's Hall: Indirect Syscall Resolution in Rust](https://patchi.fyi/blog/kassandra-hells-hall-syscalls): How Kassandra resolves NT syscall numbers and instruction addresses from ntdll at runtime, detecting EDR hooks and extracting SSNs from neighboring functions.
  - Markdown: https://patchi.fyi/blog/kassandra-hells-hall-syscalls.md
- [Kassandra: Anatomy of a Rust C2 Agent](https://patchi.fyi/blog/kassandra-architecture-overview): An architecture walkthrough of Kassandra, a Mythic C2 agent written in Rust with three transport mechanisms, subprocess isolation, and 22 commands.
  - Markdown: https://patchi.fyi/blog/kassandra-architecture-overview.md
- [CSGOCheatBase: Anatomy of an Internal Cheat](https://patchi.fyi/blog/csgo-cheatbase-internal-cheat): A walkthrough of a game cheat base written in C++, covering DLL injection, handle hijacking via NtQuerySystemInformation, native API memory manipulation, and ImGui overlay rendering with DirectX 11.
  - Markdown: https://patchi.fyi/blog/csgo-cheatbase-internal-cheat.md