Understanding how malware is built makes you much better at taking it apart. This section is for that: the techniques, the Windows internals they lean on, and real source to read. Study and lab use - the point is analysis, not deploying anything against anyone.
- Maldev Academy - a structured, modern paid course covering Windows malware development end to end.
coursepaid - Sektor7 Institute - the well-known "Red Team Operator: Malware Development" courses (essentials and intermediate).
coursepaid - Advanced Process Injection Workshop - a hands-on workshop covering modern process-injection techniques.
course - BSides 2024 Malware Development 101 - workshop source for first maldev labs: loader basics, scanning, and payload handling.
courseintro - MalDevWorkshopWebinar - Pavel Yosifovich's webinar demo code for malware-analysis and development basics.
course - Building C2 Implants in C++: A Primer - beginner-oriented GitBook that builds a toy C2 server, implant, tasking loop, and operator client in C++.
working
- cocomelonc - a long, numbered malware-development series that builds each technique from one runnable example. One of the best free walkthroughs going.
tutorialintro - 0xpat - a clear multi-part series on evasion, injection, and persistence, written to be followed in order.
tutorialworking
- ired.team - Mantvydas Baranauskas' offensive-technique notes: injection, evasion, persistence, each with code. The one people keep open in a tab.
reference - MalAPI.io - Windows API functions grouped by malicious use (injection, evasion, spying); fast lookup when you hit an unfamiliar call in a sample.
reference - Windows API Function Cheatsheets - Win32 calls grouped by job (files, processes, memory, threads, DLLs, sockets, registry) with the structs that go with them and the usual injection patterns.
reference - awesome-malware-development - a companion list focused purely on the offensive side.
reference - Pure-Malware-Development - a collection of from-scratch malware-development resources and examples.
reference - The design and implementation of ul_exec - the grugq's userland-exec paper: running an ELF entirely from memory with nothing written to disk.
paperdeep - Unix Viruses - Silvio Cesare's 1998 manual on ELF infection, still the foundation everything later cites.
paperdeep
- MalwareSourceCode - vx-underground's archive of leaked and published malware source across families and eras. Reading real code beats reading about it.
reference - libpeconv - hasherezade's library for loading, dumping, and manipulating PEs in memory; the building block behind a lot of injection and unpacking tooling.
tool
Reference implementations of common offensive techniques - read them to recognise the pattern when it turns up in a real sample.
- ProcessInjectionTechniques - one directory per injection technique with working code, from plain CreateRemoteThread through APC queueing, section mapping, and callback abuse. Read it before the individual PoCs below.
tool - ThreadlessInject - process injection via remote function hooking, without spawning a thread.
tool - ShellcodeFluctuation - flips shellcode memory between RW and RX and encrypts it at rest to dodge memory scanners.
tool - CallStackSpoofer - spoofs the call stack during syscalls to defeat stack-based detection.
tool - EDRSilencer - uses the Windows Filtering Platform to stop EDR agents from reporting home.
tool - EDRception - abuses exception handlers to bypass user-mode EDR hooks.
tool - Chrome App-Bound Encryption Decryption - extracts cookies and passwords past Chromium's App-Bound Encryption; the technique modern stealers use.
tool - transacted_hollowing - hasherezade's hybrid of process hollowing and process doppelgänging using NTFS transactions.
tool - AMSI_VEH - PowerShell AMSI bypass routed through vectored exception handling, without patching AMSI bytes directly.
tool - com-process-inject - COM
IRundown::DoCallbackprocess-injection PoC with the call path laid out in code.tool - LsassHijackingViaReg - Maldev Academy PoC for boot-time LSASS DLL injection through registry hijacking.
tool - DumpBrowserSecrets - browser secret dumper for Chromium and Gecko stores; useful for recognizing stealer collection logic.
tool - EvilLsassTwin - Nim LSASS clone-and-dump project using
NtCreateProcessEx, custom minidumps, and optional process ghosting.tool
- Modern shellcode implant design - how a current-generation position-independent implant is built.
writeupdeep - Linux process injection into sshd - xpn on injecting code into a live Linux process.
writeup - Process creation via NtCreateUserProcess - spawning processes below the documented API.
writeup - DLL injection via CreateRemoteThread - the classic injection primitive, step by step.
writeupintro - Process injection via COM IRundown - MDSec on a COM-based injection route.
writeup - Process injection using Windows thread pools - SafeBreach's Pool Party technique.
writeupdeep - Syscalls via vectored exception handling - indirect syscalls routed through VEH.
writeup - Stealthier LSASS memory dumps - quieter ways to pull credentials from LSASS.
writeup - Win32 reverse-shell shellcode from scratch - a three-part build of Windows shellcode by hand.
writeup - DLL unlinking - hiding a loaded module by unlinking it from the PEB loader lists.
writeup - Perfect DLL hijacking - a reliable DLL-hijacking primitive that doesn't break the target process.
writeupdeep - Process Injection Techniques: Gotta Catch Them All - the Black Hat USA 2019 survey paper cataloguing injection methods.
paperdeep - AtomBombing: a code injection technique - the original writeup of the atom-table injection method.
writeup - Implementing global injection and hooking in Windows - system-wide hooking, done carefully.
writeupdeep - MalDev Myths - pushes back on common loader folklore: PE sections, entropy, API hashing, unhooking, and injection choices.
writeup - Hiding in PlainSight - proxying DLL loads to alter ETWTI stack traces seen by detection tooling.
writeup - Design issues of modern EDRs: bypassing ETW-based solutions - Black Hat Europe writeup on gaps in ETW-backed EDR telemetry and call-stack trust.
writeup - Ghost in the PPL Part 1: BYOVDLL - abuses a Microsoft-signed DLL load path to get code into a protected process light target.
writeup - Ghost in the PPL Part 2: Arbitrary code execution in LSASS - turns the BYOVDLL primitive into LSASS code execution under PPL constraints.
writeup - Ghost in the PPL Part 3: LSASS memory dump - completes the chain with LSASS dumping from inside the protected process.
writeup - What is Loader Lock? - explains why
DllMaincan deadlock and why injected DLLs need to keep loader callbacks boring.writeupintro - Check Your Privilege - shows how ETW's undocumented
SecurityTraceflag can be disabled with admin rights instead of a PPL or kernel driver.writeup - ETW as an IPC mechanism - uses Event Tracing for Windows as an offensive communication channel rather than just telemetry.
writeup - PT_NOTE to PT_LOAD injection in ELF - converting an unused program header into a loadable segment to graft code into an ELF binary.
writeupdeep - SHELF loading - ulexec on fileless ELF loading, the technique later reused in ChromeSHELFLoader.
writeupdeep - Writing my first shellcode - hand-rolling Linux shellcode that runs an iptables rule, register by register.
writeupintro - Shellcode injection - Dhaval Kapil on the classic stack-overflow-to-shellcode path, worked in full.
writeupworking - Shellcode in Rust - Sylvain Kerkour on getting Rust to emit position-independent shellcode.
writeupdeep - An evasive .NET shellcode loader - building a loader and explaining which detections each step is dodging.
writeupdeep - D-TIME - Pavithran and Patnaik split malware across independently scheduled threadless fragments to slip past dynamic analysis.
paperdeep - GPThreats-3: Is Automatic Malware Generation a Threat? - Botacin tests whether an LLM can actually build working malware, and finds it assists rather than authors.
paperdeep
- 0xBoku - offensive development and AV evasion, heavy on hands-on shellcode work.
blog - Will Summerhill - red teaming and malware development.
blog - D3Ext - offensive tooling and malware development.
blog - 4p0cryph0n - malware development and evasion techniques.
blog - 0xflux - Rust malware development and red teaming.
blog - klezVirus - offensive Windows tradecraft and EDR evasion.
blog - ghostbyt3 - malware development and offensive tooling.
blog - TheWover - .NET offensive tooling and shellcode, from the author of Donut.
blogdeep - trickster0 - malware development and EDR evasion.
blog - Print3M's Hub - malware development and low-level Windows security.
blog - passthehashbrowns - malware development and EDR-evasion research.
blog - ry0dan - a hands-on malware-development series.
blog - modexp - odzhan's long-running series on shellcode, code injection, and Windows malware-development technique across architectures.
blogdeep - bitlackeys - Ryan O'Neill (ElfMaster), author of libelfmaster and Learning Linux Binary Analysis; ELF infection, SCOP binaries, and parasite techniques going back to 2007.
blogdeep - n0.lol - netspooky on ELF and PE mangling, polyglots, and the binary-golf research behind tmp.0ut.
blogdeep - hckng - a small collective self-publishing low-level Perl work, including ELF64 virus writing.
blogdeep
Links verified 2026-07-06. Found rot? Open an issue or PR.