Research group
We reverse malware and game cheats.
We test anti-cheat and anti-reversal tactics on shipping games, and only with the owner's authorization.
Work
What we do
Malware reversal
We take apart samples you send. The note covers the loader and what the payload does on a host. A packer is named only when the binary supports the name.
manual mapping VM-based obfuscationCheat reversal
User mode and kernel. Manual mapping and hypervisor-based hiding are recorded when present.
Anti-cheat assessment
Anti-reversal testing
Engagement support
Scope, written authorization, questions while you fix, then a retest.
Blockchain security
Smart contract review, wallet-drainer and crypto-stealer reversal, and security testing for web3 games. Contracts are tested on forked or local chains.
smart contracts EVM bytecode wallet drainersNotes
Latest research
Mouse, Keyboard, and the Path to WM_INPUT
Inside the Windows input path: RIM read completions, win32k sensor dispatch, mouse coordinate processing, keyboard state, and the two different ways applications consume Raw Input.
From a Window to Scanout: What BitBlt Actually Sees
A screenshot looks like a copy of whatever the GPU is sending to the monitor. Follow the surfaces through DXGI and DWM, and that assumption starts to fall apart.
How "Vigil" Was Built: A Unique Way of Hooking
Vigil watches PEB access without patching the code that reads it. The trick is a guarded fake PEB, a per-thread TEB swap, and a careful exception rearm path.
Tools
Projects
BinDiff
Binary diffing tool that compares two PE files and highlights structural changes in imports, exports, and code sections.
HookCheck
Lightweight hook detection library that compares in-memory code against on-disk PE images to identify inline hooks, IAT redirects, syscall stub tampering, hardware breakpoints, page guard abuse, and EAT modifications. Includes a test harness that installs every hook type and benchmarks detection with rdtsc.
Contact
Send us your build
Email contact@blindage.group. Encrypt with the public key if you can (fingerprint A75A 7DD9 619D 3448 4094 364D 6BEF 661D B07A 47F7).