June 30, 2026 17 min read
Nirvana v2: Electric Boogaloo
Return-provenance detection for raw and gadgeted direct syscalls, from ProcessInstrumentationCallback kernel handoff to x64 syscall metadata and final C++23 detector.
Tag archive
Everything currently published under the edr tag.
Return-provenance detection for raw and gadgeted direct syscalls, from ProcessInstrumentationCallback kernel handoff to x64 syscall metadata and final C++23 detector.