https://halftimeoflife.github.io/en/Recent content in Home on HalfTimeOfLifeHugo -- gohugo.ioenec.charbonnier@gmail.com (Elouan Charbonnier)ec.charbonnier@gmail.com (Elouan Charbonnier)© 2026 Elouan CharbonnierMon, 28 Sep 2026 00:00:00 +0000https://halftimeoflife.github.io/en/posts/09-registry-sensor/Mon, 28 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/09-registry-sensor/Implementing KDAMonitor’s fourth sensor: monitoring the creation, modification, and deletion of registry values.https://halftimeoflife.github.io/en/posts/08-network-sensor/Thu, 24 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/08-network-sensor/Third KDAMonitor sensor: capturing inbound and outbound IPv4 connections.https://halftimeoflife.github.io/en/posts/03-exceptions/Tue, 22 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/03-exceptions/Setting up the AArch64 exception vector table, the synchronous handler, the GIC and the IRQ handler.https://halftimeoflife.github.io/en/posts/07-wfp-session/Mon, 21 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/07-wfp-session/Setting up KDAMonitor’s WFP session (provider, sublayer).https://halftimeoflife.github.io/en/posts/06-image-sensor/Thu, 17 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/06-image-sensor/Implementing KDAMonitor’s second sensor: monitoring image loads.https://halftimeoflife.github.io/en/projects/mirai-arm64-analysis/Tue, 15 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/mirai-arm64-analysis/Static and dynamic analysis of an ARM64 ELF sample from the Mirai/Gafgyt family.https://halftimeoflife.github.io/en/posts/02-boot-uart/Fri, 11 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/02-boot-uart/Set up the linker script, boot code, and the first UART driver.https://halftimeoflife.github.io/en/posts/01-introduction-aarch64-kernel/Tue, 08 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/01-introduction-aarch64-kernel/Introduction to the AArch64 bare-metal kernel project and its goals.https://halftimeoflife.github.io/en/posts/05-process-sensor/Mon, 07 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/05-process-sensor/Implementing KDAMonitor’s first sensor: monitoring process creation and termination.https://halftimeoflife.github.io/en/posts/04-log-writer/Tue, 01 Sep 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/04-log-writer/Writing logs to disk and the first kernel crash of the KDAMonitor driver.https://halftimeoflife.github.io/en/projects/aartch64baremetal/Sun, 23 Aug 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/aartch64baremetal/Minimal bare-metal kernel for AArch64, built from scratch and executed on QEMU’s virt machine.https://halftimeoflife.github.io/en/posts/03-event-queue/Fri, 21 Aug 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/03-event-queue/Building the event queue for the KDAMonitor driver.https://halftimeoflife.github.io/en/posts/02-driver-foundation/Tue, 11 Aug 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/02-driver-foundation/Building the KDAMonitor driver foundation: device object and the first IOCTL communication with a test client.https://halftimeoflife.github.io/en/posts/01-introduction-kdamonitor/Fri, 07 Aug 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/posts/01-introduction-kdamonitor/Introduction to the KDAMonitor project and its goals.https://halftimeoflife.github.io/en/projects/kdamonitor/Fri, 24 Jul 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/kdamonitor/Windows kernel driver for malware analysis, logging process, image load, network, and registry activity in real time.https://halftimeoflife.github.io/en/projects/mispsk/Thu, 16 Jul 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/mispsk/Collection of Python scripts automating operations on MISP instances through PyMISP.https://halftimeoflife.github.io/en/projects/attackmap/Thu, 25 Jun 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/attackmap/CLI tool that generates MITRE ATT&CK heatmaps from ATT&CK Navigator JSON layers.https://halftimeoflife.github.io/en/projects/scowl/Fri, 19 Jun 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/scowl/Discord bot for static file triage and analysis.https://halftimeoflife.github.io/en/projects/ghidramat/Wed, 18 Feb 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/ghidramat/Ghidra script framework for automated static detection of malware behaviors: anti-debug, anti-VM, packing, C2 indicators, process injection, persistence and defense impairment.https://halftimeoflife.github.io/en/projects/malauto/Fri, 02 Jan 2026 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/malauto/WinDbg extension for automated Windows malware analysis. Sets breakpoints, dumps memory regions in PE format and generates structured reports.https://halftimeoflife.github.io/en/publications/anti-emulation-article/Fri, 29 Aug 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/publications/anti-emulation-article/Article explaining the main emulation detection techniques used by Windows malware, along with bypass strategies.https://halftimeoflife.github.io/en/publications/master-thesis-anti-vm/Fri, 22 Aug 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/publications/master-thesis-anti-vm/In-depth research on anti-emulation techniques and their bypass in the context of Time Travel Debugging (TTD) in full system emulation.https://halftimeoflife.github.io/en/projects/wine-apt29/Fri, 18 Jul 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/wine-apt29/Analysis of the WINE malware attributed to APT29 in 2025, including a proof of concept.https://halftimeoflife.github.io/en/projects/panoptiv/Fri, 06 Jun 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/projects/panoptiv/DLL using hooking techniques to bypass anti-VM protections.https://halftimeoflife.github.io/en/publications/anti-vm-youtube/Fri, 28 Mar 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/publications/anti-vm-youtube/Educational video series presenting virtualization detection mechanisms and their implications in malware analysis.https://halftimeoflife.github.io/en/publications/linux-rootkit/Wed, 15 Jan 2025 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/publications/linux-rootkit/Study of the state of Linux rootkits in 2025 through the example of the KoviD rootkit. Analysis of stealth, persistence and kernel security bypass techniques.https://halftimeoflife.github.io/en/publications/pir-paillier/Wed, 15 May 2024 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/publications/pir-paillier/Implementation of a PIR (Private Information Retrieval) protocol in C, based on Paillier homomorphic encryption to enable anonymous database querying.https://halftimeoflife.github.io/en/about/Mon, 01 Jan 0001 00:00:00 +0000ec.charbonnier@gmail.com (Elouan Charbonnier)https://halftimeoflife.github.io/en/about/