rajkit @rajkit.bsky.social · 29/09/2026www.youtube.com/watch?v=sLXr...youtube.comInside BOFs, CPLs, and PICs (1/3): How the Loader Prepares and Executes a COFF Object in MemoryYouTube video by JellyBee 000
Reposted by rajkitFallenAngel666 @fallenangelc2.bsky.social · 27/09/2026I integrated LoudSunRun-style stack spoofing into Bahamut so direct API calls and indirect syscalls, which still execute from inside ntdll present a legitimate caller chain. 221
rajkit @rajkit.bsky.social · 27/09/2026youtu.be/Rhm-Q7iBFNM?...youtu.beSwarm Factory, The JellyBee System PIC Crafting Visual EnviromentYouTube video by JellyBee 000
Reposted by rajkitrajkit @rajkit.bsky.social · 23/09/2026Next time, we will discuss the "PILL Paradigm" blog, but first, it is necessary to show how the system works in order to understand its viability. www.youtube.com/watch?v=_1ck...youtube.comJellyBee: The Swarm FactoryYouTube video by JellyBee System 001
rajkit @rajkit.bsky.social · 23/09/2026Next time, we will discuss the "PILL Paradigm" blog, but first, it is necessary to show how the system works in order to understand its viability. www.youtube.com/watch?v=_1ck...youtube.comJellyBee: The Swarm FactoryYouTube video by JellyBee System 001
Reposted by rajkitRaphael Mudge @raphaelmudge.bsky.social · 21/09/2026It's a Mod, Mod, Mod, Mod World aff-wg.org/2026/09/21/i... TCG update: - .spec files are now modules w/ query-able meta-info - Added hexdump and dump to see intermediate outputs - Added encode&mask for content transforms And, a modular demo for encode/mask: tradecraftgarden.org/simpletransf...aff-wg.orgIt’s a Mod, Mod, Mod, Mod Worldn options. 053
rajkit @rajkit.bsky.social · 15/09/2026A serie of videos where going to increase the complexity of the compiled proyect from the simplest to hardest with JBKORE. @raphaelmudge.bsky.social www.youtube.com/watch?v=ibTm...youtube.comJBKORE ::: Example one ::: Simple http-to-stdoutYouTube video by JellyBee System 022
rajkit @rajkit.bsky.social · 13/09/2026buen libro! , aunque solo utilice el primero en su dia , creo que publico otro años despues.. cambia bastante los desplazamientos en kernel, mante la lectura en paralelo con la digital, creo que continuo actualizando la digital hasta hace poco pero la fisica es del 23, ahora mismo no estoy seguro 000
rajkit @rajkit.bsky.social · 13/09/2026no te frustres con esas cosas, no copias a nadie, aprendes y mejoras, solo eso.. miralo desde otro punto de vista.. lamborghini no copio a ferrari, desarrollo una ingeniería fascinante diferente partiendo de su conocimiento fabricando tractores, ambos copiaron al que creo el primer coche ? 🤷♂️ 000
rajkit @rajkit.bsky.social · 13/09/2026me ayudaron entonces y actualmente cada vez mas debido a toda la cantidad de información que existe es vital poder tener una base rigurosa donde verificarlo en mente o en el libro. es posible que ya los conozcas pero si necesitas puedo postearte mis favoritos! 000
rajkit @rajkit.bsky.social · 13/09/2026libros como windows internals 7th(pavel), evading edr, cualquier publicacion de Ricardo Narvaja, videos y libros de pavel yosifovich, connor mcgarr blogs y cualquier link que este en aff-wg . Todo eso me ayuda mucho actualmente a discernir. El objetivo es saber mas que ayer y menos que mañana! 🥷✌️ 210
rajkit @rajkit.bsky.social · 13/09/2026la evasión real moderna a dado un salto muy grande, no te rayes de momento, disfruta de todo el camino, lo importante es asentar bien la base , arquitectura, proveedores de windows de los que se alimentan los sensores, es maravilloso por que es tan amplio que nunca dejamos de aprender. 000
rajkit @rajkit.bsky.social · 13/09/2026es una buena ocasión para que pruebes el agente... solo digo eso (es broma) jeje 🧑🏫 atope! trata de ir introduciendote en el análisis de eventos, telemetrías, kernel callbacks y posterior correlación de los mismos, de esa forma iras observando por que cadena de eventos fue o no detectado. saludos ✌️ 000
rajkit @rajkit.bsky.social · 12/09/2026i make some demos months ago, but with not easy work with gcc linker, and my next pointview would be try with CPL , because if my calcs dont fail we can have fluid module dev and swap with the implant. By the concept PILL (position indpendent linking layer) 100
rajkit @rajkit.bsky.social · 12/09/2026..are separate in a "pinit" aspect so we can link in memory (just patch), CPL it would be perfect to generate this abstract layer to send to the modular implant, just link layer + capability the pinit cap its already in memory data. Not a easy scenario for memory scanners. 000
rajkit @rajkit.bsky.social · 12/09/2026ye sorry not enought words to explain well, maybe gona make a video, in jbsystem de jbkore works graphically and show after compiling the map of coff subsections , so we can create others or reorder a group in a aspect,the goal is this ones are PIC becaouse de ABI+STACKALIGN 000
rajkit @rajkit.bsky.social · 12/09/2026So, my question is: does CPL have the option to show a roller output for constructing the matrix bonding layer? 100
rajkit @rajkit.bsky.social · 12/09/2026clean .text$ COFF subsections grouped to Aspect like resolverLocal() -> .text$.. + .text$... , the aspect is PIC but unlinked localy so CPL could output a linkage layer to link in memory, mathematically its posible 000
rajkit @rajkit.bsky.social · 12/09/2026position indepent unlinked interchangable in-memory aspects ?? compile with JBKORE (clean .text output)+ LINK with CPL so.. whole trazability. CPL generare linklayer+ JBKORE gen aspect =PILL (arrives to host, loader path reels of the independt aspect to the caller) 100
rajkit @rajkit.bsky.social · 10/09/2026I’m now compiling fairly large projects into a completely clean section, and I feel like I should have been writing some of the blog posts alongside the development process. There are so many parts I’d like to go into in detail that I don’t even know where to start. 000
rajkit @rajkit.bsky.social · 10/09/2026I honestly couldn’t have read a better comment. Especially because there were moments when I actually started to hate memory accesses and all the work that went into optimizing them — just kidding. also forwadin and API Set resolver also turned out to be absolutely key.. 010
rajkit @rajkit.bsky.social · 09/09/2026I developed my system to deeper into shellcode PIC capabilities and to share it in morder to find others with similar interests in shellcode and to evolve those techniques.. I can't even recall exactly when I finished the first functional plugin 100
rajkit @rajkit.bsky.social · 09/09/2026Basically, everything I know is thanks to brilliant people like you sharing their knowledge over the years. I didn't quite catch the point you were making in the last video which was very interesting, by the way-nor did I know that this was already being used or for how long. 000
rajkit @rajkit.bsky.social · 09/09/2026🤯🤯 www.linkedin.com/posts/ramon-...linkedin.com#pic #rajpilator #jellybee | Ramon Gonzalez GaztelupeProvides rapid transformation, compilation, and execution of native C into #PIC (Position Independent Code), with integrated #Rajpilator in the #JellyBee Control Center, enabling basic SYSTEM-level ex... 000
rajkit @rajkit.bsky.social · 09/09/2026The previous one does focus exclusively on JBKORE and GCC, where I try to summarize some of the most important stages of the compilation process and explain how plugin works with them. kdrajkit.github.io/blogs/jellyb...kdrajkit.github.ioRewiring the GCC Compilation Lifecycle for Position-Independent ModularityJellyBee System Internals · Compiler · Part One: GCC, JBIR, Matrix, the x64 ABI, and COFF verification for PIC modularity. 100
rajkit @rajkit.bsky.social · 09/09/2026Yes 🤦🏽♂️, to be fair, it’s been more difficult than I expected to keep a coherent narrative flow across the blog posts... 000
rajkit @rajkit.bsky.social · 09/09/2026kdrajkit.github.io/blogs/jellyb... @raphaelmudge.bsky.socialkdrajkit.github.ioBOF, Crystal Palace and the JellyBeeKORE compilerBOF, Crystal Palace and JBKORE within a modular architecture for compilation, loading and in-memory execution. 100
rajkit @rajkit.bsky.social · 01/09/2026🐝 🪼 Analyzing the Pe-Sieve scan of the implant, I am working on every detail. I am also getting good results from the SIEM in an environment with ElasticEDR. Long live for the position independent shellcode modules system!!! 000
rajkit @rajkit.bsky.social · 27/08/2026🥷🏿 🧪 Been a while since I came across a reversing find this hard. Thanks for share reversing job!! research.checkpoint.com/2026/btr-ref...research.checkpoint.comBTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check Point ResearchResearch by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver c... 000
rajkit @rajkit.bsky.social · 26/08/2026I think back then I was still trying to create my first ROP to run Metasploit generated shellcode on the stack. Thanks to everyone who shared their knowledge and tools! 010
rajkit @rajkit.bsky.social · 24/08/2026www.linkedin.com/posts/ramon-...linkedin.com#pic #resetnightmare #edr #telemetry #microsoft #lsass #windows #kernel #debugging #lsass #pic #edr | Ramon Gonzalez Gaztelupe🐝 🪼 I used my JBKORE compiler to generate a pure #PIC version of #ResetNightmare and test its execution in an environment protected by Elastic #EDR. The goal is to analyze the #telemetry generated ... 000
rajkit @rajkit.bsky.social · 24/08/2026x.com/NtRajkit/sta...x.comnt!RajKit (@NtRajkit) on Xhttps://t.co/LW3sJjhL58 010
rajkit @rajkit.bsky.social · 21/08/2026www.linkedin.com/posts/ramon-...linkedin.com🐝 🪼 💊 Let’s dance across the whole Jellybee research system for advanced Red Team operations, powered by what may be the first truly position-independent artifact… | Ramon Gonzalez Gaztelupe🐝 🪼 💊 Let’s dance across the whole Jellybee research system for advanced Red Team operations, powered by what may be the first truly position-independent artifact compiler. https://lnkd.in/eZ4yKs5Q 000
rajkit @rajkit.bsky.social · 19/08/2026github.com/kdRajKit/Res...github.comGitHub - kdRajKit/ResetNightmare-C-code-POCContribute to kdRajKit/ResetNightmare-C-code-POC development by creating an account on GitHub. 010
Reposted by rajkit5pider @5pider.net · 06/07/2026I released another video demonstration about the stack spoofing capabilities and especially CET compliance and being able to migrate into an CET enabled process such as Microsoft Edge and retrieving the passwords and cookies database via the cookie-monster BOF www.youtube.com/watch?v=hQqI...youtube.comHavoc Professional 0.7 - CET Compliant Stack Spoofing and Browser Cookie DumpingYouTube video by 5pider 272
Reposted by rajkitRaphael Mudge @raphaelmudge.bsky.social · 16/07/2026LSH delish aff-wg.org/2026/07/16/l... Another CPL and TCG update: Specify language-specific exception handlers in +unwind, user-defined intrinsics, and callnear to make before/after more useful.aff-wg.orgLSH delishAnother Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn’… 155
rajkit @rajkit.bsky.social · 06/08/2026kdrajkit.github.io/blogs/jellyb...kdrajkit.github.ioRewiring the GCC Compilation Lifecycle for Position-Independent ModularityJellyBee System Internals · Compiler · Part One: GCC, JBIR, Matrix, the x64 ABI, and COFF verification for PIC modularity. 030
