Detouring Yourself Into a Ban: Reverse-Engineering AMD Anti-Lag+
A symbol-level teardown of the Adrenalin 23.10.1 feature that got Counter-Strike 2 players VAC-banned - what it hooked, how it hooked it, and the single byte that turned it off.
posts
AMD Anti-Lag+ vs VAC 4 parts
The Engine Room: AMD's Detours-Based Hook Library (amdihk64)
Part 2 of the Anti-Lag+ teardown. A deep dive into amdihk64 - a Microsoft Detours-based inline-hook engine that ships in the same driver package and also hooks raw input. It's a sibling to the Delag detour from Part 1; I couldn't prove it's on the Anti-Lag+ path itself, and I say so.
The Control Plane: How One Byte in a Profile Blob Disabled Anti-Lag+
Part 3 of the Anti-Lag+ teardown. The hook lived in code - but the on/off switch was data. Reverse-engineering AMD's per-game application-profile database (atiapfxx.blb / the BWJE format) and the single byte that turned the feature off.
Indistinguishable: What VAC Checks For, and Why Anti-Lag+ Never Stood a Chance
Finale of the Anti-Lag+ teardown. We mapped the feature byte-for-byte; now we line it up against what Valve Anti-Cheat is publicly known to look for. Every single signal a cheat trips, Anti-Lag+ tripped too - because at the instruction level they were the same thing.
BlackBerry Bold 9780 1 part
Sorting Yourself Into a Use-After-Free: a Forever-Day in the BlackBerry Bold 9780's 2010 WebKit
It is 2026 and this is a browser bug from 2010 - a comparator-reentrancy use-after-free in Array.prototype.sort, in the decade-old JavaScriptCore that still ships on a BlackBerry Bold 9780. The rest of WebKit fixed this shape years ago; this frozen fork never will. A forever-day, confirmed crashing the real browser from a webpage, reversed to the stale write-back, and driven to an attacker-controlled cross-object write - with no ASLR and no NX, and an honest account of exactly where it stops.
standalone
16 Kilobytes in the Clear: Decrypting Overwatch 2 Without Running It
Overwatch 2's 47 MB .text section ships encrypted at entropy 8.000, decrypted lazily one page at a time by Blizzard's Eidolon protector. The pad that decrypts it is 16 KB of plaintext bytes sitting in Overwatch_loader.dll, in the same folder, read circularly across the whole section. 99.84% of the game's code recovered from two files on disk - no key, no memory dump, no running process. Plus the 22 functions Eidolon guts entirely, and an honest account of the four times I fooled myself on the way.