chrncl

FCAT (First Chronicle Analysis Tool) parses the complete PE structure, DOS header, NT headers, optional header, and every standard data directory including import, export, resource, reloc, debug, TLS, load config, and the x64 exception table, written against the Microsoft PE/COFF spec directly rather than an existing library, partly because nothing available in C# handled bound imports and delay-load descriptors correctly.

The gateway layer holds a persistent WebSocket connection through Discord's full lifecycle: IDENTIFY on first connect, sequence-number tracking so a dropped connection can RESUME instead of losing session state entirely, and a heartbeat loop that has to fire on the server-dictated interval or the connection gets killed outright. Getting RESUME right, replaying the correct sequence number, falling back cleanly to a fresh IDENTIFY when Discord rejects it, was the part that actually took debugging.

Started as a personal project exploring game security and anti-cheat mechanics, it grew into a full commercial product: a kernel driver, an obfuscated C++ client loader, a hardware-bound auth backend, a React dashboard, billing, and support tooling, all built and maintained personally over two years.

A Node.js microservice handling roughly 40,000 authentication requests a day at peak, with sub-10ms response times under load, every active client checked in at launch and on a regular interval, so reliability was not optional. Hardware binding computed a deterministic fingerprint from disk serial, CPU ID, and MAC address, HMAC-SHA256'd with a per-user salt and stored as machine identity; it survived OS reinstalls but broke on hardware swaps, which was the intended behavior.

The goal was understanding exactly what the Windows loader does when you call LoadLibrary, by implementing the same process manually, just the PE/COFF spec and WinDbg open in another window. Memory gets allocated at the image's preferred base via VirtualAlloc, sections get copied from PointerToRawData into the correct virtual offsets, and import resolution walks the IMAGE_IMPORT_DESCRIPTOR array, patching FirstThunk entries with GetProcAddress results, including the ordinal-import case, where the high bit of the thunk changes how the lookup has to be done.

Walks a target process's virtual address space via VirtualQueryEx, filtering to committed, readable regions before handing them to a wildcard byte-pattern scanner implemented three ways: a naive byte-by-byte baseline, a Boyer-Moore-Horspool variant for non-wildcard patterns, and an AVX2 SIMD path comparing 32 bytes per instruction for the no-wildcard hot path. On a typical 4GB process space, the SIMD scanner completes in under 200ms.

Uses the standard splice approach: overwrite the first five bytes of a target function with a relative JMP to a hook handler, keeping the original bytes for the trampoline, built both with Microsoft Detours and a hand-rolled implementation to understand what Detours is doing automatically. Hooked functions include NtCreateFile, NtReadFile, RegSetValueExW, CreateProcessW, and several socket-level calls, each logging arguments and a captured call stack to a structured event stream.

A WDM driver operating at Ring 0, built to understand exactly how DKOM-based detection evasion works by implementing it from the WDK documentation upward. Locates a target EPROCESS block by walking ActiveProcessLinks from PsInitialSystemProcess, then demonstrates how unlinking an entry from that list affects tools that enumerate processes via NtQuerySystemInformation, since most of them walk the same list internally.

Opens a raw socket in promiscuous mode and manually unencapsulates every layer: the 14-byte Ethernet header, the variable-length IP header (length derived from the IHL nibble), and TCP parsing covering sequence numbers, ACKs, flags, and window size, enough to pretty-print a full SYN/SYN-ACK/ACK handshake in real time, watching sequence numbers increment exactly as the RFC says they should.