<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <title>Eitan Elbaz · Research</title>
  <subtitle>Security research, reverse engineering, and technical publications by Eitan Elbaz.</subtitle>
  <link href="https://research.elbaz.ch/feed.xml" rel="self" type="application/atom+xml" />
  <link href="https://research.elbaz.ch/research/" rel="alternate" type="text/html" />
  <id>https://research.elbaz.ch/research/</id>
  <updated>2026-10-20T00:36:38+02:00</updated>
  <author><name>Eitan Elbaz</name><uri>https://github.com/AnonXl32</uri></author>
  
  <entry>
    <title>Rust-Based Hypervisors for Memory Introspection and Reverse Engineering</title>
    <link href="https://research.elbaz.ch/research/rust-based-hypervisors/" rel="alternate" type="text/html" />
    <id>https://research.elbaz.ch/research/rust-based-hypervisors/</id>
    <published>2026-10-20T00:00:00+02:00</published>
    <updated>2026-10-20T00:00:00+02:00</updated>
    <summary type="text">Research notes comparing illusion-rs and matrix-rs: EPT hooks, early-boot and runtime introspection, instruction replay, and detection trade-offs.</summary>
    <category term="Rust" /><category term="Hypervisors" /><category term="Memory introspection" />
  </entry>
  
  <entry>
    <title>Tickling VMProtect with LLVM: Lifting, Exploration, and Optimization</title>
    <link href="https://research.elbaz.ch/research/tickling-vmprotect-with-llvm/" rel="alternate" type="text/html" />
    <id>https://research.elbaz.ch/research/tickling-vmprotect-with-llvm/</id>
    <published>2021-09-08T00:00:00+02:00</published>
    <updated>2021-09-08T00:00:00+02:00</updated>
    <summary type="text">A complete journey from virtualized x64 code to readable LLVM IR: lifting VMProtect handlers, exploring control flow, and building a custom optimization pipeline.</summary>
    <category term="LLVM" /><category term="VMProtect" /><category term="Deobfuscation" />
  </entry>
  
</feed>
