Kicking off a 4-part deep dive into AFD.sys on Windows 11: crafting a raw TCP socket, performing the TCP handshake, sending & receiving TCP packets - everything without Winsock.

Part 1: https://leftarcode.com/posts/afd-reverse-engineering-part1/

Part 2: https://leftarcode.com/posts/afd-reverse-engineering-part2/

Part 3: https://leftarcode.com/posts/afd-reverse-engineering-part3/

Part 4: https://leftarcode.com/posts/afd-reverse-engineering-part4/

#reverseengineering #windows #cybersecurity #malware