> For the complete documentation index, see [llms.txt](https://docs.redteamleaders.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api.md).

# Windows Internals and API

- [Building Backdoors with Alternative Socket with lib-nosa (No Socket API)](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/building-backdoors-with-alternative-socket-with-lib-nosa-no-socket-api.md): Alternative implementation of winsock2 using AFD.sys for socket realization. Still improving!
- [Windows API Hashing to Malware](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/windows-api-hashing-to-malware.md)
- [Detection of Hooked Syscalls in ntdll.dll](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/detection-of-hooked-syscalls-in-ntdll.dll.md)
- [Credential Exposure in Memory](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/credential-exposure-in-memory.md): A Deep Dive into SecureString, PowerShell, and Windows Process Internals