Ahmed Aoussare

Reverse Engineering • Windows Internals • Binary Analysis • Low-Level Programming

Overview

About

Work

Skills

Projects

Education

References

Certificates

About

Ahmed Aoussare (OVRRIDFORCE) is a Security Researcher and Low-Level Developer specializing in Windows Internals, reverse engineering, and binary analysis. He focuses on understanding and manipulating compiled code at the binary level, analyzing malware evasion techniques, stud...

Work

Jun 2024 ·

OVRRIDFORCE (Independent)

Low-Level Security Researcher

Jan 2021 → May 2024 ·

Binary Diagnostics Lab

Low-Level Software Developer

Skills

Reverse Engineering

Windows Internals

Projects

ovrrid-pe-parser

A high-performance command-line PE/COFF file parser written in pure C++ to dissect, analyze, and rebuild Windows executable files.

syscall-stubs-generator

A low-level C utility that dynamically extracts syscall numbers from ntdll.dll at runtime to execute clean syscalls directly, bypassing endpoint hooks.

Education

References

Certificates

OVRRIDFORCE (Independent)

Low-Level Security Researcher

Jun 2024

→

Present

Dedicated to independent research in Windows Kernel security, binary instrumentation, and reverse engineering Windows binaries.

Researched Windows kernel mechanisms, focusing on custom syscall implementation, NTAPI, and kernel callback mechanisms to write detection-evasion testbeds in C/C++.

Reconstructed proprietary software execution flows using IDA Pro and Ghidra, identifying hidden logic and binary-level vulnerabilities.

Built custom PE/COFF parsers in C++ to inspect, parse, and reconstruct export/import tables, base relocations, and PE headers.

Analyzed anti-debugging, anti-VM, and code obfuscation techniques, utilizing x64dbg and WinDbg to develop custom scripting and bypass strategies.

Binary Diagnostics Lab

Low-Level Software Developer

Jan 2021

→

May 2024

Focused on native Windows application development, system debugging, and binary analysis of core operating system processes.

Designed and optimized high-performance C/C++ native diagnostics utilities interacting directly with WinAPI and NTAPI.

Debugged complex multithreaded native codebases, tracking down memory corruption, heap leaks, and synchronization issues at the assembly level.

Interrogated Process Environment Block (PEB) and Thread Environment Block (TEB) structures to implement custom process execution tracking.

Automated structural reverse engineering workflows using IDAPython, reducing manual disassembly analysis time by 40%.

Reverse Engineering

Windows Internals

Binary Analysis

Low-Level Programing

C++

C

x86-64 Assembly

ARM 64

Operating System

Computer Security

Malware Analysis

Pe File Format

ovrrid-pe-parser

A high-performance command-line PE/COFF file parser written in pure C++ to dissect, analyze, and rebuild Windows executable files.

syscall-stubs-generator

A low-level C utility that dynamically extracts syscall numbers from ntdll.dll at runtime to execute clean syscalls directly, bypassing endpoint hooks.

peb-unlinking-utility

A low-level proof-of-concept utility written in C++ that manipulates the Process Environment Block (PEB) to obscure loaded modules from standard API inspection.

Scylla-EDR-Bypass

Jan 2024

→

May 2024

A custom defense-evasion testbed written in C++ that demonstrates dynamic syscall invocation, NTAPI resolution, and Process Environment Block (PEB) unlinking to bypass modern user-mode EDR hooks.

Vx-PE-Parser

Jun 2023

→

Dec 2023

A dependency-free PE/COFF executable parser written in pure C++ that reads, parses, and validates Windows binaries directly from raw bytes.

NtdllUnhooker

Jan 2023

→

May 2023

A low-level utility that maps a fresh, untouched copy of ntdll.dll from the Windows system directory into memory and hot-patches hooked functions.