Attack .NET at Runtime

This document covers some of my research that went into the presentations at Black Hat 2010 - Arsenals and DefCon 18

Reflections Hidden Power

This document covers some of the basics of Reflection in .NET

Assembly Code in .NET (ASM)

This document covers running real machine level code from .NET applications.

Forensics: The Process of Acquiring Live Systems

A process for acquiring a live system independent of the method of deployment. Discuss how an acquisition may be staged so as to minimize the destruction of potential evidence and the insertion of artifacts.