Timer callback spoofing

README.md

@@ -19,6 +19,16 @@ This version is based on the following:
 * [SLE(A)PING Issues: SWAPPALA and Reflective DLL Friends Forever](https://oldboy21.github.io/posts/2024/06/sleaping-issues-swappala-and-reflective-dll-friends-forever/) 
 * [Timer Callbacks Spoofing to Improve your SLEAP and SWAPPALA Untold](https://oldboy21.github.io/posts/2024/09/timer-callbacks-spoofing-to-improve-your-sleap-and-swappala-untold/)
 
+## RflDllOb-NG VS In-memory Scanners
+
+Results at the time of the commit, who knows how it is going to be (!?)
+
+![HSB](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/hsb.png?raw=true)
+
+![Moneta](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/moneta.png?raw=true)
+
+![pesieve](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/pesieve.png?raw=true)
+
 ## Sit down, I will tell you a story
 
 If you do not want to read my blogs and miss all the memes and the GIFs: 
@@ -37,16 +47,6 @@ Last update (September 2024) also includes the logic for spoofing the callback a
 
 To conclude: SWAPPALA and SLEAPING are used to load the reflective DLL in a private mapping backed by physical memory and swap-it with a memory mapping backed by a legit DLL on disk, at its very own legit address. All of this orchestrated at sleeping time by worker threads created in a suspended state and resumed via OS timers.
 
-## RflDllOb-NG VS In-memory Scanners
-
-Results at the time of the commit, who knows how it is going to be (!?)
-
-![HSB](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/hsb.png?raw=true)
-
-![Moneta](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/moneta.png?raw=true)
-
-![pesieve](https://raw.githubusercontent.com/oldboy21/RflDllOb/main/imgs/pesieve.png?raw=true)
-
 ## Little Demo
 
 This demo helps to understand how the Reflective DLL Ob hides itself behind a legit dll at sleeping time.