Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping .

The full text of the associated blogpost is available in the Documentation directory.