... the following patch is sufficient: > CHANGE_HERE << +[ORG 0x8210] ; >> CHANGE_HERE << %include "constants.inc" @@ -140,8 +140,8 @@ _start: ; >> CHANGE_HERE << ; Overwritten BIOS instructions below (if any) - nop - nop + mov ax, 0x4F02 + int 0x10 nop nop' dir="auto">diff --git a/dbg.asm b/dbg.asm
index caedb70..88024d3 100644
--- a/dbg.asm
+++ b/dbg.asm
@@ -21,7 +21,7 @@
; SOFTWARE.

[BITS 16]
-[ORG 0x0000] ; >> CHANGE_HERE <<
+[ORG 0x8210] ; >> CHANGE_HERE <<

%include "constants.inc"

@@ -140,8 +140,8 @@ _start:

; >> CHANGE_HERE <<
; Overwritten BIOS instructions below (if any)
- nop
- nop
+ mov ax, 0x4F02
+ int 0x10
nop
nop It is important to note that if you have altered a few instructions within your ROM to invoke the debugger code, they must be restored prior to returning from the debugger. The reason for replacing these two instructions is that they are executed just prior to the BIOS displaying the logo on the screen, which is now the debugger, ensuring a few key points: The logo module (which is the debugger) has already been loaded into memory Video interrupts from the BIOS already work The code around it indicates that the stack already exists Finding a good location to call the debugger (where the BIOS has already initialized enough, but not too late) can be challenging, but it is possible. After this, dbg.bin is ready to be inserted into the correct position in the ROM. For DOS Debugging DOS programs with BREAD is a bit tricky, but possible: 1. Edit dbg.asm so that DOS understands it as a valid DOS program: Set the ORG to 0x100 Leave the useful code away from the beginning of the file (times) Set the program output (int 0x20) The following patch addresses this: > CHANGE_HERE << +[ORG 0x100] + +times 40*1024 db 0x90 ; keep some distance, + ; 40kB should be enough %include "constants.inc" @@ -140,7 +143,7 @@ _start: ; >> CHANGE_HERE << ; Overwritten BIOS instructions below (if any) - nop + int 0x20 ; DOS interrupt to exit process nop' dir="auto">diff --git a/dbg.asm b/dbg.asm
index caedb70..b042d35 100644
--- a/dbg.asm
+++ b/dbg.asm
@@ -21,7 +21,10 @@
; SOFTWARE.

[BITS 16]
-[ORG 0x0000] ; >> CHANGE_HERE <<
+[ORG 0x100]
+
+times 40*1024 db 0x90 ; keep some distance,
+ ; 40kB should be enough

%include "constants.inc"

@@ -140,7 +143,7 @@ _start:

; >> CHANGE_HERE <<
; Overwritten BIOS instructions below (if any)
- nop
+ int 0x20 ; DOS interrupt to exit process
nop 2. Create a minimal bootable DOS environment and run Create a bootable FreeDOS (or DOS) floppy image containing just the kernel and the terminal: KERNEL.SYS and COMMAND.COM. Also add to this floppy image the program to be debugged and the DBG.COM (dbg.bin). The following steps should be taken after creating the image: Boot it with bridge already opened (refer to the next section for instructions). Execute DBG.COM. Once execution stops, use GDB to add any desired breakpoints and watchpoints relative to the next process you want to debug. Then, allow the DBG.COM process to continue until it finishes. Run the process that you want to debug. The previously-configured breakpoints and watchpoints should trigger as expected. It is important to note that DOS does not erase the process image after it exits. As a result, the debugger can be configured like any other DOS program and the appropriate breakpoints can be set. The beginning of the debugger is filled with NOPs, so it is anticipated that the new process will not overwrite the debugger's memory, allowing it to continue functioning even after it appears to be "finished". This allows BREaD to debug other programs, including DOS itself. Bridge Bridge is the glue between the debugger and GDB and can be used in different ways, whether on real hardware or virtual machine. Its parameters are: Usage: ./bridge [options]
Options:

-s Enable serial through socket, instead of device
-d Replaces the default device path (/dev/ttyUSB0)
(does not work if -s is enabled)
-p Serial port (as socket), default: 2345
-g GDB port, default: 1234
-h This help

If no options are passed the default behavior is:
./bridge -d /dev/ttyUSB0 -g 1234

Minimal recommended usages:
./bridge -s (socket mode, serial on 2345 and GDB on 1234)
./bridge (device mode, serial on /dev/ttyUSB0 and GDB on 1234)
Real hardware To use it on real hardware, just invoke it without parameters. Optionally, you can change the device path with the -d parameter: Execution flow: Connect serial cable to PC Run bridge (./bridge or ./bridge -d /path/to/device) Turn on the PC to be debugged Wait for the message: Single-stepped, you can now connect GDB! and then launch GDB: gdb. Virtual machine For use in a virtual machine, the execution order changes slightly: Execution flow: Run bridge (./bridge or ./bridge -d /path/to/device) Open the VM3 (https://github.com/Theldus/bread#user-content-fn-vm_note-39e484c63d9d86e3a2c6e6aff6905f63) (such as: make bochs or make qemu) Wait for the message: Single-stepped, you can now connect GDB! and then launch GDB: gdb. In both cases, be sure to run GDB inside the BRIDGE root folder, as there are auxiliary files in this folder for GDB to work properly in 16-bit. Contributing BREAD is always open to the community and willing to accept contributions, whether with issues, documentation, testing, new features, bugfixes, typos, and etc. Welcome aboard. License and Authors BREAD is licensed under MIT License. Written by Davidson Francis and (hopefully) other contributors (https://github.com/Theldus/bread/graphs/contributors). Footnotes Breakpoints are implemented as hardware breakpoints and therefore have a limited number of available breakpoints. In the current implementation, only 1 active breakpoint at a time! ↩ (https://github.com/Theldus/bread#user-content-fnref-bp_note-39e484c63d9d86e3a2c6e6aff6905f63) Hardware watchpoints (like breakpoints) are also only supported one at a time. ↩ (https://github.com/Theldus/bread#user-content-fnref-watchp_note-39e484c63d9d86e3a2c6e6aff6905f63) Please note that debug registers do not work by default on VMs. For bochs, it needs to be compiled with the --enable-x86-debugger=yes flag. For Qemu, it needs to run with KVM enabled: --enable-kvm (make qemu already does this). ↩ (https://github.com/Theldus/bread#user-content-fnref-vm_note-39e484c63d9d86e3a2c6e6aff6905f63)

Download Bread (https://github.com/Theldus/bread)

Hacking Microsoft IIS : Enumerating IIS for V

IIS EnumerationContinue reading on Medium »
Read more...

23.5 Lab: User ID controlled by request parameter with password disclosure | 2023

This lab has user account page that contains the current user’s existing password, prefilled in a masked input. To solve the lab, retrieve…Continue reading on Medium »
Read more...

CVE-2023–36025: An In-Depth Analysis of Circumventing Windows SmartScreen Security

In the world of cybersecurity, the discovery of a vulnerability like CVE-2023-36025 in Windows SmartScreen is a significant event. This…Continue reading on InfoSec Write-ups »
Read more...

Hacking Microsoft IIS : Enumerating IIS for V
https://medium.com/@mudasserhussain1111/hacking-microsoft-iis-enumerating-iis-for-v-39de5a27f101?source=rss------bug_bounty-5

IIS EnumerationContinue reading on Medium » (https://medium.com/@mudasserhussain1111/hacking-microsoft-iis-enumerating-iis-for-v-39de5a27f101?source=rss------bug_bounty-5)

23.5 Lab: User ID controlled by request parameter with password disclosure | 2023
https://cyberw1ng.medium.com/23-5-lab-user-id-controlled-by-request-parameter-with-password-disclosure-2023-ad748d1daa9e?source=rss------bug_bounty-5

This lab has user account page that contains the current user’s existing password, prefilled in a masked input. To solve the lab, retrieve…Continue reading on Medium » (https://cyberw1ng.medium.com/23-5-lab-user-id-controlled-by-request-parameter-with-password-disclosure-2023-ad748d1daa9e?source=rss------bug_bounty-5)

CVE-2023–36025: An In-Depth Analysis of Circumventing Windows SmartScreen Security
https://infosecwriteups.com/cve-2023-36025-an-in-depth-analysis-of-circumventing-windows-smartscreen-security-6ff05c8b69d0?source=rss------bug_bounty-5

In the world of cybersecurity, the discovery of a vulnerability like CVE-2023-36025 in Windows SmartScreen is a significant event. This…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/cve-2023-36025-an-in-depth-analysis-of-circumventing-windows-smartscreen-security-6ff05c8b69d0?source=rss------bug_bounty-5)

OAuth Misconfiguration Leads To Pre-Account Takeover(snapchat)
https://medium.com/@a7med.ctf/oauth-misconfiguration-leads-to-pre-account-takeover-snapchat-129b118661f6?source=rss------bug_bounty-5

Hi guys, my name is Ahmed Mahmoud. I am a bug hunter. I will share my latest finding, which is an OAuth Misconfiguration that Leads To…Continue reading on Medium » (https://medium.com/@a7med.ctf/oauth-misconfiguration-leads-to-pre-account-takeover-snapchat-129b118661f6?source=rss------bug_bounty-5)

OAuth Misconfiguration Leads To Pre-Account Takeover(snapchat)

Hi guys, my name is Ahmed Mahmoud. I am a bug hunter. I will share my latest finding, which is an OAuth Misconfiguration that Leads To…Continue reading on Medium »
Read more...

Default Credentials, P1 with $$$$ Reward in a Bug Bounty Program

Hello dear hunters I hope you’re doing great. It’s been over a year since my last publication about Insecure Direct Object ReferencesContinue reading on Medium »
Read more...

CVE-2023–35078 Unveiled: Ethical Vulnerability Discovery and Reporting By Me and My Hunting Buddy…

Introduction: In our regular vulnerability hunt,themalwarebug and I set on several services, narrowing down to a few select IP addresses…Continue reading on Medium »
Read more...

Project 2510: Bug Bounty Challenge — Day 13/25

Welcome to Day 13.Continue reading on Medium »
Read more...