Extracting Prefetch from Memory
Good morning,
Iโve just released a new Introduction to Memory Forensics episode. This is an excerpt from the upcoming premiere of a new 13Cubed series called Deep Dives. We'll take a look at how to extract Windows Prefetch data from memory. There are a number of things you'll need to know to get the Volatility prefetchparser plugin to work correctly, especially with Windows 10 Prefetch files since they are compressed. We'll walk through the entire process, including installation of Volatility, the prefetchparser plugin, and of an open source implementation of the Microsoft compression algorithms.
Episode:
https://www.youtube.com/watch?v=6y9Wxch7NKk
Episode Guide:
https://www.13cubed.com/episodes
Channel:
https://www.youtube.com/13cubed
Patreon (Help support 13Cubed):
https://www.patreon.com/13cubed
๐ฃ13Cubed
๐@malwr
Good morning,
Iโve just released a new Introduction to Memory Forensics episode. This is an excerpt from the upcoming premiere of a new 13Cubed series called Deep Dives. We'll take a look at how to extract Windows Prefetch data from memory. There are a number of things you'll need to know to get the Volatility prefetchparser plugin to work correctly, especially with Windows 10 Prefetch files since they are compressed. We'll walk through the entire process, including installation of Volatility, the prefetchparser plugin, and of an open source implementation of the Microsoft compression algorithms.
Episode:
https://www.youtube.com/watch?v=6y9Wxch7NKk
Episode Guide:
https://www.13cubed.com/episodes
Channel:
https://www.youtube.com/13cubed
Patreon (Help support 13Cubed):
https://www.patreon.com/13cubed
๐ฃ13Cubed
๐@malwr
YouTube
Extracting Prefetch from Memory
This is an excerpt from the upcoming premiere of a new 13Cubed series called Deep Dives. In this episode, we'll take a look at how to extract Windows Prefetch data from memory. There are a number of things you'll need to know to get the Volatility prefetchparserโฆ
How We Found Another XSS in Google with Acunetix
Some time ago, Russian security researchers Andrey Leonov and Link found an XSS in Google Cloud with the help of Acunetix. Recently they found another XSS vulnerability. Here is how it happened. Read on ยป
https://preview.redd.it/8k5mfavrfnh41.png?width=910&format=png&auto=webp&s=9f163a59304f45574a3b17b591d48170411d1926
๐ฃAcunetixLtd
๐@malwr
Some time ago, Russian security researchers Andrey Leonov and Link found an XSS in Google Cloud with the help of Acunetix. Recently they found another XSS vulnerability. Here is how it happened. Read on ยป
https://preview.redd.it/8k5mfavrfnh41.png?width=910&format=png&auto=webp&s=9f163a59304f45574a3b17b591d48170411d1926
๐ฃAcunetixLtd
๐@malwr
Acunetix
How We Found Another XSS in Google with Acunetix | Acunetix
Some time ago, we found an XSS in Google Cloud with the help of the Acunetix vulnerability scanner. Recently we found another XSS vulnerability. Here is how it happened.
Hidden in PEB Sight: Hiding Windows API Imports With a Custom Loader
๐ฃthorn42
Very nice. Engaging writing style too.
๐คragnar_graybeard87
๐@malwr
๐ฃthorn42
Very nice. Engaging writing style too.
๐คragnar_graybeard87
๐@malwr
Christophe Tafani-Dereeper
Hidden in PEB Sight: Hiding Windows API Imports With a Custom Loader
In this post, we look at different techniques to hide Windows API imports in a program in order to fly under the radar of static analysis tools.
Purpose of `mov edi, edi`?
I was debugging a Windows' built in program and notices that almost all subroutines starts with
subsomething proc near
mov edi, edi
push ebp
mov ebp, esp
;do something...
leave
retn
subsomething endp
AFAIU, that
It seems like it's specific to Microsoft based C language compiled modules, cause I also use Delphi to create Windows programs, and none of their functions has such asm code pattern.
So, what's the purpose of that instruction?
๐ฃjcunews1
It's a nop. It's there for patching. Intel doesn't actually have formal nop instructions! For nops people often write xchg eax, eax, or something like this if they want a longer nop.
๐คchrisgseaton
It's a no-op, on purpose, that can be overwritten.
Raymond Chen explains it, here: https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
๐คchunkyks
https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
๐คjedwardsol
๐@malwr
I was debugging a Windows' built in program and notices that almost all subroutines starts with
mov edi, edi. e.g.subsomething proc near
mov edi, edi
push ebp
mov ebp, esp
;do something...
leave
retn
subsomething endp
AFAIU, that
mov edi, edi practically does nothing and affect nothing, and it only wastes space and computing time.It seems like it's specific to Microsoft based C language compiled modules, cause I also use Delphi to create Windows programs, and none of their functions has such asm code pattern.
So, what's the purpose of that instruction?
๐ฃjcunews1
It's a nop. It's there for patching. Intel doesn't actually have formal nop instructions! For nops people often write xchg eax, eax, or something like this if they want a longer nop.
๐คchrisgseaton
It's a no-op, on purpose, that can be overwritten.
Raymond Chen explains it, here: https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
๐คchunkyks
https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583
๐คjedwardsol
๐@malwr
Reddit
From the asm community on Reddit
Explore this post and more from the asm community
Public Key Cryptography, How and Why Does It Work? [DC206](https://www.youtube.com/watch?v=133Ysr71YOw)
๐ฃcyberg0100
๐@malwr
๐ฃcyberg0100
๐@malwr
YouTube
Public Key Cryptography, How and Why Does It Work? [DC206]
Live from the February 2020 DC206 monthly meeting
DC206 Meeting Presentation:
Title: Public Key Cryptography, How and Why Does It Work?
Abstract: A description of the non-elliptic versions of RSA and DHA followed by a primer on the branches of math involvedโฆ
DC206 Meeting Presentation:
Title: Public Key Cryptography, How and Why Does It Work?
Abstract: A description of the non-elliptic versions of RSA and DHA followed by a primer on the branches of math involvedโฆ