Antivirus-Artifacts: Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.
🗣digicat

Nice work. Gimme crowdstrike falcon.
👤brandeded


🎖@malwr

How Secure Boot works on M1 series Macs
🗣tnavda

Thanks for this! I’d been scratching my head over some of those log entries, and it makes sense that as iBoot spins things up, xnu and friends are taking over their delegated tasks, but iBoot is still managing overall security.

Also interesting that things start from a single efficiency core and expand out, so late in the boot process.

This means that if someone’s looking to mess with the process, vulnerabilities in loading the second efficiency core are prime real estate.
👤Em_Adespoton


🎖@malwr

A bunch of updates to REMnux today (see 🧵 for details). Run "remnux upgrade" to get them.
🗣REMnux


🎖@malwr

Process injection via the KernelCallBackTable involves replacing original callback function by custom payload so that whenever the function is invoked, payload will be triggered. In this case the fnCOPYDATA callback function has been used.
C# code snippet: https://gist.github.com/sbasu7241/5dd8c278762c6305b4b2009d44d60c13
🗣SoumyadeepBas12


🎖@malwr

OpenDrop: An open Apple AirDrop implementation written in Python
https://github.com/seemoo-lab/opendrop
🗣newsycombinator


🎖@malwr

Taking Water Cooler UX Into Your Own Hands With Ghidra
https://hackaday.com/2022/01/02/taking-water-cooler-ux-into-your-own-hands-with-ghidra/
🗣hackaday


🎖@malwr

For the new year I started a new blog post series on HyperGuard: PatchGuard’s lesser-known sibling:
https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/
🗣yarden_shafir


🎖@malwr

Happy New Year! 🎊🎈 🎉
Happy New Bug! 🐛🐜🐞
https://bugs.chromium.org/p/project-zero/issues/detail?id=2223

https://bugs.chromium.org/p/project-zero/issues/detail?id=2235
🗣natashenka


🎖@malwr

I published a new blog post on “Automated RE of Kernel Configurations”:

This also includes the release of a new BN plugin (link in blog post).
https://zznop.com/2022/01/02/automated-re-of-kernel-build-configs/
🗣zznop_


🎖@malwr

Automated RE of Kernel Configurations
🗣zznop_

Pretty nice but seems to be somewhat manual process. I think somewhere on Twitter(?) I saw an idea of bruteforcing/bisecting the kconfig by building multiple variations of the kernel with different kconfig settings and comparing it against the image you have.
👤igor_sk


🎖@malwr

AccChecker LOLBIN [AccCheckConsole.exe - load a managed DLL](https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340)
🗣digicat


🎖@malwr

WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet


🎖@malwr