OpenDrop: An open Apple AirDrop implementation written in Python
https://github.com/seemoo-lab/opendrop
🗣newsycombinator
🎖@malwr
https://github.com/seemoo-lab/opendrop
🗣newsycombinator
🎖@malwr
GitHub
GitHub - seemoo-lab/opendrop: An open Apple AirDrop implementation written in Python
An open Apple AirDrop implementation written in Python - seemoo-lab/opendrop
Taking Water Cooler UX Into Your Own Hands With Ghidra
https://hackaday.com/2022/01/02/taking-water-cooler-ux-into-your-own-hands-with-ghidra/
🗣hackaday
🎖@malwr
https://hackaday.com/2022/01/02/taking-water-cooler-ux-into-your-own-hands-with-ghidra/
🗣hackaday
🎖@malwr
Hackaday
Taking Water Cooler UX Into Your Own Hands With Ghidra
Readers not aware of what Ghidra is might imagine some kind of aftermarket water cooler firmware or mainboard – a usual hacker practice with reflow ovens. What [Robbe Derks] did is no less im…
For the new year I started a new blog post series on HyperGuard: PatchGuard’s lesser-known sibling:
https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/
🗣yarden_shafir
🎖@malwr
https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/
🗣yarden_shafir
🎖@malwr
Happy New Year! 🎊🎈 🎉
Happy New Bug! 🐛🐜🐞
https://bugs.chromium.org/p/project-zero/issues/detail?id=2223
https://bugs.chromium.org/p/project-zero/issues/detail?id=2235
🗣natashenka
🎖@malwr
Happy New Bug! 🐛🐜🐞
https://bugs.chromium.org/p/project-zero/issues/detail?id=2223
https://bugs.chromium.org/p/project-zero/issues/detail?id=2235
🗣natashenka
🎖@malwr
I published a new blog post on “Automated RE of Kernel Configurations”:
This also includes the release of a new BN plugin (link in blog post).
https://zznop.com/2022/01/02/automated-re-of-kernel-build-configs/
🗣zznop_
🎖@malwr
This also includes the release of a new BN plugin (link in blog post).
https://zznop.com/2022/01/02/automated-re-of-kernel-build-configs/
🗣zznop_
🎖@malwr
Automated RE of Kernel Configurations
🗣zznop_
Pretty nice but seems to be somewhat manual process. I think somewhere on Twitter(?) I saw an idea of bruteforcing/bisecting the kconfig by building multiple variations of the kernel with different kconfig settings and comparing it against the image you have.
👤igor_sk
🎖@malwr
🗣zznop_
Pretty nice but seems to be somewhat manual process. I think somewhere on Twitter(?) I saw an idea of bruteforcing/bisecting the kconfig by building multiple variations of the kernel with different kconfig settings and comparing it against the image you have.
👤igor_sk
🎖@malwr
AccChecker LOLBIN [AccCheckConsole.exe - load a managed DLL](https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340)
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Gist
AccChecker LOLBIN [AccCheckConsole.exe]
AccChecker LOLBIN [AccCheckConsole.exe]. GitHub Gist: instantly share code, notes, and snippets.
WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet
🎖@malwr
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet
🎖@malwr
Introducing inject-assembly! Execute a .NET assembly in any existing process, including your current Beacon, and retrieve the output!
- Patches Environment.Exit()
- PE header stomping
- Random pipe name generation
- No blocking of the current Beacon
https://github.com/kyleavery/inject-assembly
🗣kyleavery_
🎖@malwr
- Patches Environment.Exit()
- PE header stomping
- Random pipe name generation
- No blocking of the current Beacon
https://github.com/kyleavery/inject-assembly
🗣kyleavery_
🎖@malwr
GitHub
GitHub - kyleavery/inject-assembly: Inject .NET assemblies into an existing process
Inject .NET assemblies into an existing process. Contribute to kyleavery/inject-assembly development by creating an account on GitHub.
Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) (use translate if you cannot read the original)
https://github.com/alphaSeclab/awesome-reverse-engineering
🗣Dinosn
🎖@malwr
https://github.com/alphaSeclab/awesome-reverse-engineering
🗣Dinosn
🎖@malwr
GitHub
GitHub - alphaSeclab/awesome-reverse-engineering: Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT)…
Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos) - alphaSeclab/awesome-rever...
🎉2
🔥2
Keeping the ball rolling on blog posts! MalwareBazaar is giving me lots of material to work with and I like walking through my thought process #malware
https://forensicitguy.github.io/a-tale-of-two-dropper-scripts/
🗣ForensicITGuy
🎖@malwr
https://forensicitguy.github.io/a-tale-of-two-dropper-scripts/
🗣ForensicITGuy
🎖@malwr
forensicitguy.github.io
A Tale of Two Dropper Scripts for Agent Tesla
In this post I want to look at two script files that drop Agent Tesla stealers on affected systems and show how adversary decisions affect malware analysis and detection. If you want to follow alon...