Introduction Some time ago, I accidentally came across some interesting behaviour in PE files while debugging an unrelated project. I noticed that setting the SectionAlignment value in the NT header to a value lower than the page size (4096) resulted in significant…

Key findings Introduction Check Point Research identified an ongoing operation against targets in North Africa involving a previously undisclosed multi-stage backdoor called Stealth Soldier. The malware Command and Control (C&C) network is part of a larger…

﷽

These volatility modules parse these structures and substructures within them and presents the examiner a beautiful tabular view for analysis

Forensic toolkit for iOS sysdiagnose feature. Contribute to EC-DIGIT-CSIRC/sysdiagnose development by creating an account on GitHub.

As some of you may have seen, I posted a challenge to use Ghidra to identify a vulnerability in a WarGames themed game. There has been a…

In this video, we build upon the introductory video on function flowcharts and delve deeper into the topic. Our focus is on the qflow_chart_t class, where we demonstrate how to enumerate basic blocks along with their predecessors and successors. Lastly, we…

Introduction Process Injection is a popular technique used by Red Teams and threat actors for defense evasion, privilege escalation, and other interesting use cases. At the time of this publishing,…