A CAN protocol decoder https://kentindell.github.io/2020/12/19/can2-decoder/
Ken Tindell’s blog
A CAN protocol decoder
We said in our previous blog post that “Our next goal is to create a GTKWave filter so that an arbitrary waveform can be decoded” and in an early Christmas present to those who are into the CAN protocol, we’ve done that! But we’ve done even better and we…
Disclosure of 8 0-day vulnerabilities in AVs https://halove23.blogspot.com/2020/12/oh-so-you-have-antivirus-nameevery-bug.html
We have published a new blog post introducing our last research, enjoy! » "Unrelocating Windows Modules (I)" https://reversea.me/index.php/unrelocating-windows-modules-i/
Analyzing Cobalt Strike for Fun and Profit https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/
A Complete Guide to LLVM for Programming Language Creators https://mukulrathi.co.uk/create-your-own-programming-language/llvm-ir-cpp-api-tutorial/
Mukulrathi
A Complete Guide to LLVM for Programming Language Creators
We'll explain the concepts underlying LLVM IR, and how you can use the LLVM C++ API in your programming language's compiler.
ESILSolve - A python symbolic execution framework using r2 and ESIL https://github.com/radareorg/esilsolve
GitHub
GitHub - radareorg/esilsolve: A python symbolic execution framework using radare2's ESIL (Evaluable String Intermediate Language)
A python symbolic execution framework using radare2's ESIL (Evaluable String Intermediate Language) - radareorg/esilsolve
Never upload ransomware samples to the Internet https://0xc0decafe.com/2020/12/28/never-upload-ransomware-samples-to-the-internet/
0xC0DECAFE.com
Never upload ransomware samples to the Internet - 0xC0DECAFE.com
This post explains what information a ransomware sample contains, why you should never upload ransomware samples to the Internet, and what actually happens if you upload them after all.
Introducing PcapMonkey: an easy way to analyze pcaps using Zeek, Suricata and Elasticsearch https://www.certego.net/en/news/introducing-pcapmonkey/
Certego
Introducing PcapMonkey
PcapMonkey is a project that will provide an easy way to analyze pcap using the latest version of Suricata and Zeek. It can also save...
Analysis of OpenSSL ChaCha20-Poly1305 Heap Buffer Overflow (CVE-2016-7054) https://www.fortinet.com/blog/threat-research/analysis-of-openssl-chacha20-poly1305-heap-buffer-overflow-cve-2016-7054
Fortinet Blog
Analysis of OpenSSL ChaCha20-Poly1305 Heap Buffer Overflow (CVE-2016-7054)
A High-Severity Heap Buffer Overflow vulnerability was recently fixed in a patch by Openssl Project. This vulnerability affects the remote SSL servers that support the ChaCha20-Poly1305 cipher su…
Flare-On 7 – Task 9 write-up https://hshrzd.wordpress.com/2020/12/12/flareon-7-task-9/
hasherezade's 1001 nights
Flare-On 7 – Task 9
This year’s FlareOn was very interesting. I managed to finish it with 87th place. In this small series I will describe my favorite tasks, and how I solved them. I hope to provide some educati…
MemProcFS: an easy and convenient way of viewing physical memory as files in a virtual file system https://github.com/ufrisk/MemProcFS
GitHub
GitHub - ufrisk/MemProcFS: MemProcFS
MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.
CVE-2020-10148 (local file disclosure PoC for SolarWinds Orion aka door to SuperNova?) https://gist.github.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965
Gist
Solarwinds_Orion_LFD local file disclosure PoC for SolarWinds Orion aka door to SuperNova?)
Solarwinds_Orion_LFD local file disclosure PoC for SolarWinds Orion aka door to SuperNova?) - Solarwinds_Orion_LFD.py
ACE: Apple Type-C Port Controller Secrets | Part 1 https://blog.t8012.dev/ace-part-1/
NTFS Timestamps http://www.kazamiya.net/en/NTFS_Timestamps
nice tutorial! » Reverse Engineering For Everyone! https://0xinfection.github.io/reversing/
HID ActivID Mobile Soft Token Vulnerabilities https://www.randorisec.fr/activid-vulnerabilities/
www.randorisec.fr
HID ActivID Mobile Soft Token Vulnerabilities
RandoriSec Offensive Security
How I Found My First Ever ZeroDay (In RDP) https://www.malwaretech.com/2020/12/how-i-found-my-first-ever-zeroday-in-rdp.html
Malwaretech
How I Found My First Ever ZeroDay (In RDP)
Up until recently, I’d never tried the bug hunting part of vulnerability research. I’ve been reverse engineering Windows malware for over a decade, and I’d done the occasional patch analysis, but I never saw a point in bug hunting on a major OS. After all…
Running Arm Binaries on x86 with QEMU-User https://azeria-labs.com/arm-on-x86-qemu-user/
Azeria-Labs
Running Arm Binaries on x86 with QEMU-User
Defeating Userland Hooks (ft. Bitdefender) https://0x00sec.org/t/defeating-userland-hooks-ft-bitdefender/12496
0x00sec - The Home of the Hacker
Defeating Userland Hooks (ft. Bitdefender)
It has been brought to my attention by @lkw of a recent Cylance bypass that would allow an application to dump memory from the lsass.exe process. The article discusses the issues of userland hooks employed by the EDR to detect the use of the ReadProcessMemory…
Reversing Go - Part 1 Reversing Golang Binaries https://x0r19x91.gitlab.io/post/reversing-go-part-1/