Abusing native Windows functions for shellcode execution

http://ropgadget.com/posts/abusing_win_functions.html

A Deep Dive Into Malicious Direct Syscall Detection

https://www.paloaltonetworks.com/blog/security-operations/a-deep-dive-into-malicious-direct-syscall-detection

x64dbg plugin for simple spoofing of CPUID instruction behavior

https://github.com/jonatan1024/CpuidSpoofer

fpicker: Fuzzing with Frida

https://insinuator.net/2021/03/fpicker-fuzzing-with-frida

https://github.com/ttdennis/fpicker

Finally, PageDOut No. 8 is out

https://pagedout.institute/?page=issues.php

Bypassing Frida: Advance Frida Detection Bypass

https://medium.com/@haxymad/bypassing-frida-advanced-frida-detection-bypass-part-1-cc7c1dfbad9d


https://medium.com/@haxymad/bypassing-frida-advanced-frida-detection-bypass-part-2-e3466a141a4c


https://medium.com/system-weakness/bypassing-frida-advanced-frida-detection-bypass-part-3-339aa1202c48


https://medium.com/system-weakness/bypassing-frida-advanced-frida-detection-bypass-part-4-c258e8f5aa64

VM Detection Tricks, Part 1: Physical memory resource maps

In this series we’ll document a novel and as-yet-undocumented Virtual Machine detection trick for each month of 2021. These detection tricks will be focused on 64-bit Windows 10 or Windows Server 2019 guests, targeting a variety of VM platforms.

https://labs.nettitude.com/blog/vm-detection-tricks-part-1-physical-memory-resource-maps

Decompilation Debugging

https://clearbluejar.github.io/posts/decompilation-debugging-pretending-all-binaries-come-with-source-code

Сustom shellcode compiler for Binary Ninja

https://scc.binary.ninja/index.html

IDA Pro 9.3 KeyGen


pip install + privilege escalation on Win (ShellExecuteW(..., "runas", ...) + generation of JSON license and signature + copying idapro.hexlic to %APPDATA%\Hex-Rays\Ida Pro\idapro.hexlic + of course editing the registry HKCU\SOFTWARE\Hex-Rays\IDA\Licenses\ + patching IDA binaries

On *nix/mac - it searches for libida.so, libida32.so, .dylib in the current directory and patches them

@reverseengine

🟢 7️⃣ Page Permissions

هر صفحه حافظه:

Read

Write

Execute

مثال:

Code → RX

Data → RW

📌 مهم: چون Debugger و loader با این پرمیژن‌ ها کار میکنن



🟢 7️⃣ Page Permissions

Each memory page:

Read

Write

Execute

Example:

Code → RX

Data → RW

📌 Important: Because Debugger and loader work with these permissions

@reverseengine

🟢 8️⃣ User Mode vs Kernel Mode

CPU
دو حالت داره:

User Mode
برنامه‌های معمولی
دسترسی محدود

Kernel Mode
خود سیستم‌عامل
دسترسی کامل

برنامه مستقیم نمیتونه کارهای حساس انجام بده باید syscall بزنه

📌  RE:

میفهمید چرا بعضی دستورها خطا میدن




🟢 8️⃣ User Mode vs Kernel Mode

CPU has two modes:

User Mode

Normal programs
Limited access


Kernel Mode

The operating system itself
Full access

A program cannot do sensitive work directly, it must make a syscall

📌 RE:

Do you understand why some commands give errors?

@reverseengine