Feeling overwhelmed trying to learn security research? (Analyzing the PayloadRestrictions.dll Export Address Filtering)
#research #reverse #internals
Check out the "Process of Step-by-Step" by Yarden Shafir — a great resource that breaks it down clearly.
#research #reverse #internals
Windows Anti-Debug techniques - OpenProcess filtering
"OBREGISTERCALLBACKS AND COUNTERMEASURES"
Debugging AV
"OBREGISTERCALLBACKS AND COUNTERMEASURES"
XPN InfoSec Blog
@_xpn_ - Windows Anti-Debug techniques - OpenProcess filtering
This week I took a break from SYSTEM chasing to review some anti-debugging techniques. With quite a few Bug Bounty programs available relying on client-side applications, I thought I'd share one of the techniques used by numerous security products (and apparently…
Forwarded from Order of Six Angles
YouTube
Malware Loader Reverse Engineering with IDA Pro (Stream - 06/05/2025)
In this stream we reverse engineered a malware loader with IDA Pro, including its anti-analysis, persistence, COM UAC Bypass, command-line spoofing, C2, process injection, and TCP proxy functionality.
Learn how to reverse engineer malware: https://train…
Learn how to reverse engineer malware: https://train…
👾1
aiya-mmd-book.pdf
31.8 MB
AIYA MMD - means Attack and Introduction or (Android and IOS), start Your Adventure in Mobile Malware Development. also AIYA means AIYA Nurkhankyzy.
https://github.com/cocomelonc/bsprishtina-2024-maldev-workshop/
#mobile
👾4
Obfusk8: C++17-Based Obfuscation Library
#obf
Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and runtime techniques aimed at protecting your code's logic and data.
#obf
Spoofing Call Stacks To Confuse EDRs
#evasion
Call stacks are an understated yet often important source of telemetry for EDR products. They can provide vital context to an event and be an extremely powerful tool in determining false positives from true positives (especially for credential theft events such as handle access to lsass).
#evasion