NEW BOT Телеграм, страница

Low Level CO 🇨🇴

Reverse engineering Codex CLI to get GPT-5-Codex-Mini to draw me a pelican

#gpt_5 #codex_mini #chatgpt #reverse_engineering

https://simonwillison.net/2025/Nov/9/gpt-5-codex-mini/

Simon Willison’s Weblog

Reverse engineering Codex CLI to get GPT-5-Codex-Mini to draw me a pelican

OpenAI partially released a new model yesterday called GPT-5-Codex-Mini, which they describe as "a more compact and cost-efficient version of GPT-5-Codex". It’s currently only available via their Codex CLI tool …

57 views08:37

Low Level CO 🇨🇴

🛡 NoMoreStealer

A Windows kernel-mode minifilter driver that monitors file system access to protect against information-stealing malware

#minidriver #windows_kernel #defensive_tool #minifilter #ring0

https://github.com/EvilBytecode/NoMoreStealers

GitHub

GitHub - EvilBytecode/NoMoreStealers: NoMoreStealers is a Windows file system minifilter driver that protects sensitive user data…

NoMoreStealers is a Windows file system minifilter driver that protects sensitive user data from untrusted processes. - EvilBytecode/NoMoreStealers

🔥1

47 views10:24

Low Level CO 🇨🇴

🛡 NoMoreStealer A Windows kernel-mode minifilter driver that monitors file system access to protect against information-stealing malware #minidriver #windows_kernel #defensive_tool #minifilter #ring0 @ZwLowLevel https://github.com/EvilBytecode/NoMoreStealers

Understanding Mini-Filter Drivers for Windows Vulnerability Research & Exploit Development

#minifilter_driver #minidriver #windows_internals #windows_kernel

Medium

Understanding Mini-Filter Drivers for Windows Vulnerability Research & Exploit Development

Hey everyone! Hope you’re all doing well. As always, I was looking for an interesting Windows internals topic to blog about. I google-d…

52 viewsedited 10:31

⚙️ Como crear un live memory dump de System usando Task Manager!

#memory_dump #task_manager #windbg

https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/task-manager-live-dump

🔥2

46 views11:12

Low Level CO 🇨🇴

Kid-cam firmware modding
#firmware_hacking #hardware_hacking

https://spritesmods.com/?art=kid_cam

44 views16:31

Low Level CO 🇨🇴

Who's that Pokemon? It's Monero!

#cryptojacking #xmr #monero #malware #pokemon

https://secureannex.com/blog/pokemon-or-cryptominer

Secure Annex

Who's that Pokemon? It's Monero!

How your Pokemon Theme VS Code extension might be a cryptominer in disguise.

48 views17:26

Low Level CO 🇨🇴

Forwarded from Android Security & Malware

Runtime Android Object Instrumentation
https://knifecoat.com/Posts/Runtime+Android+Object+Instrumentation

KnifeCoat

Runtime Android Object Instrumentation - KnifeCoat

Intro This year I have been doing quite a bit Android userland analysis. Android is a wonderful platform to work on, great decompiler support (JEB), easy access to rooted devices (unless you buy NA l…

52 views19:04

Low Level CO 🇨🇴

Evading Elastic EDR's call stack signatures with call gadgets

#call_stack #call_gadgets #edr_bypass #edr_evasion #maldev

https://offsec.almond.consulting/evading-elastic-callstack-signatures.html

50 views06:30

Low Level CO 🇨🇴

Polymorphic Obfuscation

This example demonstrates basic polymorphic obfuscation techniques, including encryption, variable code structure, and behavioral adaptation.

#obfuscate #polymorphic #edr_bypass

Gist

This example demonstrates basic polymorphic obfuscation techniques, including encryption, variable code structure, and behavioral…

This example demonstrates basic polymorphic obfuscation techniques, including encryption, variable code structure, and behavioral adaptation. - polymorphic-obfuscation.md

56 views06:33

Low Level CO 🇨🇴

Forwarded from Proxy Bar

0:10

This media is not supported in your browser

VIEW IN TELEGRAM

CARDERS !!!

41 views10:14

Low Level CO 🇨🇴

EDR bypasses techniques written in Rust for Windows 10
#rust #malware_development #maldev

https://github.com/Arasimnida/EDR-bypass-rs

GitHub

GitHub - Arasimnida/EDR-bypass-rs: EDR bypasses techniques written in Rust for Windows 10

EDR bypasses techniques written in Rust for Windows 10 - Arasimnida/EDR-bypass-rs

52 views14:03

Low Level CO 🇨🇴

Moufilrr

Moufiltr is a Windows kernel filter driver which will attach to your mouse driver stack pipeline and allows you to filter or modify your mouse input.

#minifilter_driver #minidriver #windows_kernel

GitHub

GitHub - Devilasa/Moufiltr: Moufiltr is a Windows kernel filter driver which will attach to your mouse driver stack pipeline and…

Moufiltr is a Windows kernel filter driver which will attach to your mouse driver stack pipeline and allows you to filter or modify your mouse input. - Devilasa/Moufiltr

49 views14:14

Low Level CO 🇨🇴

Proxy: Next Generation Polymorphism in C++
#polymorphic #obfuscation

https://github.com/microsoft/proxy

GitHub

GitHub - microsoft/proxy: Proxy: Next Generation Polymorphism in C++

Proxy: Next Generation Polymorphism in C++. Contribute to microsoft/proxy development by creating an account on GitHub.

55 views18:58

Low Level CO 🇨🇴

Low Level CO 🇨🇴 pinned «Proxy: Next Generation Polymorphism in C++ #polymorphic #obfuscation @ZwLowLevel https://github.com/microsoft/proxy»

19:19

Low Level CO 🇨🇴

A novel technique to instantly retrieve Windows kernel base address with a single instruction

#include <ntddk.h>
#include <intrin.h>
 
  NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
  {
      UNREFERENCED_PARAMETER(pRegistryPath);
 
      // Get kernel base address
      uintptr_t kernel_base = __readmsr(0xC0000082) & ~0xFFFFFF;
 
      DbgPrint("[+] ntoskrnl.exe base: 0x%llx\n", kernel_base);
 
      // Verify it's a valid PE
      PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)kernel_base;
      PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(kernel_base + dos->e_lfanew);
 
      DbgPrint("[+] Image size: 0x%x (%u MB)\n",
               nt->OptionalHeader.SizeOfImage,
               nt->OptionalHeader.SizeOfImage / (1024 * 1024));
 
      pDriverObject->DriverUnload = DriverUnload;
      return STATUS_SUCCESS;
  }
 
  void DriverUnload(PDRIVER_OBJECT pDriverObject)
  {
      UNREFERENCED_PARAMETER(pDriverObject);
      DbgPrint("[-] Driver unloaded\n");
  }