Android Kernel Exploit CVE-2025-38352
1. In-the-wild Android Kernel Vulnerability Analysis + PoC
2. Extending The Race Window Without a Kernel Patch
3. Uncovering Chronomaly
1. In-the-wild Android Kernel Vulnerability Analysis + PoC
2. Extending The Race Window Without a Kernel Patch
3. Uncovering Chronomaly
#android_internals
#exploit_development
@ZwLowLevel
faith2dxy.xyz
CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC
Part 1 (This blog post) - In-the-wild Android Kernel Vulnerability Analysis + PoC Part 2 - Extending The Race Window Without a Kernel Patch CVE-2025-38352 was a…
Forwarded from Order of Six Angles
deep dive into an electronic detection and response system deployed by China’s security agencies
https://netaskari.substack.com/p/chinas-guardian-of-secrets
https://netaskari.substack.com/p/chinas-guardian-of-secrets
Substack
China's guardian of secrets: 保密管理系统
NetAskari got exclusive access to internal software used by Chinese security agencies to control data leakage from the internal government network.
Time(less) LAPS: Securing persistent anonymous access to local administrator passwords
The
The
RecoveryMode mechanism in Windows LAPS allows local administrator passwords to be decrypted using remote ‘decryptors’. #windows_internals
#windows_security
#reverse_engineering
#reversing
@ZwLowLevel
HackMag
Time(less) LAPS: Securing persistent anonymous access to local administrator passwords
Tech magazine for cybersecurity specialists
Golden Byte
Time(less) LAPS: Securing persistent anonymous access to local administrator passwords The RecoveryMode mechanism in Windows LAPS allows local administrator passwords to be decrypted using remote ‘decryptors’. #windows_internals #windows_security #rev…
Docs
Windows LAPS overview
Get an overview of Windows Local Administrator Password Solution (Windows LAPS), including key scenarios and setup and management options.
Low Level CO 🇨🇴 pinned «Time(less) LAPS: Securing persistent anonymous access to local administrator passwords The RecoveryMode mechanism in Windows LAPS allows local administrator passwords to be decrypted using remote ‘decryptors’. #windows_internals #windows_security #rev…»
JavaScript, MSBuild, and the Blockchain: Anatomy of the NeoShadow npm Supply-Chain Attack
#malware_analysis
@ZwLowLevel
www.aikido.dev
NeoShadow npm Supply-Chain Attack: JavaScript, MSBuild & Blockchain
A deep technical analysis of the NeoShadow npm supply-chain attack, detailing how JavaScript, MSBuild, and blockchain techniques were combined to compromise developers.
Fibratus
Adversary tradecraft detection, protection, and hunting
Adversary tradecraft detection, protection, and hunting
#cyber_threat_intelligence
#cti
#malware_analysis
@ZwLowLevel
Forwarded from Proxy Bar
Hi everyone! Does anyone know how to get the image base address from a remote process without using NtQueryInformationProcess? If you know, please let me know. Thanks in advance.
Amadey Malware: A Comparative Study of Static Detection vs Memory-Based Detection
#malware_analysis
@ZwLowLevel
Code Before Breach
Amadey Malware: A Comparative Study of Static Detection vs Memory-Based Detection
Using Amadey as a case study, this post compares static signature detection and memory-based detection through structure, evasion difficulty, and YARA usage.
Injecting DLLs in Rust: A Hands-On Guide to Classic Remote Thread Injection
#malware_development
#malwaredev
#maldev
@ZwLowLevel
Medium
Injecting DLLs in Rust: A Hands-On Guide to Classic Remote Thread Injection
DLL injection is a well-known Windows technique that allows one process to load a dynamic-link library (DLL) into another process’s address…
Malicious NPM Packages Deliver NodeCordRAT
#malware_analysis
#cyber_threat_intelligence
#cti
@ZwLowLevel
Zscaler
Malicious NPM Packages Deliver NodeCordRAT | ThreatLabz
ThreatLabz identified malicious NPM packages that deliver NodeCordRAT, which performs credential theft and steals cryptocurrency wallet data.
Low Level CO 🇨🇴 pinned «PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026 #windows_internals #windows_kernel #reverse_engineering #reversing @ZwLowLevel »
Tutorial: DLL Sideloading and function proxying with ShellcodePack
#malware_development
#maldev
#malwatedev
@ZwLowLevel
Medium
Tutorial: DLL Sideloading and function proxying with ShellcodePack
DLL sideloading is a technique that allows an attacker to have a legitimate signed application run some malicious code on Windows. It work…
Debugging WinDbg with WinDbg: Fixing a Ctrl-C UI Freeze
https://www.island.io/blog/debugging-windbg-with-windbg-fixing-a-ctrl-c-ui-freeze
https://www.island.io/blog/debugging-windbg-with-windbg-fixing-a-ctrl-c-ui-freeze
#reversing
#reverse_engineering
@ZwLowLevel
Island.io
Fixing the Windows Debugger freeze when copying text
Follow an Island engineer’s deep dive into fixing a years-old Windows Debugger issue - the few-second freeze when copying text from WinDbg.