Reversing Windows Container, episode II: Silo to Server Silo
https://blog.quarkslab.com/reversing-windows-container-part-ii-silo-to-server-silo.html
https://blog.quarkslab.com/reversing-windows-container-part-ii-silo-to-server-silo.html
Quarkslab
Reversing Windows Container, episode II: Silo to Server Silo - Quarkslab's blog
This second article describes how to convert a Silo into a Server Silo in order to create a Windows Container. In addition, it dives into certain Kernel side Silo mechanisms.
An analysis of an obfuscated JavaScript malware package
https://stacklok.com/blog/analysis-of-an-obfuscated-code-attack-on-npms-package-registry
https://stacklok.com/blog/analysis-of-an-obfuscated-code-attack-on-npms-package-registry
Stacklok
Stacklok | Simple and Secure AI Tools
Understanding the PE+ File Format - Part 4: Entry Points and TLS Callbacks
https://www.youtube.com/watch?v=9K8WaZ53oOs
https://www.youtube.com/watch?v=9K8WaZ53oOs
YouTube
Understanding the PE+ File Format - Part 4: Entry Points and TLS Callbacks
In Part 4, we focus on the PE+ file format's entry points, specifically the AddressOfEntryPoint and TLS callbacks. The video covers how to find the AddressOfEntryPoint, its role, and entry points' precedence. It also explains locating the IMAGE_TLS_DIRECTORY…
PCIe Part 2 - All About Memory: MMIO, DMA, TLPs, and more!
https://ctf.re/kernel/pcie/tutorial/dma/mmio/tlp/2024/03/26/pcie-part-2/
https://ctf.re/kernel/pcie/tutorial/dma/mmio/tlp/2024/03/26/pcie-part-2/
Reversing Engineering for the Soul
PCIe Part 2 - All About Memory: MMIO, DMA, TLPs, and more!
Diving into how PCIe devices transfer data (Part 2 of the series)
Windows Address Translation Deep Dive – Part 1
https://bsodtutorials.wordpress.com/2021/06/14/windows-address-translation-deep-dive-part-1/
https://bsodtutorials.wordpress.com/2021/06/14/windows-address-translation-deep-dive-part-1/
Machines Can Think
Windows Address Translation Deep Dive – Part 1
This is one of the most fundamental topics which you should read about while you’re debugging. The topic will be far too long to write into one post so I’m planning to split it into at …
Order of Six Angles
Unpacking VIDAR using Time-Travel Debugging (TTD) in WinDbg Preview https://www.youtube.com/watch?v=HcyCZPNO3qI
YouTube
Dr Josh Stroschein - The Cyber Yeti
You've found the Cyber Yeti! Here I host free cybersecurity educational content focused on malware analysis, reverse engineering and ethical hacking.
Ways to connect:
Twitter: https://twitter.com/jstrosch
LinkedIn: https://www.linkedin.com/in/joshstroschein/
Ways to connect:
Twitter: https://twitter.com/jstrosch
LinkedIn: https://www.linkedin.com/in/joshstroschein/
Malware Development Workshop (17 апреля, бесплатно)
https://us06web.zoom.us/webinar/register/WN_GjWVolQiRDi7zdLA9gJgWg#/registration
https://us06web.zoom.us/webinar/register/WN_GjWVolQiRDi7zdLA9gJgWg#/registration
This is a repository with sample malduck🦆 config extraction modules. By utilizing them you should be able to extract embedded configuration from unpacked malware samples of: njrat, remcos, revil, graphicalproton
https://github.com/CERT-Polska/malduck-modules
https://github.com/CERT-Polska/malduck-modules
GitHub
GitHub - CERT-Polska/malduck-modules
Contribute to CERT-Polska/malduck-modules development by creating an account on GitHub.
Escaping the Safari Sandbox:
A tour of WebKit IPC (презентация)
https://www.synacktiv.com/sites/default/files/2024-05/escaping_the_safari_sandbox_slides.pdf
A tour of WebKit IPC (презентация)
https://www.synacktiv.com/sites/default/files/2024-05/escaping_the_safari_sandbox_slides.pdf
Extracting data from encrypted virtual disks: six methods
https://news.sophos.com/en-us/2024/05/13/extract-data-from-encrypted-vms/
https://news.sophos.com/en-us/2024/05/13/extract-data-from-encrypted-vms/
Sophos News
Extracting data from encrypted virtual disks: six seven methods
For incident responders, a variety of techniques for information retrieval from locked-up VMs
Fuzzing Android binaries using AFL++ Frida Mode
https://valsamaras.medium.com/fuzzing-android-binaries-using-afl-frida-mode-57a49cf2ca43
https://valsamaras.medium.com/fuzzing-android-binaries-using-afl-frida-mode-57a49cf2ca43
Medium
Fuzzing Android binaries using AFL++ Frida Mode
You might find this to be a fitting prologue to my earlier post on Creating and using JVM instances in Android C/C++ applications… and you…