Exploiting Windows Kernel
CVE-2023–28218
https://theori.io/blog/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218
@reverseengine
CVE-2023–28218
https://theori.io/blog/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218
@reverseengine
theori.io
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218) - Theori BLOG
At Hexacon 2023, we presented our Windows kernel security research, uncovering CVE-2023-28218, a heap overflow in afd.sys. Read our exploit analysis and methodology. | Vulnerability Research
❤1
Hypervisors for Memory Introspection and Reverse Engineering
https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html
@reverseengine
https://secret.club/2025/06/02/hypervisors-for-memory-introspection-and-reverse-engineering.html
@reverseengine
secret club
Hypervisors for Memory Introspection and Reverse Engineering
Introduction
❤1
Ghidra Bare Metal Frimware Analysis
https://blog.attify.com/analyzing-bare-metal-firmware-binaries-in-ghidra
@reverseengine
https://blog.attify.com/analyzing-bare-metal-firmware-binaries-in-ghidra
@reverseengine
Attify Blog - IoT Security, Pentesting and Exploitation
Ghidra bare metal firmware analysis
Reverse engineering firmware binaries often entails going through the datasheet, compiler headers to set up the base address and memory map correctly.
❤1
Native Function and Assembly Code Invocation
https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation
@reverseengine
https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation
@reverseengine
Check Point Research
Native function and Assembly Code Invocation - Check Point Research
Introduction For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. While in some cases it is just possible to understand the function logic and reimplement it in a higher-level…
❤1
LayeredSyscall – Abusing VEH to Bypass EDRs
https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs
@reverseengine
https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs
@reverseengine
White Knight Labs
LayeredSyscall - Abusing VEH to Bypass EDRs | White Knight Labs
Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows.
❤2
Reverse Engineering 3011: Reversing C++ Binaries
https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+RE3011_re_cpp+2022_v1/about?s=09
@reverseengine
https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+RE3011_re_cpp+2022_v1/about?s=09
@reverseengine
p.ost2.fyi
Reverse Engineering 3011: Reversing C++ Binaries
The course will explain C++ reverse engineering topics including techniques and tools for researching C++ Binaries.
❤2
Detecting Crypto-Ransomware in IoT Networks Based on Energy Consumption Footprint
https://www.researchgate.net/publication/319252402_Detecting_crypto-ransomware_in_IoT_networks_based_on_energy_consumption_footprint
@reverseengine
https://www.researchgate.net/publication/319252402_Detecting_crypto-ransomware_in_IoT_networks_based_on_energy_consumption_footprint
@reverseengine
ResearchGate
(PDF) Detecting crypto-ransomware in IoT networks based on energy consumption footprint
PDF | An Internet of Things (IoT) architecture generally consists of a wide range of Internet-connected devices or things such as Android devices, and... | Find, read and cite all the research you need on ResearchGate
❤2
Racing bugs in Windows kernel
https://dannyodler.hashnode.dev/racing-bugs-in-windows-kernel
@reverseengine
https://dannyodler.hashnode.dev/racing-bugs-in-windows-kernel
@reverseengine
❤2
Aiding Reverse Engineering with Rust and a local LLM
https://security.humanativaspa.it/aiding-reverse-engineering-with-rust-and-a-local-llm
@reverseengine
https://security.humanativaspa.it/aiding-reverse-engineering-with-rust-and-a-local-llm
@reverseengine
HN Security
Aiding reverse engineering with Rust and a local LLM - HN Security
Offensive Rust series article that introduces a new AI tool (oneiromancer) to aid with reverse engineering.
❤3
Reverse Engineering Android Apps for API Keys
https://pwn.guide/free/forensics/re-android
@reverseengine
https://pwn.guide/free/forensics/re-android
@reverseengine
pwn.guide
Reverse Engineer Android Apps for API Keys
How to reverse engineer Android apps & find confidential API Keys
❤3
Bypassing Windows Defender antivirus in 2025: Evasion Techniques Using Direct Syscalls and XOR Encryption
https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025
@reverseengine
https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025
@reverseengine
Hackmosphere
Windows Defender antivirus bypass in 2025 - part 1
Discover how antivirus works and how to setup a lab for (Windows Defender) antivirus bypass. Basic code is provided to start experimenting !
❤2
Disassembling a Binary: linear Sweep and Recursive Traversal
https://nicolo.dev/en/blog/disassembling-binary-linear-recursive
@reverseengine
https://nicolo.dev/en/blog/disassembling-binary-linear-recursive
@reverseengine
nicolo.dev
Disassembling a binary: linear sweep and recursive traversal
Building your own set of analysis tools is a great exercise for those who already have some basics and allows you to later move on to implement more targeted analyses in reverse engineering. Even just seeing how the different algorithms can be implemented…
❤2