Weaponizing Windows Syscalls as Modern, 32-bit Shellcode (DEF CON 30)

@reverseengine

Attacking the IPsec Standards in Encryption-only Configurations

https://eprint.iacr.org/2007/125.pdf

@reverseengine

Malicious-PixelCode

@reverseengine

Malicious PixelCode Delivery Technique

https://github.com/S3N4T0R-0X0/Malicious-PixelCode

@reverseengine

Windows Kernel Exploitation Fundamentals

@reverseengine

UEFI scanner brings Microsoft Defender ATP protection to a new level

https://www.microsoft.com/security/blog/2020/06/17/uefi-scanner-brings-microsoft-defender-atp-protection-to-a-new-level

@reverseengine

OSX.EvilQuest Uncovered analyzing a new piece of mac ransomware and more!

https://objective-see.com/blog/blog_0x59.html

@reverseengine

efiSeek for Ghidra

https://github.com/DSecurity/efiSeek

@reverseengine

How to unc0ver a 0-day in 4 hours or less

https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html

@reverseengine

Stealthy Windows audio-capture tool

https://github.com/Drew-Alleman/wiretap

@reverseengine

Cracking BattlEye packet encryption

https://secret.club/2020/06/19/battleye-packet-encryption.html

@reverseengine

The Intezer Analyze IDA Pro plugin is now available to community users

https://intezer.com/blog/intezer-analyze/ida-pro-plugin-now-available-to-the-community

@reverseengine

ببخشید، امتحان های دانشگاه هست، نمیرسم بعد از این که تموم شدن قوی تر ادامه میدیم.

Sorry, I have university exams, I couldn't make it. We'll continue stronger after they're over.

0⃣🎄 01001000 01100001 01110000 01110000 01111001 00100000 01001110 01100101 01110111 00100000 01011001 01100101 01100001 01110010 🎅🏻1⃣

حالم اصن خوب نیست خودتون دلیلشو میدونید وقتی خوب شدم دوباره فعالیت مثل قبل میشه عذر میخام💔

I'm not feeling well at all. You know the reason. When I get better, I'll be back to being active like before. I apologize🖤

امیدوارم حالتون خوب باشه برادرها و خواهرای من، به زودی دوباره شروع می‌کنیم 🖤

I hope you are well my brothers and sisters, we will start again soon ❤️‍🩹

How LLMs feed Your RE Habit

https://clearbluejar.github.io/posts/how-llms-feed-your-re-habit-following-the-uaf-trail-in-clfs

@reverseengine

19 Shades of LockBit5.0

https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit5.0-inside-the-latest-cross-platform-ransomware-part-1

@reverseengine

سیستم‌ عامل برای مهندسی معکوس

🟢 1️⃣ Process پروسه

Process =
یک برنامه در حال اجرا
وقتی یک فایل اجرایی اجرا میشه
سیستم‌عامل یک Process میسازه به اون PID میده یک فضای حافظه جدا اختصاص میده رجیسترها و context مخصوص داره

هر Process:

حافظه جدا داره
Stack و Heap
جدا داره

ماژول‌ها (DLL / SO) خودش رو داره

داخل مهندسی معکوس مهمه چرا:
چون باینری که تحلیل میکنید داخل یک Process اجرا میشه و همه چیز داخل همین فضا اتفاق میوفته



Operating System for Reverse Engineering

🟢 1️⃣ Process

Process = A running program
When an executable file is executed
The operating system creates a Process, gives it a PID, allocates a separate memory space, and has its own registers and context

Each Process:

Has a separate memory

Has a separate Stack and Heap

Has its own modules (DLL / SO)

Why is reverse engineering important:

Because the binary you are analyzing is executed inside a Process and everything happens inside this space

@reverseengine