UEFI scanner brings Microsoft Defender ATP protection to a new level

https://www.microsoft.com/security/blog/2020/06/17/uefi-scanner-brings-microsoft-defender-atp-protection-to-a-new-level

@reverseengine

OSX.EvilQuest Uncovered analyzing a new piece of mac ransomware and more!

https://objective-see.com/blog/blog_0x59.html

@reverseengine

efiSeek for Ghidra

https://github.com/DSecurity/efiSeek

@reverseengine

How to unc0ver a 0-day in 4 hours or less

https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html

@reverseengine

Stealthy Windows audio-capture tool

https://github.com/Drew-Alleman/wiretap

@reverseengine

Cracking BattlEye packet encryption

https://secret.club/2020/06/19/battleye-packet-encryption.html

@reverseengine

The Intezer Analyze IDA Pro plugin is now available to community users

https://intezer.com/blog/intezer-analyze/ida-pro-plugin-now-available-to-the-community

@reverseengine

ببخشید، امتحان های دانشگاه هست، نمیرسم بعد از این که تموم شدن قوی تر ادامه میدیم.

Sorry, I have university exams, I couldn't make it. We'll continue stronger after they're over.

0⃣🎄 01001000 01100001 01110000 01110000 01111001 00100000 01001110 01100101 01110111 00100000 01011001 01100101 01100001 01110010 🎅🏻1⃣

حالم اصن خوب نیست خودتون دلیلشو میدونید وقتی خوب شدم دوباره فعالیت مثل قبل میشه عذر میخام💔

I'm not feeling well at all. You know the reason. When I get better, I'll be back to being active like before. I apologize🖤

امیدوارم حالتون خوب باشه برادرها و خواهرای من، به زودی دوباره شروع می‌کنیم 🖤

I hope you are well my brothers and sisters, we will start again soon ❤️‍🩹

How LLMs feed Your RE Habit

https://clearbluejar.github.io/posts/how-llms-feed-your-re-habit-following-the-uaf-trail-in-clfs

@reverseengine

19 Shades of LockBit5.0

https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit5.0-inside-the-latest-cross-platform-ransomware-part-1

@reverseengine

سیستم‌ عامل برای مهندسی معکوس

🟢 1️⃣ Process پروسه

Process =
یک برنامه در حال اجرا
وقتی یک فایل اجرایی اجرا میشه
سیستم‌عامل یک Process میسازه به اون PID میده یک فضای حافظه جدا اختصاص میده رجیسترها و context مخصوص داره

هر Process:

حافظه جدا داره
Stack و Heap
جدا داره

ماژول‌ها (DLL / SO) خودش رو داره

داخل مهندسی معکوس مهمه چرا:
چون باینری که تحلیل میکنید داخل یک Process اجرا میشه و همه چیز داخل همین فضا اتفاق میوفته



Operating System for Reverse Engineering

🟢 1️⃣ Process

Process = A running program
When an executable file is executed
The operating system creates a Process, gives it a PID, allocates a separate memory space, and has its own registers and context

Each Process:

Has a separate memory

Has a separate Stack and Heap

Has its own modules (DLL / SO)

Why is reverse engineering important:

Because the binary you are analyzing is executed inside a Process and everything happens inside this space

@reverseengine

🟢 2️⃣ Thread

Thread =
واحد اجرای داخل Process
هر Process حداقل یک Thread داره

هر Thread:
Stack جدا داره
رجیسترهای جدا دارد

ولی حافظه Process مشترک است

خیلی مهم: چون بعضی رفتارها داخل Threadهای جدا اجرا میشن و در دیباگ باید Thread درست رو دنبال کنید



🟢 2️⃣ Thread

Thread = Unit of execution within a Process

Each Process has at least one Thread

Each Thread:
Has a separate Stack
Has separate registers

But the Process memory is shared

Very important: Because some behaviors are executed in separate Threads and in debugging you must follow the correct Thread

@reverseengine

تا اینجا، اسمبلی رو کامل یاد گرفتیم، هرچی نیاز بود، و گفتم و الان نوبت یاد گرفتن سیستم عامله، این بخش خیلی مهمه.

So far, we have learned assembly completely, everything we needed, and now it's time to learn the operating system. This is a very important part.

Tracking malicious code execution in Python
https://rushter.com/blog/python-code-exec

@reverseengine

A Ghidra processor module for the EFI Byte Code (EBC)

https://github.com/meromwolff/Ghidra-EFI-Byte-Code-Processor

@reverseengine

Tools used during the reversing of the Nikon firmware

https://github.com/simeonpilgrim/nikon-firmware-tools

@reverseengine

Cracking BattlEye packet encryption

https://secret.club/2020/06/19/battleye-packet-encryption.html

@reverseengine

Thread-Name Calling - A new process injection technique using Thread Name.

The code to be injected is passed as a thread denoscription to the target

https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/

@reverseengine