Source Byte

The Source Chat group has been banned, but we’re back with a new space. Join us to continue our discussions, share knowledge, and stay ahead in the security world. Let’s keep moving forward! Group chat

we lost our previous group :( have no idea why , telegram is so strange

Defeating malware's Anti-VM techniques (CPUID-Based Instructions) By Sina Karvandi https://rayanfam.com/topics/defeating-malware-anti-vm-techniques-cpuid-based-instructions/

#reverse #IDA #hardware #research .title Mouse Adventures .text Wherein I delve into the internals of my no-name brand "Tecknet Hypertrak Gaming Mouse" in an attempt to write a cross-platform tool that can manipulate its configuration without having to use the awful Windows-only tool it's shipped with. In this first part we tear apart said tool to figure out how it communicates with the mouse. .comment Practical field story about "simple" hardware reverse engineering. Part 7 is noticeable as rare info about IDA's processor module creation. .data #1: Introduction #2: Extracting the Firmware #3: Writing a Disassembler #4: Writing a custom tool #5: Dumping and Parsing the USB Descriptors #6: Enabling the Bootloader #7: Writing an IDA Processor Module #8: Dissecting the USB Code and Unbricking the Mouse [ deprecated_bytes ]

https://github.com/ELMERIKH/PyinMemoryPE a python tool to run PE(exe/dll) on memory filelessly #redteam

New blog on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI bypass that identified by author in 2023. By taking control of CLR assembly loads, we can load assemblies from memory with no AMSI scan. https://securityintelligence.com/x-force/being-a-good-clr-host-modernizing-offensive-net-tradecraft/ Proof-of-concept for the AMSI bypass and an implementation of a CLR memory manager is on GitHub. We can implement custom memory routines and track all allocations made by the CLR. https://github.com/passthehashbrowns/Being-A-Good-CLR-Host #redteam #net #clr

Chrome Extension Security https://extensions.neplox.security #CVE-2024-10229

GoDefender

Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package.

https://github.com/EvilBytecode/GoDefender.git

Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 🔗 Link #binary #exploitation #virtualbox #pwn2own #cve #CVE_2023_21987 #CVE_2023_21991 ——— 🆔 @Infosec_Fortress

this year he ranked in top 3 :)

Lnk series 📄

+ Forensic Analysis of LNK Files https://belkasoft.com/forensic-analysis-of-lnk-files + Deep Dive: Analysis of Shell Link (.lnk) Files https://www.docguard.io/deep-dive-analysis-of-shell-link-lnk-binary-file-format-and-malicious-lnk-files/ Finding the LNK: Techniques and methodology for advanced analysis with Velociraptor https://www.rapid7.com/blog/post/2024/11/01/finding-the-lnk-techniques-and-methodology-for-advanced-analysis-with-velociraptor/ Exploring Windows Artifacts : LNK Files https://u0041.co/posts/articals/lnk-files-artifact/

Database Viewer and Exporter

This is a Python tool for viewing and exporting data from various databases and JSON files. It supports SQLite, MySQL, PostgreSQL, MSSQL, and JSON files. Users can also export query results in CSV or JSON formats. The tool is designed to handle encrypted data using multiple encryption algorithms and can decrypt data that has been encrypted with a combination of algorithms.

https://github.com/MrAmirRezaie/readDatabase