Source Byte

Reverse Engineering Dark Souls 3 Networking: A DarkSouls fan wrote his own DS3OS server for the second and third parts. A series of articles about how he managed to reverse engineer the game’s network stack. Link

C2 Development Series 4/4 credit : @preemptdev [ 01 ] Introduction [ 02 ] The C2 Architecture [ 03 ] Building the Team Server [ 04 ] Writing a C2 Implant #C2 , #red_team , ——— @islemolecule_source

Happy Nowruz everyone 🫰🏻 This year was a great year for me , I find valuable friends, and develop my personality a lot . I wish for all of you great year and reaching your goals. Best regards ana🤍 What is Nowruz? TLDR: Nowruz means “new day” in Persian, also known as Persian New Year. More than 300 million people worldwide celebrate Nowruz including Afghanistan, India, Iran, Iraq, Kazakhstan, Pakistan, Tajikistan, and Turkey...

Command Line Argument Spoofing

The PEB of a process holds the command line arguments of a process. This PEB resides in usermode which means that we can spoof our command line arguments as an unprivileged user.

https://kwcsec.gitbook.io/the-red-team-handbook/techniques/defense-evasion/misdirection/command-line-argument-spoofing

سلام و درود فرا رسیدن عید نوروز رو از صمیم قلب به شما همراهان گرامی تبریک می‌گوییم، با آرزوی بهترین‌ها برای شما در این سال نو 💥✨ 📌 پاسخ دهی به تیکت ها در ایام عید بدون تغییر روال کاری همه روزه انجام می‌شود. Hello and greetings We sincerely congratulate you dear companions on the arrival of Nowruz, wishing you the best in this new year 💥✨ 📌 Answering tickets during Eid is done every day without changing the work routine. Best Regards, Hide01

HyperDbg v0.8.2 is now released! 🔥 This update brings support for functions in the script engine. Read more: https://docs.hyperdbg.org/commands/scripting-language/constants-and-functions ## [0.8.2.0] - 2024-03-19 New release of the HyperDbg Debugger. ### Added - Add user-defined functions and variable types in script engine ### Changed - Fix debuggee crash after running the '.debug close' command on the debugger - The problem with adding edge MTRR pages is fixed - All compiler/linker warnings of kernel-mode modules are fixed - User/Kernel modules of HyperDbg now compiled with "treat warning as error" - After downloading new symbols it is automatically loaded - Fix error messages/comments spelling typos

if you want to using Function stomping technique you have to know this about windows:

Kernel32.dll, a common DLL, might have different addresses in two processes(ASLR), but functions like VirtualAlloc, exported from Kernel32.dll, will have the same address in both processes.

example: Link

[ Testing LFI in Windows: How I (never) got a $30000 bounty ] Another great post by adeadfed! https://adeadfed.com/posts/testing-lfi-in-windows-how-i-never-got-a-30000-bounty/

One of the "essential" windows auditing tools, add my other favorites like rpcview, process hacker, sysinternals, ghidra, wireshark xpe viewer, windbg, imhex and visual studio. Get James Forshaw's NtObjectManager thing too, seems useful for parsing MIDL like rpcviewer. PipeViewer - A Tool That Shows Detailed Information About Named Pipes In Windows https://github.com/cyberark/PipeViewer credit : Eviatar Gerzi #tweet , source

A very good introductory series of articles examining the process of driver development for Windows (NT): Part 1, part 2,.... (The material is old, but gold) #windows #drivers

مردان واقعی از دیس اسمبلر قاسمی استفاده میکنند

NIST Cybersecurity Framework https://www.youtube.com/playlist?list=PLxC28bkWNxkM1AVwmhF0Xfbs8F-NMox0I

Scorpio-Windows.Internals.(2020)

https://github.com/BlackHat-Ashura/Reflective_DLL_Injection Program to Inject a DLL into a process from memory

List of callbacks and codes that we can use them to execute shellcode (Alternative Shellcode Execution Via Callbacks) https://github.com/aahmad097/AlternativeShellcodeExec #malware_dev

Blinding EDR On Windows https://synzack.github.io/Blinding-EDR-On-Windows/ #edr