Source Byte

A very quick look inside win32k_rs by Cindy Xiao REcon 2023 #slide #win32k @cafe_security

Offensive Mobile Reversing and Exploitation From BLACKHAT [ Download ]

post updated : part 21 added Getting started with Event Tracing for Windows in C# credit : Alex Khanin https://medium.com/@alexkhanin/getting-started-with-event-tracing-for-windows-in-c-8d866e8ab5f2

Bypassing PESieve and Moneta (The "easy" way....?) It contains several parts. Lockd: This is the main Gargoyle component sRDI-Master: This has been slightly re worked to provide a free mechanism. test.profile: This sample profile shows required options to work ShellcodeRDI.py: This is the altered python generator with the new sRDI assembly Blog GitHub #maldev

PE-LiteScan (or PELS) is a simple heuristic analyzer for common PE-anomalies, specifically focusing on the detection of packers and protectors. Designed for Windows and Linux. https://github.com/DosX-dev/PE-LiteScan

updated : part 19 & 20 added - New Perspectives on ETW Patching Telemetry - Malware academy : ( modules 12 - 17 )

+ Event Tracing For Windows - Introduction + Event Tracing For Windows - ETW Tools + Event Tracing For Windows - ETW Bypass Via Byte Patching + Event Tracing For Windows - Improved Patching + Event Tracing for Windows - Patchless ETW Bypass Via HBPs + Event Tracing For Windows - ETW Provider Session Hijacking

guys if anyone have this maldev academy modules will be great to share them on the group so i can add and make this ETW series more complete :)

updated : part 19 added New Perspectives on ETW Patching Telemetry

The art of Fuzzing: Introduction https://bushido-sec.com/index.php/2023/06/19/the-art-of-fuzzing/ @cafe_security

Cindy Xiao - Reversing Rust Binaries #binary #reverse #slides ——— 🆔 @Infosec_Fortress

Skochinsky - Recon (2011) - Practical C++ Decompilation #reverse #binary #slides ——— 🆔 @Infosec_Fortress

new process injection technique called Mockingjay allows attackers to stealthily execute malicious code https://wins21.co.kr/kor/promotion/information.html?bmain=view&language=KOR&uid=4037 #injection

👾 Malware Development - Evading Diaries. • NTFS Files Attributes; • FuncIn; • Code Cave; • Stolen Certificate; • Redirect Antivirus Website Evading Techniques; • Shortcut Hiding; • Disabling Antivirus; • Adding Antivirus Exception; • Fake Signature; • Mark-Of-The-Web (MOTW) Bypass; • Return Address Spoofing; • Runtime Function Decryption; • DLL Unhooking; - How DLL Unhooking Works; - Unhooking Strategies; • Evasion Using Direct Syscalls; - Key Aspects of This Technique; - Operational Mechanism; - Featured Windows APIs; • Unloading Module With FreeLibrary; - Operational Overview; - Key Aspects of This Technique; - Featured Windows APIs; • References. #Malware

Fuzzer Internals https://blog.reodus.com/posts/fuzzer-internals-part1/ https://blog.reodus.com/posts/fuzzer-internals-part2/ https://blog.reodus.com/posts/fuzzer-internals-part3/ #fuzzing