Source Byte

ساختار فایل PE قسمت ۱ – header ها https://mrpythonblog.ir/pe1/

Reverse engineering of Android Phoenix RAT Analysis: https://cryptax.medium.com/reverse-engineering-of-android-phoenix-b59693c03bd3 Phoenix overview: https://cryptax.medium.com/android-phoenix-authors-claims-sample-identification-and-trends-f199cbc9901d

"Introduction to Reverse Engineering with Ghidra" https://voidstarsec.com/ghidra.html#:~:text=Introduction%20to%20Reverse%20Engineering%20with%20Ghidra

 Initial Access Operations Part 2: Offensive DevOps https://www.blackhillsinfosec.com/initial-access-operations-part-2/

Keylogging in the Windows kernel with undocumented data structures https://eversinc33.com/posts/kernel-mode-keylogging/

Introducing APT-Hunter : Threat Hunting Tool via Windows Event Log https://shells.systems/introducing-apt-hunter-threat-hunting-tool-via-windows-event-log/ #tools

How we applied advanced fuzzing techniques to cURL https://blog.trailofbits.com/2024/03/01/toward-more-effective-curl-fuzzing/

Scam .pdf files https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-in-deceptive-pdf-the-gateway-to-malicious-payloads

Pelmeni Wrapper: New Wrapper of Kazuar (Turla Backdoor) https://lab52.io/blog/pelmeni-wrapper-new-wrapper-of-kazuar-turla-backdoor/

Несколько переведённых глав из книжки об операционной системе, разбирающейся в курсе: Глава 6. Блокировки https://habr.com/ru/articles/789478 Глава 5. Прерывания и драйверы устройств https://habr.com/ru/articles/791058 Глава 4. Прерывания и системные вызовы https://habr.com/ru/articles/791286 Глава 3. Таблицы страниц https://habr.com/ru/articles/792808 Инструменты для сборки и запуска xv6 под QEMU https://habr.com/ru/articles/794326 Глава 2. Устройство операционной системы https://habr.com/ru/articles/795735 Глава 1. Интерфейсы операционной системы https://habr.com/ru/articles/797557

MIT Operating System Engineering 6.1810(6.S081) Course labs, pdfs, books, links, videos included https://github.com/yaruwangway/6.S081 https://youtube.com/playlist?list=PLTsf9UeqkReZHXWY9yJvTwLJWYYPcKEqK&si=zt7GV6w5zFD-Vau4 CS 162 Berkley https://youtube.com/playlist?list=PLF2K2xZjNEf97A_uBCwEl61sdxWVP7VWC&si=iQHM_2XyWPerIW4P

Windows persistence mechanisms https://persistence-info.github.io/

Password : GREENARMOR

Lazarus exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools.CVE-2024-21338 Beyond BYOVD with an Admin-to-Kernel Zero-Day https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/

How we applied advanced fuzzing techniques to cURL https://blog.trailofbits.com/2024/03/01/toward-more-effective-curl-fuzzing/

open source RAT on the scene Xeno Rat https://www.cyfirma.com/outofband/xeno-rat-a-new-remote-access-trojan-with-advance-capabilities/ https://github.com/moom825/xeno-rat