Orca Cyber Weapons
رفتن به کانال در Telegram
Orca Cyber Weapons: Security Research World ~ "Content for educational purposes." check our community if you are interesting about Security Researching https://t.me/VulnerabilityResearchers - кибербезопасность admin: @x86byte
نمایش بیشتر1 318
مشترکین
اطلاعاتی وجود ندارد24 ساعت
+37 روز
+1230 روز
در حال بارگذاری داده‌ها
کانال‌های مشابه
![RME-DisCo @ UNIZAR [www.reversea.me]](https://cdn.tlmtr.io/_next/image?url=https%3A%2F%2Fimg.telemetr.io%2Fc%2F1yS5QI%2F5954169611656212876%3Fty%3Dx&w=96&q=75){kind=small}
ابر برچسب‌ها
اشارات ورودی و خروجی
---
---
---
---
---
---
جذب مشترکین
نوامبر '26نوامبر '26
نوامبر '26
+2
در 0 کانال‌ها
اکتبر '26
+862
در 0 کانال‌ها
Get PRO
سپتامبر '260
در 0 کانال‌ها
Get PRO
اوت '260
در 0 کانال‌ها
Get PRO
ژوئیه '260
در 0 کانال‌ها
Get PRO
ژوئن '260
در 0 کانال‌ها
Get PRO
مه '260
در 0 کانال‌ها
Get PRO
آوریل '260
در 0 کانال‌ها
Get PRO
مارس '260
در 1 کانال‌ها
Get PRO
فوریه '260
در 1 کانال‌ها
Get PRO
ژانویه '260
در 0 کانال‌ها
Get PRO
دسامبر '250
در 1 کانال‌ها
Get PRO
نوامبر '250
در 2 کانال‌ها
Get PRO
اکتبر '250
در 0 کانال‌ها
Get PRO
سپتامبر '250
در 1 کانال‌ها
Get PRO
اوت '250
در 0 کانال‌ها
Get PRO
ژوئیه '250
در 0 کانال‌ها
Get PRO
ژوئن '250
در 0 کانال‌ها
Get PRO
مه '250
در 3 کانال‌ها
Get PRO
آوریل '250
در 0 کانال‌ها
Get PRO
مارس '25
+31
در 0 کانال‌ها
Get PRO
فوریه '25
+34
در 0 کانال‌ها
Get PRO
ژانویه '25
+31
در 0 کانال‌ها
Get PRO
دسامبر '24
+39
در 0 کانال‌ها
Get PRO
نوامبر '24
+28
در 0 کانال‌ها
Get PRO
اکتبر '24
+24
در 1 کانال‌ها
Get PRO
سپتامبر '24
+207
در 0 کانال‌ها
Get PRO
اوت '240
در 0 کانال‌ها
Get PRO
ژوئیه '24
+219
در 0 کانال‌ها
| تاریخ | رشد مشترکین | اشارات | کانال‌ها | |
| 04 نوامبر | 0 | |||
| 03 نوامبر | 0 | |||
| 02 نوامبر | +1 | |||
| 01 نوامبر | +1 |
پست‌های کانال
BitBender: Automated Binary Unpacking & Deobfuscation
Hey everyone, Aftermath Labs just released a new tool for the community called BitBender. It’s an automated binary deobfuscation and unpacking service built specifically for malware and game-cheat analysis.
Here is what makes it stand out:
MCP Integration: It is built directly for IDA and Binary Ninja MCP workflows.
Core Engine: Powered by the BLARE2 framework, it automates unpacking and devirtualization to recover native code and executable structure.
Full Investigations: Beyond the automated tooling, they offer expert analysis and provide full technical reports for more complex targets.
Automating the unpacking phase helps bring your binaries back into focus so you and your AI agents have a much cleaner starting point. If you are tired of manually fighting packers before you can even begin your analysis, you can check it out at https://bitbender.io/
@OrcaCyberWeapons
| 2 | Public PoC for CVE-2026-102282, an adm-zip Local Privilege Escalation via SUID/SGID permission preservation.
https://github.com/x86byte/adm-zip_LPE-PoC | 372 |
| 3 | Static Devirtualization of Tencent VM by aftermathlabs
@OrcaCyberWeapons | 589 |
| 4 | Some bugs found via binary instrumentation and fuzzing by aftermathlabs
~"Using BLARE2 for binary instrumentation to guide fuzzing via coverage. Seems to work well, two discord/chromium crasher media files in 30min~ We can instrument arbitrary PE files (no source or debug info needed)." - aftermathlabs
https://github.com/aftermathlabs/discord-crasher
@OrcaCyberWeapons | 557 |
| 5 |  +1After a long wait, the BinaryHardening organization is finally back
GitHub Support confirmed that their abuse detection systems had flagged the account for manual review, and the restrictions have now been cleared
Everything is accessible again.
Glad to finally have it restored.
github: https://github.com/BinaryHardening
Discord server: https://discord.com/invite/gmJJ6737Us | 538 |
| 6 | Static Devirtualization of Tencent VM by
@BackEngineerLab
. Great read for anyone interested in VM-based obfuscation and devirtualization.
https://back.engineering/blog/31/07/2026/ | 861 |
| 7 | Update - GitHub flagged the org, cfgrip is on GitLab now:
https://gitlab.com/BinaryHardening/cfgrip
Appreciate everyone reaching out. GitLab's been solid, built in CI, container registry, group profile already up. Same code, nothing's stalled. | 1 183 |
| 8 | Binary Hardening just put out cfgrip v1.0.0 - https://github.com/BinaryHardening/cfgrip
It loads PE and ELF binaries (32 and 64-bit), disassembles everything with Capstone, traces through indirect calls via GOT lookups, jump tables, and backward register tracking, figures out function boundaries from entry points, exports, prolog signatures, exception tables and data section pointers. Outputs the whole control flow graph as JSON with three modes: full graph, entry-point reachable only, and a cleaned version with jump threading, dead block removal, stack deltas and cross-references
@OrcaCyberWeapons | 1 210 |
| 9 | A dive into the PE file format
https://0xrick.github.io/win-internals/pe1/
https://0xrick.github.io/win-internals/pe2/
https://0xrick.github.io/win-internals/pe3/
https://0xrick.github.io/win-internals/pe4/
https://0xrick.github.io/win-internals/pe5/
https://0xrick.github.io/win-internals/pe6/
[Mastering PE Structure for Malware Analysis: A Layman’s Guide](https://tech-zealots.com/malware-analysis/pe-portable-executable-structure-malware-analysis-part-2/)
[Peering Inside the PE: A Tour of the Win32 Portable Executable File Format](https://coffi.readthedocs.io/en/latest/peering_inside_pe.pdf)
https://0xrick.github.io/win-internals/pe8/
packages:
- c++ : https://lief.re/doc/stable/formats/pe/cpp.html
- rust : https://docs.rs/pe-parser/latest/pe_parser/
- python : https://pypi.org/project/pe-parser/
questions? :
- [What does "e_lfanew" mean in the DOS header for the PE format?](https://stackoverflow.com/questions/47711282/what-does-e-lfanew-mean-in-the-dos-header-for-the-pe-format)
- [Disassemble Windows PE .data section (using python)](https://stackoverflow.com/questions/58775954/disassemble-windows-pe-data-section)
- [Loading a 64-bit Windows PE file from memory](https://stackoverflow.com/questions/68988499/loading-a-64-bit-windows-pe-file-from-memory)
@OrcaCyberWeapons | 1 164 |
| 10 | We’re building a small community around binary security research, focused on things like:
- Reverse Engineering
- Binary Obfuscation / Deobfuscation
- Exploit Development
- Compiler / interpreters...
- Malware Analysis
- Binary Hardening research
we also work on open source tools and experiments here:
GitHub → BinaryHardening GitHub
Discord → BinaryHardening Discord
If low level stuff and weird binaries are ur thing, come join us
Always happy to meet more RE people | 2 462 |
| 11 | Post-Build PE Obfuscation
Obfusk8 includes a post-build script to further harden the compiled binary by removing forensic artifacts.
* Script Location: `Obfusk8/Obfusk8/SCRIPTS/obfuscate_pe.ps1 at main · x86byte/Obfusk8`
* What it does:
1. Strips the Rich Header — removes the MSVC build-environment fingerprint that reveals compiler version and toolchain details.
2. Spoofs the TimeDateStamp — replaces the PE header timestamp with a fixed value to obscure build time.
3. Clears the Debug Directory — wipes debug directory entries that could leak PDB paths or build metadata.
* Usage:
Run as a post-build step after compiling:
powershell PowerShell -NoProfile -ExecutionPolicy Bypass -File Obfusk8/SCRIPTS/obfuscate_pe.ps1 -Path "path\to\Obfusk8.exe"
The script modifies the binary in-place. No backup is created.
@OrcaCyberWeapons | 2 179 |
| 12 | Obfusk8 v1.5 released!
Enhanced AES string obfuscation with improved decryption reliability and stronger PE obfuscation hardening. Smoother, more resilient code protection.
https://github.com/x86byte/Obfusk8/releases/tag/v1.5 | 798 |
| 13 | https://prime.platacard.mx/file-service/static/
That's the Banco Plata S3 bucket we dumped earlier (platform-file-service-manager-prod-public in us-west-2). It serves financial documents: quarterly risk reports, signed Docusign contracts, Fitch/Moody's credit ratings, loan contracts, investment agreements, privacy policies — 849 files (156.4 MB). Authored by jorge.delacabada and Carlos Gonzalez.
@OrcaCyberWeapons | 980 |
| 14 | sbox
Compile-time AES string obfuscation for C++.
No XOR.
No delimiters.
No plaintext in .rdata.
https://github.com/x86byte/sbox | 1 028 |
| 15 | sbox - delimiter-less string obfuscation powered by compile-time AES
Plaintext literals are a signature. Standard string serialization using delimiters is easy to trace and trivial to reverse. I wrote sbox to handle both single-string and multi-string encryption at compile-time, ensuring that sensitive source data is never exposed in the constant pool.
The project ports the AES8 core from Obfusk8 to the NeetCode "Encode and Decode Strings" challenge.
The implementation passed NeetCode in 7ms.
- Static Stealth: Shreds both atomic literals and string arrays at compile-time. The strings utility returns high-entropy noise instead of rodata artifacts.
- Delimiter-less: Fixed-width headers and AES-128 blocks remove the need for predictable separators.
- Binary Safe: Handles raw payloads and null bytes without the overhead of split-logic.
Making static analysis irrelevant for a standard coding challenge.
sbox repo : https://github.com/x86byte/sbox | 898 |
| 16 | RE//verse 2026: Deobfuscation of a Real World Binary Obfuscator by James McGowan and Bas Zweers
@OrcaCyberWeapons | 1 244 |
| 17 |  +3ent8 Bin2bin Obfuscator answers about the @PELock question "but the question is - can it obfuscate ntoskrnl.exe" | 1 350 |
| 18 |  about the last x.com post:
https://x.com/x86byte/status/2029291022811799745 | 954 |
| 19 |  +1ent8 Bin2bin Obfuscator dev update: dead injections, loop obfs, NOT/PUSH/POP & anti-decompiler work but need polish.
fixing a wild bug where obfuscating C++ std libs bloats a 1MB binary to 11MB (no need for c++ stds obf), even though it incredibly still runs perfectly.
@OrcaCyberWeapons | 849 |
| 20 | GHOST IN THE SILICON: You're an admin on your machine, but you're still a guest in its house.
A lot of people still think Ring 0 (the Kernel) is the absolute ceiling of authority. If you have root, you have God mode, right? For cracked people(not one though), they know the real power lives in Ring -3.
There is a separate, invisible processor inside your Intel CPU running its own closed-source operating system usually a version of MINIX. This is the Intel Management Engine (ME).
It doesn't matter if your PC is off, your drive is encrypted with AES-256, or you're running the most hardened Linux distro. If the power cable is plugged in, the ME is awake.
It has its own independent network stack. It can bypass your OS-level firewall to send and receive data. It can see your RAM, your screen, and every single keystroke you type before your OS even knows they happened.
The Kill Switch Irony: The only reason we know how to soft-disable this is because the NSA requested a way to turn it off for their own high-security machines. It's called the HAP (High Assurance Platform) bit.
Even the guys who do the spying didn't trust a black-box OS living inside their silicon.
@OrcaCyberWeapons | 832 |
