Source Byte

Into the Rabbit Hole – Offensive DNS Tunneling Rootkits Dns Tunneling #Tunneling #exfiltration#DNS

چند تا write-up درباره باگ‌هایی که از کرنل Linux/Windows/macOS گزارش دادم و چگونه فازر کردنشون رو تو وبلاگم 👇 اینجا نوشتم. پست جدیدم رو هم به زودی همینجا مینویسم. R00tkitSMM https://r00tkitsmm.github.io/?s=09

SWAPPALA and Reflective DLL credit : Kyle Avery https://oldboy21.github.io/posts/2024/06/sleaping-issues-swappala-and-reflective-dll-friends-forever/

Malware Development, Analysis and DFIR Series PART III credit : Nithin Chenthur Prabhu Delve into Windows Memory Internals! Explore virtual address spaces, process internals and memory models for a deeper understanding of memory forensics & malware analysis! https://azr43lkn1ght.github.io/Malware Development, Analysis and DFIR Series

fuzzer-internals from One of my lovely friends https://blog.reodus.com/posts/fuzzer-internals-part1/ #fuzzer #internals

Hello everyone, I've made a somehow big update in the HyperDbg. Now, it utilizes a dedicated HOST IDT and HOST GDT, different than the Windows IDT/GDT. This update will address a specific category of bypasses for HyperDbg, although there are still many bypasses to address. This change influences the handling of interrupts, especially NMIs for halting cores in VMX root-mode. lt may introduce instability issues in various systems, potentially leading to crashes. If you're using HyperDbg, please switch to the 'dev' branch and re-build and test it to help us identify any problems. Currently, it works well on my 12th Gen machine, but I'm uncertain if it's universally stable. If you encounter any crashes or BSODs, please notify me before the release of v0.9 (the next version). The best way to test it is using events (EPT hooks) with a high rate of execution (e.g., using !epthook on nt!ExAllocatePoolWithTag and meanwhile pause the debuggee). The 'dev' branch: https://github.com/HyperDbg/HyperDbg/tree/dev GitHub built artifact for those who can't build: https://github.com/HyperDbg/HyperDbg/actions/runs/9384856535

Table of contents Syntax Comments Assembly Language Statements Syntax of Assembly Language Statements Example: Hello World Program in Assembly Compiling and Linking Sections Processor Registers System Calls Strings String Instructions Repetition Prefixes Numbers BCD Representation Instructions: Conditions CMP Instruction Conditional Jump Instructions (Signed Data) Conditional Jump Instructions (Unsigned Data) Special Conditional Jump Instructions Addressing Modes MOV Instruction File Handling Example: Reading from a File Stack and Memory Stack and Memory Tools for Analysis Code Injection Attack DLL Injection APC Injection Valid Accounts System Binary Proxy Execution: Rundll32 Reflective code loading Modify Registry Process Injection Mark-Of-The-Web (MOTW) Bypass Access Token Manipulation Hijack Execution Flow Resources

IDA Pro Version 8.3 (with tools, sdk + keygen for x86_x64, ARM, ARM64, PPC, PPC64, and MIPS decompilers! )

Windows PE权威指南

Heavenly.exe

is the main process that generates the anti-killing loader. It reports viruses normally and does not contain malicious code. To ensure anti-killing performance, the source code is not open. It will be updated to 2.0 later.

GitHub

Avoiding Memory Scanners credit : Kyle Avery https://kyleavery.com/posts/avoiding-memory-scanners/