ReverseEngineering

Windows Drivera Reverse Engineering Methodology https://voidsec.com/windows-drivers-reverse-engineering-methodology/ @reverseengine @reverseengine

https://www.falconops.com/blog/goexec-dcom-madness @reverseengine

Windows Remote Execution Multitool https://github.com/FalconOpsLLC/goexec @reverseengine

https://blog.elmo.sg/posts/breaking-disassembly-through-symbol-resolution/ @reverseengine

Loadable Kernel Module Linux https://github.com/Trevohack/Venom @reverseengine

Linux Kernel Rootkit https://github.com/carloslack/KoviD @reverseengine

این کنفرانس در زمینه ی مهندسی معکوس و توسعه اکسپلویت‌ هست This conference is about reverse engineering and exploit development. https://www.youtube.com/@reconmtl/videos @reverseengine

 BlackSuit Ransomware Actors Breached Corporate Environment https://cybersecuritynews.com/blacksuit-ransomware-vmware-esxi @reverseengine

بخش سوم بافر اور فلو

تفاوت های مهم بین استک هیپ و خطاهای off by one رو بررسی میکنیم توضیح stack overflow استک جاییه که فریم تابع ها قرار میگیره و معمولا بافر های محلی اینجا ساخته میشن استک overflow زمانی رخ میده که نوشته های بیش از اندازه به بافر محلی برسن و بخش هایی مثل saved rbp و saved return address رو بازنویسی کنه در عمل این نوع باعث کرش سریع میشه و معمولا به صورت overwrite روی فریم جاری قابل مشاهده هست توضیح کد استک در این کد یک تابع بافر محلی داره و با strcpy مقدار وارد شده رو کپی میکنه دیدن کرش و بررسی saved return address در gdb هست کد استک فایل demo_stack.c

#include <stdio.h> #include <string.h> void vuln(char *s) { char buf[32]; printf("inside vuln\n"); strcpy(buf, s); printf("buf says %s\n", buf); } int main(int argc, char **argv) { if (argc < 2) { printf("usage demo_stack input\n"); return 1; } vuln(argv[1]); printf("returned normally\n"); return 0; }

دستورات اجرا و دیباگ مربوط به استک این دستورات رو اجرا کنید تا کرش و فریم رو ببینید

gcc -g demo_stack.c -o demo_stack gdb --args ./demo_stack $(python3 -c "print('A'*80)")

داخل gdb

break vuln run info frame x/40gx $rbp backtrace



Part Three Buffer Overflow

We examine important differences between stack, heap, and off‑by‑one errors Explanation stack overflow The stack is where function frames are placed and local buffers are usually allocated A stack overflow occurs when writes exceed a local buffer and overwrite areas like saved rbp and the saved return address In practice this type causes a fast crash and is usually visible as an overwrite on the current frame Explanation stack code In this code a function has a local buffer and uses strcpy to copy the supplied input You will see the crash and inspect the saved return address in gdb Stack source file stack.c

#include <stdio.h> #include <string.h> void vuln(char *s) { char buf[32]; printf("inside vuln\n"); strcpy(buf, s); printf("buf says %s\n", buf); } int main(int argc, char **argv) { if (argc < 2) { printf("usage demo_stack input\n"); return 1; } vuln(argv[1]); printf("returned normally\n"); return 0; }

Commands to build and debug the stack Run these commands to see the crash and inspect the frame

gcc -g stack.c -o demo_stack gdb --args ./demo_stack $(python3 -c "print('A'*80)")

Inside gdb

break vuln run info frame x/40gx $rbp backtrace

@reverseengine

Awesome Malware Development

List of awesome reverse engineering resources https://github.com/wtsxDev/reverse-engineering @reverseengine

Deep Dive into a Modern Stealth Linux Kernel Rootkit https://blog.kyntra.io/Singularity-A-final-boss-linux-kernel-rootkit @reverseengine

Reverse engineering tools both offensive and defensive operations can utilize https://github.com/InfosecHouse/InfosecHouse/blob/main/re.md @reverseengine

Linux Kernel Exploitation https://r1ru.github.io/categories/linux-kernel-exploitation/ @reverseengine

ELF structure

PE Structure

Recon 2025 Breaking Obfuscated .NET Malware with Profiler Based Dynamic Binary Instrumentation https://www.youtube.com/watch?v=jPDJ_Zo6jiY @reverseengine