Centralized resource for listing and organizing known injection techniques and POCs

https://github.com/itaymigdal/awesome-injection

#redteam #malware #process #inject

Analyzing a Modern In-the-wild Android Exploit

https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html

#expdev #android #linux

CVE-2023-4047 Root Cause Analysis

https://www.richardosgood.com/posts/cve---2023---4047-root-cause-analysis/

#expdev #windows #1day #winrar

Advanced Root Detection & Bypass Techniques

In this blog, we will explore techniques related to root detection on Android devices and methods to bypass it. Our main focus will be on the strategies employed by app developers to protect their applications and prevent them from running on compromised devices.

https://8ksec.io/advanced-root-detection-bypass-techniques/

#mobile #android #reverse #frida #root #detection #bypass

Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device

https://boschko.ca/qemu-emulating-firmware/

#qemu #firmware

HEVD: How a simple K-TypeConfusion took me 3 months long to create a exploit? — Windows 11 (build 22621)

https://wafzsucks.medium.com/how-a-simple-k-typeconfusion-took-me-3-months-long-to-create-a-exploit-f643c94d445f

#expdev #windows #hevd #kaslr #smep

Local Privilege Escalation in the glibc's ld.so (CVE-2023-4911)

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

POC: https://github.com/leesh3288/CVE-2023-4911

#expdev #linux #lpe #Alexs3y

msdocviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA.

https://github.com/alexander-hanel/msdocsviewer

#tools #idapro #windows #api

PatchaPalooza uses the power of Microsoft's MSRC CVRF API to fetch, store, and analyze security update data. Designed for cybersecurity professionals, it offers a streamlined experience for those who require a quick yet detailed overview of vulnerabilities, their exploitation status, and more. This tool operates entirely offline once the data has been fetched, ensuring that your analyses can continue even without an internet connection.

https://github.com/xaitax/PatchaPalooza

https://patchapalooza.com

#expdev #helpers #tools

LdrLibraryEx a small x64 library to load dll's into memory.

https://github.com/Cracked5pider/LdrLibraryEx

#tools #redteam #dev

Use the free Microsoft bing's gpt with ida pro, to perform free analyzes!

https://github.com/p1ay8y3ar/idaBingGPTPlugin

#tools #reverse #idapro #ai

Reverse Engineering Go Binaries with Ghidra (Part 1)
https://forum.reverse4you.org/t/reverse-engineering-go-binaries-with-ghidra-part-1/20096/1

Reverse Engineering Go Binaries with Ghidra (Part 2)
https://forum.reverse4you.org/t/reverse-engineering-go-binaries-with-ghidra-part-2/20097

#reverse #ghidra #golang

VMProtect Source Code (Leaked 07.12.2023)

intel.cc and processors.cc included

mirror:
https://github.com/jmpoep/vmprotect-3.5.1

#tools #source #leaked #vmp #protector

Titan is a VMProtect devirtualizer

https://github.com/archercreat/titan

#tools #reverse #devirt #devirtualizer #vmp #protector

Mergen converts Assembly code into LLVM IR, a process known as lifting. It leverages the LLVM optimization pipeline for code optimization and constructs control flow through pseudo-emulation of instructions. Unlike typical emulation, Mergen can handle unknown values, easing the detection of opaque branches and theoretically enabling exploration of multiple code branches.

These capabilities facilitate the deobfuscation and devirtualization of obfuscated or virtualized functions. Currently in early development, Mergen already shows promise in devirtualizing older versions of VMProtect, with ambitions to support most x86_64 instructions.

https://github.com/NaC-L/Mergen

#llvm #lifting #vmprotect #tnaci

xVMP is an LLVM IR-based code virtualization tool, which fulfilled a scalable and virtualized instruction-hardened obfuscation. It supports multiple programming languages, and architectures. It is also compatible with existing LLVM IR-based obfuscation schemes (such as Obfuscator-LLVM).

xVMP is developer friendly. You only need to add annotations to the to-be-protected function in the source code, and xVMP can perform virtualization protection on the function during compilation.

https://github.com/GANGE666/xVMP

#virtualization #obfuscation #alekum

Keystone / Capstone Replacement

Nyxstone is a powerful assembly and disassembly library based on LLVM. It doesn’t require patches to the LLVM source tree and links against standard LLVM libraries available in most Linux distributions. Implemented as a C++ library, Nyxstone also offers Rust and Python bindings. It supports all official LLVM architectures and allows to configure architecture-specific target settings.

GitHub: https://github.com/emproof-com/nyxstone

Blog: https://www.emproof.com/introducing-nyxstone-an-llvm-based-disassembly-framework/

Thread-Name Calling - A new process injection technique using Thread Name.

The code to be injected is passed as a thread description to the target.

https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/

#redteam #inject

The installation package for IDA Pro 9.0 Beta 2 available without password.
https://out5.hex-rays.com/beta90_6ba923/

Forum for discussion:
https://forum.reverse4you.org/t/ida-pro-9-0-beta/20459

Chat for discussion:
https://xn--r1a.website/r0_chat/1

#tools #reverse #idapro #windows #linux #macos

DJI - The ART of obfuscation

https://blog.quarkslab.com/dji-the-art-of-obfuscation.html

#reverse #mobile #android #obfuscation

LayeredSyscall – Abusing VEH to Bypass EDRs

https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs

#redteam #edr #hook #bypass