USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation https://nebelwelt.net/publications/files/20SEC3.pdf #fuzzing #dukeBarman
Chronicles of a Sandbox Escape: Deep Analysis of CVE-2019-0880 https://byteraptors.github.io/windows/exploitation/2020/05/24/sandboxescape.html #windows #exploit #dukeBarman
ByteRaptors
Chronicles of a Sandbox Escape: Deep Analysis of CVE-2019-0880
Overview
Dynamic Data Resolver (DDR) — IDA Plugin 1.0 beta
Article: https://blog.talosintelligence.com/2020/05/dynamic-data-resolver-1-0.html
Source: https://github.com/Cisco-Talos/DynDataResolver
#reverse #IDA #dukeBarman
Article: https://blog.talosintelligence.com/2020/05/dynamic-data-resolver-1-0.html
Source: https://github.com/Cisco-Talos/DynDataResolver
#reverse #IDA #dukeBarman
Cisco Talos Blog
Dynamic Data Resolver (DDR) — IDA Plugin 1.0 beta
10/20/20 Update: A new version of this software and associated blog can be found here
Executive summary Static reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a…
Executive summary Static reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a…
MindShaRE: How to “Just Emulate It With QEMU” https://www.thezdi.com/blog/2020/5/27/mindshare-how-to-just-emulate-it-with-qemu #hardware #dukeBarman
Zero Day Initiative
Zero Day Initiative — MindShaRE: How to “Just Emulate It With QEMU”
MindShaRE is our periodic look at various reverse engineering tips and tricks. The goal is to keep things small and discuss some everyday aspects of reversing. You can view previous entries in this series here .
Threat Spotlight: Astaroth — Maze of obfuscation and evasion reveals dark stealer https://blog.talosintelligence.com/2020/05/astaroth-analysis.html #reverse #malware #dukeBarman
Cisco Talos Blog
Threat Spotlight: Astaroth — Maze of obfuscation and evasion reveals dark stealer
By Nick Biasini, Edmund Brumaghin and Nick Lister.
* Cisco Talos is detailing an information stealer, Astaroth, that has been targeting Brazil with a variety of lures, including COVID-19 for the past nine to 12 months.
* Complex maze of obfuscation and…
* Cisco Talos is detailing an information stealer, Astaroth, that has been targeting Brazil with a variety of lures, including COVID-19 for the past nine to 12 months.
* Complex maze of obfuscation and…
Ansible Security Assessment https://blog.quarkslab.com/ansible-security-assessment.html #exploitation #dukeBarman
Quarkslab
Ansible Security Assessment - Quarkslab's blog
Ansible is an open-source software automating configuration management and software deployment. Ansible is used in Quarkslab to manage our infrastructure and in our product Irma. In order to have an idea of the security of Ansible, we conducted a security…
Advanced Windows exploit development resources https://github.com/FULLSHADE/WindowsExploitationResources #exploitation #windows #dukeBarman
GitHub
GitHub - FULLSHADE/WindowsExploitationResources: Resources for Windows exploit development
Resources for Windows exploit development. Contribute to FULLSHADE/WindowsExploitationResources development by creating an account on GitHub.
Methodology for Static Reverse Engineering of Windows Kernel Drivers https://posts.specterops.io/methodology-for-static-reverse-engineering-of-windows-kernel-drivers-3115b2efed83 #reverse #windows #dukeBarman
SpecterOps
Blog - SpecterOps
Your new best friend: Introducing BloodHound Community Edition!
FI(le) SY(stem) - full file system fuzzing framework
Source: https://github.com/0xricksanchez/fisy-fuzz
Video from HITB 2020: https://www.youtube.com/watch?v=VNzKVOsn5qQ&feature=youtu.be&t=17032
Materials: https://github.com/0xricksanchez/HITB2020_FSFUZZER
#fuzzing #dukeBarman
Source: https://github.com/0xricksanchez/fisy-fuzz
Video from HITB 2020: https://www.youtube.com/watch?v=VNzKVOsn5qQ&feature=youtu.be&t=17032
Materials: https://github.com/0xricksanchez/HITB2020_FSFUZZER
#fuzzing #dukeBarman
GitHub
GitHub - 0xricksanchez/fisy-fuzz: This is the full file system fuzzing framework that I presented at the Hack in the Box 2020 Lockdown…
This is the full file system fuzzing framework that I presented at the Hack in the Box 2020 Lockdown Edition conference in April. - 0xricksanchez/fisy-fuzz
New mac debugger tutorial for IDA: Obj-C, kernelcaches, IOS apps https://www.hex-rays.com/wp-content/uploads/2020/05/mac_debugger_primer2.pdf #reverse #ida #dukeBarman
Hardware Root of Trust — Bios and UEFI https://maxfieldchen.com/posts/2020-05-31-Hardware-Root-Of-Trust-Bios-UEFI.html #reverse #hardware #uefi #dukeBarman
RCE vulnerability in Avast Antivirus by Project Zero Team https://bugs.chromium.org/p/project-zero/issues/detail?id=2018 #exploit #dukeBarman
JEB 3.19.1 is leaked today. You can find it here:
https://forum.reverse4you.org/
#reverse #tools #jeb #leaked
https://forum.reverse4you.org/
#reverse #tools #jeb #leaked
R0 CREW
r0 Crew is a community of low-level information security researchers.
FridaTrace++ – quick & dirty API monitor http://www.hexacorn.com/blog/2020/05/31/fridatrace-quick-dirty-api-monitor/ #frida #reverse #dukeBarman
A Frida based tool that traces usage of the JNI API in Android apps https://github.com/chame1eon/jnitrace #frida #android #reverse #dukeBarman
GitHub
GitHub - chame1eon/jnitrace: A Frida based tool that traces usage of the JNI API in Android apps.
A Frida based tool that traces usage of the JNI API in Android apps. - chame1eon/jnitrace
Applied Reverse Engineering: Accelerated Assembly [P1] https://revers.engineering/applied-re-accelerated-assembly-p1/ #reverse #dukeBarman
Reverse Engineering
Applied Reverse Engineering: Accelerated Assembly [P1] - Reverse Engineering
Part 1 of the x86_64 assembly crash course for people looking to learn how to reverse engineer, read assembly, and understand how exploits work.
Build Your Own iOS 13 Jailbreak Tweak for Beginners - Theos setup, Tweak Development (unc0ver) https://www.youtube.com/watch?v=jGWzc8UIHbk #videos #newbie #ios #dukeBarman
Analyzing Malware Techniques
Fileless Malware - A self loading technique
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-1/
A case of Powershell, Excel 4 Macros and VB6
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-2/
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-3/
I’m afraid of no packer
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-4/
#reverse #malware #Danus
Fileless Malware - A self loading technique
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-1/
A case of Powershell, Excel 4 Macros and VB6
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-2/
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-3/
I’m afraid of no packer
https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-4/
#reverse #malware #Danus
An IDA Pro Plugin for embedding an IPython Kernel (dark mode!) https://github.com/ChiChou/ida_ipython/tree/dark #reverse #ida #dukeBarman